[guffins]

Many sites do allow logging in with just an SMS OTP, no password required (even if you’ve set a password for the account). If it absolutely must be used (it shouldn’t), then SMS OTP should be a second factor, not the only factor.