The Question at Hand
Your authentication stack probably includes SMS One-Time Passwords. With passkeys now available, data shows they outperform SMS OTP on key metrics: success rate, speed, phishing resistance, and cost. So why are you still sending text messages?
This isn't theoretical anymore. More than one in three successful sign-ins now use a passkey (36%), up from roughly one in four in 2025 (26%). The shift is real. But deprecating a working authentication method, one your users know and your systems support, carries risk. The question isn't whether passkeys are better. It's whether you can afford to turn off SMS OTP, and when.
The Case for Full Passkey Migration
The performance gap is clear. Passkey sign-ins succeed 93% of the time compared to 78% for traditional Multi-Factor Authentication methods. This 15-point difference means fewer support tickets, less user frustration, and higher completion rates for critical workflows. Participants in the Passkey Index 2026 reported fewer successful phishing attacks and lower SMS OTP costs after deploying passkeys.
Speed is crucial. Passkey sign-ins are nearly three times faster, saving an average of 27 seconds per sign-in. Multiply that across thousands of daily authentications and you're looking at hours of recovered productivity per week. For customer-facing applications, that speed difference directly impacts conversion rates and abandonment.
Security is stronger with passkeys. SMS OTP is vulnerable to SIM swapping, interception, and social engineering. FIDO2-based passkeys use public-key cryptography bound to the device and origin. There's no shared secret to phish, no code to intercept, no carrier infrastructure to compromise. You're replacing a credential that can be stolen with one that can't.
Cost reduction is immediate. SMS delivery fees add up fast at scale, especially for global user bases where international rates apply. Passkeys eliminate that recurring expense entirely. Your identity provider still charges for authentication events, but you're not paying Twilio or AWS SNS for every login attempt.
The Case for Keeping SMS OTP Available
Passkey enrollment isn't universal yet. Even organizations with high adoption rates see 64% of sign-ins still using other methods. You can't force enrollment without locking out users who haven't completed setup, who use older devices, or who work in environments with strict device policies.
Device dependency creates new risks. Passkeys are tied to specific devices or synchronized through platform providers like Apple, Google, or Microsoft. If a user loses their phone and doesn't have a backup authenticator, they're locked out. SMS OTP works on any phone with a number, including borrowed devices in emergencies.
Cross-platform complexity remains real. A user who enrolls a passkey on their iPhone can sync it across Apple devices, but that passkey won't follow them to an Android tablet or Windows workstation unless you've implemented cross-platform passkey providers. SMS OTP works everywhere without platform lock-in.
Regulatory and compliance frameworks haven't caught up. Some standards still reference SMS-based Two-Factor Authentication as acceptable. If you're operating under specific compliance mandates, you may need written guidance that passkeys satisfy the requirement before you can deprecate legacy methods. That guidance exists for FIDO2 in most frameworks now, but procurement and audit teams move slower than technology does.
Where Practitioners Actually Land
Most IAM architects are running hybrid authentication for the next 18 to 24 months. They're prioritizing passkey enrollment for high-risk user populations first: administrators, finance teams, anyone with access to production systems or sensitive data. They're measuring adoption rates and success metrics before making deprecation decisions.
The pattern that's working: make passkeys the default option in the authentication flow, but keep SMS OTP available as a fallback during enrollment and for account recovery. Set a threshold, when passkey adoption hits 80% or 90% within a user segment, then announce a deprecation timeline for that segment specifically.
Segment by risk and capability, not by role. Your engineering team on MacBooks can probably go passkey-only next quarter. Your field sales team on mixed devices with inconsistent connectivity might need SMS OTP for another year. Your third-party contractors who don't have managed devices might need it indefinitely unless you issue them Multi-Factor Cryptographic Devices.
Our Take
Deprecate SMS OTP where you can prove passkey coverage, but don't set a company-wide deadline yet. The data supports full migration, the 93% success rate and phishing elimination are too significant to ignore. But the risk of locking out users who haven't enrolled or who work in edge cases outweighs the cost savings from eliminating SMS today.
Start with a phased approach: disable SMS OTP for new accounts starting next quarter. Require passkey enrollment for privileged access within 90 days. Measure your success and failure rates weekly. If you see passkey authentication failures climbing, investigate before you expand the rollout.
The argument for keeping SMS OTP indefinitely is weak. It's not whether you deprecate it, it's when and for whom. If your passkey success rate stays above 90% for a user segment over three months, and you've got a documented recovery process for lost devices, you can safely remove SMS OTP for that group.
Set the expectation now: SMS OTP is legacy infrastructure. Communicate that to your users, your support team, and your compliance reviewers. Give them a timeline. Make passkey enrollment frictionless. Then start turning off the text messages, one user segment at a time.
The 27 seconds you save per sign-in is nice. The phishing attacks you prevent are better. The support tickets you avoid when SMS delivery fails are worth the migration effort alone.
