Trai plans uniform OTP format to curb scams

This is a Mint Premium article gifted to you.Subscribe to enjoy similar stories.

New Delhi: As one-time passwords (OTPs) become a routine part of online banking and shopping, the different formats in which these messages arrive can make it harder for users to distinguish genuine alerts from scams. The telecom regulator is now looking to standardize OTP messages across banks, online platforms and other companies to make them easier to recognize and harder for fraudsters to imitate, two people aware of the discussions said. Experts, however, see only limited effectiveness.

“The proposal to standardize OTP SMS templates has been discussed with telecom operators in a few meetings. Trai (The Telecom Regulatory Authority of India) is also expected to come up with a consultation paper on the same,” said one of the persons cited above, on the condition of anonymity.

In a few meetings with the operators, the regulator discussed the proposal to enhance consumer awareness and check misuse of OTP messages. A format of the OTP has also been proposed, the person added.

The plan to standardize its format could also involve mandating a few things such as the purpose for which the OTP was generated, the origin or sender of the message, the validity span for the number, among others, said the second person cited above.

Queries emailed to Trai and the Cellular Operators Association of India (COAI) on Monday did not elicit any response till the press time. COAI represents private telecom operators Bharti Airtel, Reliance Jio and Vodafone Idea.

Currently, the format of OTP messages differs from one company to another, creating confusion among users. For example, one of the issues is that some messages display the OTP directly on the screen, while others require users to open the full message to access the code.

Standardized OTP formats can help prevent codes from appearing in message previews, reducing the risk of others seeing them without opening the message.

According to the home affairs ministry, financial fraud complaints on the on the National Cyber Crime Reporting Portal rose to 2.402 million in 2025 from 262,000 in 2021. The amount involved in these complaints increased to ₹22,495 crore from ₹551 crore over the period. There were no specific numbers on frauds related to OTP misuse.

Some industry experts were sceptical about the plan's effectiveness.

“It appears to be an unnecessary exercise but there is no harm in standardization of OTP templates if it is benefiting users,” said Satya N. Gupta, former principal advisor at Trai.

According to Gupta, as far as standardization of OTP SMS content is concerned, it won’t lead to major tweaks in systems of companies but the regulator should not micromanage fixing the digits in the OTPs as that can increase compliance costs and technical difficulties.

“OTP-based authentication is powerful, and it is difficult to replace it with other methods. Users have to be more vigilant and careful as regulators and telcos are working to have mechanisms through technology solutions,” Gupta added.

The effectiveness of such a system will depend on whether the format includes features that users can reliably verify, rather than just bringing a uniform template, said Faisal Kawoosa, chief analyst at Techarc, a technology market research, analytics, and consulting firm.

"Standardization will help users, especially the new ones experiencing digital landscape in recognising genuine OTPs messages. They don’t have to educate themselves about various formats out there, which is susceptible to fraud as users honestly don’t know which ones to believe and which ones to ignore," said Kawoosa.

The challenge would be that the template could get copied by scamsters and also how all companies, especially the ones who are not based out of India, can be convinced to follow this format.

"They will follow what they have designed. Also, some of them are migrating to WhatsApp based OTP which is easy to manage as single provider covers whole universe instead of partnering with multiple bulk SMS providers to cover different countries," he added.

The regulator already requires companies sending bulk SMS, including OTPs, to register their message templates with the telecom operators. Operators are required to ensure that messages are sent through registered telemarketers and match the approved templates before delivery to users. Messages are checked against these registered templates before delivery, helping curb unauthorized changes and misuse.

Telecom operators have also introduced measures to combat SMS-based fraud, with Airtel launching a dedicated OTP fraud alert system, while Vodafone Idea and Jio have rolled out broader anti-spam and scam protection initiatives.

In a release of 9 October, the department of telecommunications (DoT) said its artificial intelligence (AI) and facial recognition-powered solution for telecom SIM subscriber verification (ASTR) has helped disconnect over 8.2 million fraudulent mobile connections.

The financial fraud risk indicator (FRI), a system that classifies mobile numbers based on their likelihood of being linked to financial fraud, has also helped prevent suspected financial losses exceeding ₹5,000 crore over 15 months, according to DoT.

Jatin is based in New Delhi and writes on telecom and technology with a keen interest in policy and regulation. With over five years of reporting experience across Informist Media, Financial Express and now Mint, he has extensively covered the telecom, information technology, electronics and semiconductor sectors.A commerce graduate, Jatin's work focuses on tracking industry developments, regulatory changes and policy decisions that shape India’s evolving digital ecosystem. Over the years, he has reported on key trends and shifts across these sectors, bringing clarity to complex policy and business issues.Known for his strong news sense, Jatin focuses on breaking stories and delivering in-depth reporting th…