Security Twitter argues about passkeys while your uncle still logs in with SMS codes—and both realities exist at once. Product leaders feel caught between “modern identity” slides and helpdesk tickets from users who lost access without understanding recovery paths.
This article avoids ideology. It explains where SMS OTP still earns its keep in 2026, where passkeys reduce phishing surface meaningfully, and how regional adoption differences (notably across EU, US, and major APAC markets) should influence your rollout—not your ego.
Where SMS still wins
- Universality: nearly every phone understands SMS—even when users refuse app installs.
- Operational simplicity: support scripts can be simpler than device-bound crypto recovery.
- Cross-border reality: some banks still anchor SMS as the lowest-friction second factor for broad demographics.
Where passkeys pull ahead
- Phishing resistance: fewer “wrong-site OTP paste” incidents.
- Device-bound clarity: credentials live with hardware-backed protections where enabled.
- UX speed: fewer clipboard dances than SMS when implemented well.
A layered mental model
Treat factors by risk tier: passkeys (or security keys) on crown-jewel accounts; SMS as convenience or fallback where appropriate; authenticator apps where passkeys are immature for your audience.
The builder's view: which factor should your product offer?
Most passkeys-vs-SMS commentary is written for end users; this one is for the people choosing what to ship. If you run signup and login flows, the question isn't abstract superiority — it's conversion, support load, fraud cost, and recovery debt across your actual user base. The factors win in different columns, and the strongest products deploy both deliberately rather than crowning one.
Scorecard by concern
- Phishing and credential-stuffing resistance: passkeys, decisively — origin-bound cryptography can't be proxied through a fake login page. If account takeover is your top loss driver, this alone justifies shipping them.
- Signup abuse pricing: SMS wins by default, because passkeys can't do this job. A new-account phone check exists to attach a scarcity cost to registration; it verifies reachability of a number, not identity. (Design honestly for the fact that privacy-conscious legitimate users will verify with virtual numbers — behavioral risk scoring beats blanket range-blocking on both fraud catch-rate and false positives.)
- Coverage and conversion: SMS reaches every phone on earth today; passkey support still varies across browsers, OS versions, and user savvy. Passkey-only signup is a conversion cliff for any mainstream audience in 2026; passkey-optional with SMS fallback captures both curves.
- Support and recovery cost: a wash, interestingly. SMS generates "code never arrived" tickets (routing, filtering, rate limits); passkeys generate "new phone, no access" tickets where the credential died with the device and no sync existed. Both demand a designed recovery ladder — backup codes remain the unglamorous backbone.
- Cost per authentication: passkeys, overwhelmingly: SMS costs real money per message forever, plus pumping-fraud exposure; passkeys cost engineering once.
The deployment pattern that wins
Ship SMS where it's irreplaceable (signup reachability checks, the universal fallback), passkeys as the promoted default for returning login, TOTP for the security-conscious middle, and backup codes under everything. Then measure per-cohort takeover rates and support tickets rather than arguing from principle — the data will tell you how fast to push passkey adoption for your audience, and it will say "faster than you think, but never to one hundred percent."
Key takeaways
- Stop framing it as war—layer defenses instead.
- Invest in recovery—passkeys shift failure modes.
- Publish honest guidance for users switching devices.
In short
Passkeys and SMS answer different constraints—phishing resistance versus ubiquity. Strong posture combines both thoughtfully, with recovery planned deliberately.