Yes, sms spoofing is possible. Even if not really easy (you have to use specific hardware and know how it work).
One time login
Depending on how this is implemented on server, ideally one time login password mean a password useable only one time, then deleted immediately after use.
If someone obtains your one time pass and uses it, you yourself will not be able to connect. From there, you would have to report the problem to the site owner.
If you could connect with your password, nobody else could after you.
For this to correctly work, the site using this kind of method have to correctly check and delete password after 1st use.
Custom (Alice) come to an inscription formulare on Bob's Server site, to create
- All required identity fields
- A specific field One time password 1
- ... please re-enter One time password 1
Bob's Server create random One time password 2 for send by SMS to Alice's phone
Alice connect again to One time password verification, will have to correctly fill 3 fields:
- One time password 1 (from Alice)
- One time password 2 (from SMS)
If some third person (Charles) could obtain SMS, they have to know what Alice typed in first formulare (under HTTPS, of course!)
Of course One time passwords have to be deleted immediately after first use anyway.