Special Report – Retiring the OTP 2026

The report argues that the one-time password, long trading’s default second authentication factor, is being withdrawn rather than reinforced. The reason is technical rather than administrative. Modern phishing no longer just steals a password. A reverse-proxy sits between the customer and the real broker, copies the login page pixel for pixel, and passes everything the victim types, including the OTP, straight to the genuine site in real time. The broker then hands over a live session token to the attacker, not to the customer. In April 2025, Japan’s Financial Services Agency reported roughly 5,000 hijacked accounts across nine brokerages and 2,746 fraudulent trades worth close to USD 2 billion, executed this way.

Regulators have split into two camps. Hong Kong, Singapore and the UAE are banning OTP outright, with Hong Kong’s Securities and Futures Commission setting a hard deadline of 8 July 2027. The EU, UK and US are not banning OTP but are mandating stronger authentication standards, such as the EU’s dynamic linking and New York’s universal multi-factor authentication rule. India sits between the two positions. GreySpark’s recommended replacement rests on a credential that cannot be handed over: a passkey or a device-bound key, cryptographically tied to the genuine site, paired with a separate approval step for any money movement rather than treating login and payment as the same event.

The report is candid about the limits of this fix. Phishing-resistant login does not stop authorised push-payment fraud, malware inside an already-authenticated session, or coercion during account recovery, so it must sit within a wider defence that includes monitoring, hardened recovery and client education. It closes with a prioritised, jurisdiction-mapped control checklist and assigns implementation ownership to a named senior individual, reflecting regulators’ shift towards personal accountability.