Two-factor authentication for Indian businesses: SMS versus TOTP versus passkeys and security keys, banking rules, and what the IT Act says.
Two-factor authentication is still worth it, but SMS one-time passwords are the weakest useful form of it, because the code travels over a network an attacker can reach, and India has seen SIM porting, message interception and AI voice cloning used against exactly this channel. The stronger options are an authenticator app, a passkey, and a hardware security key, and the 2026 Indian guidance is explicit that a bank should not rely on a channel the customer can be socially engineered into reading aloud. For a business, deploy MFA on remote and privileged access first.
Four reasons, all specific to how Indian fraud actually works. SIM porting, where a social engineering call to the operator moves the number to an attacker device, which then receives the code. Message interception, which historically required malware on the device and now includes apps that read notifications. OTP relay, where the customer is asked to read the code aloud to a fake agent, which no technical control stops but a better script and a policy do. And voice cloning, which the I4C flagged in June 2026 when it warned that deepfakes defeat facial authentication and video-based KYC. A second factor is only as strong as the channel it arrives on, and in India the phone number is the least protected channel most people own.
Four stages, and the order matters because each stage removes more risk per rupee. Stage one, MFA on remote access, privileged accounts, email, cloud consoles and code signing, because those credentials are the ones that reach everything else; this is where a hardware security key or a passkey earns its cost. Stage two, MFA on customer and staff logins to internal applications, using an authenticator app at minimum. Stage three, phishing-resistant factors for the finance team, the administrators and anyone who can move money, because that is where the documented Indian losses are, such as the Rs 10 crore voice-cloned MD case. Stage four, removal of SMS as an authentication method for anything above low risk, and removal of shared accounts entirely, because a shared account cannot have a second factor at all.
At enrolment and recovery, which is where the real breach is. If a support desk can disable MFA on an account after a phone call with a persuasive caller, the second factor is decorative, and Indian fraud in 2026 is heavily voice-based for exactly that reason. The controls that fix it: recovery requires a stronger factor than the one being recovered, such as a passkey or a security key plus a callback to a number on file. MFA removal or downgrade requires a named approver and produces a log entry. Enrolment of a new device is alerted to the account owner out of band, immediately. Suspicious activity triggers a step-up, not a silent bypass. And every one of these events is logged and retained for 180 days, as CERT-In requires, because the audit trail is what proves the control held.
Section 43 of the Information Technology Act, 2000 makes unauthorised access to a computer, computer system or computer network an offence, so a defeated authentication step that is exploited becomes a criminal matter rather than a support ticket. CERT-In's directions require 6-hour reporting of listed incidents and 180 days of log retention, and the authentication logs are usually the first evidence set an investigator asks for. Banks in India operate under RBI's cyber security framework, which expects strong authentication for internet banking, and insurers increasingly expect evidence of phishing-resistant MFA at renewal. In short, MFA is moving from a best practice to a documented, evidenced control, and a business that cannot evidence it will find it reflected in premiums and in audit findings.
| Factor | Resistance | Recommended use |
|---|---|---|
| Hardware security key | Highest | Privileged access, finance, code signing |
| Passkey | High | Customer login, remote access where supported |
| Authenticator app | High | General staff and customer MFA |
| Push approval with number matching | Medium | Interim where a key is not yet deployed |
| SMS OTP | Low | Recovery only |
| Shared account, no factor | None | Not permitted |
Two-factor authentication is still worth it, but SMS one-time passwords are the weakest useful form of it, because the code travels over a network an attacker can reach, and India has seen SIM porting, message interception and AI voice cloning used against exactly this channel. The stronger options are an authenticator app, a passkey, and a hardware security key, and the 2026 Indian guidance is explicit that a bank should not rely on a channel the customer can be socially engineered into reading aloud. For a business, deploy MFA on remote and privileged access first.
A hardware security key for privileged and finance accounts, and a passkey for everything else. Both are phishing-resistant, which means a proxied login page cannot capture them, and neither depends on the mobile number that SIM porting attacks.
Because the code is delivered over the telecom network to a number that can be ported to an attacker, intercepted by malware, or read aloud to a fraudster on a call. In India all three techniques are in active use, and the I4C warned in June 2026 about AI deepfakes defeating facial authentication and video-based KYC as well.
At recovery and enrolment. If a support desk can disable a second factor after a persuasive phone call, the control is decorative. Recovery should require a stronger factor than the one being recovered, removal should need a named approver and produce a log entry, and new device enrolment should alert the account owner out of band.
There is no single blanket MFA rule for all Indian businesses, but the expectation is strong. Section 43 of the Information Technology Act, 2000 makes unauthorised access an offence, CERT-In's directions require 6-hour reporting of listed incidents and 180 days of log retention, and RBI's cyber security framework expects strong authentication for internet banking.
Yes. AAVETech tests MFA, recovery and session handling as a named area inside a fixed-price penetration test at roughly Rs 12,000 to Rs 30,000 per tester-day plus 18% GST, in 5 to 10 working days with a signed rules-of-engagement document and a retest included.
Read the full guide on AAVETech: Is Two-Factor Authentication Still Worth It if It Uses SMS?.
Send us your list of applications and privileged accounts and we will return a fixed-price MFA and account recovery assessment with a written scope.
Talk to an analyst about this.