SMS-Based Two-Factor Authentication is No Longer Effective

SMS two-factor authentication was a real upgrade when it arrived. A one-time code sent to your phone stopped the credential-stuffing that passwords alone could not, and for a while that was enough.

The window has closed. SIM swapping, SS7 interception, and real-time phishing have turned the SMS code into a second password the attacker can read too. It is time to stop treating it as a meaningful second factor.

A bit of boring history

The story starts where the password story does: a cheap factor that made sense in a simpler threat model. In the 2000s, banks, email providers, and social platforms started sending one-time codes by text message.

The threat model was straightforward: the attacker had your password (phishing, password reuse, a breach), and the code landed on a device they did not have. That assumption held while a phone number was tied to a physical SIM in a device you carried. Taking over someone's number meant getting their phone or persuading someone inside the carrier.

Why the threat model changed

SIM swapping is the headline. An attacker calls your carrier, talks support into believing they are you, or pays an insider, and your number is ported to a SIM they control. Every text that follows, including every 2FA code, lands on their phone. It has been a documented attack on crypto accounts for years, and the FBI has published consumer warnings about it.

SS7 is the quieter one. SS7 is the signaling network that moves calls and texts between carriers, and its flaws have been public since at least 2014. A number of carriers still do not protect SMS delivery over it properly, so an attacker with SS7 access can redirect your messages without ever touching your carrier account.

Then there is the unglamorous end: Android malware that reads incoming SMS, and adversary-in-the-middle phishing kits that grab the code in real time while you type it into a fake login page. None of this is exotic anymore. It is a service industry.

Why it now gives a false sense of security

Be fair to it first: SMS 2FA still beats no 2FA. If the only choice is an SMS code or nothing, take the SMS code. The problem is the other direction. Most security checklists, and most people, treat SMS as real 2FA, and it is not.

The code is not generated on a device you control, it travels over a channel you do not control, and the same phone number is usually the recovery path, so an attacker who takes the number can often reset the password too. That is a false sense of security, which is worse than an honest weakness.

NIST pushed SMS out of its recommended out-of-band methods in SP 800-63B back in 2016 and 2017, for exactly this reason: SMS is not a secure channel. Surprisingly, even colleagues working in the sector seem to be unaware of this fact.

The user-facing cost is lockouts. Lose the phone or change the number and the account becomes unreachable, which pushes people into weaker recovery flows or into writing codes down. The practice that was supposed to be frictionless security became the thing that makes every account both easier to steal and harder to get back into.

What to use instead

Make TOTP authenticator apps the floor. Aegis, 2FAS, Bitwarden Authenticator (but don’t let it handle both your passwords and 2FAS…), or the built-in ones are all fine.

The code is derived from a shared secret on your own device, it never travels over a network, and a SIM swap does not touch it.

Move to passkeys where the service supports them, which is most large ones now. A passkey is a WebAuthn credential tied to your device, it is phishing-resistant, and it replaces both the password and the code. For the accounts that matter most (email, password manager, domain registrar, bank), add a hardware key (Yubikey, …) or keep a passkey synced to a device you actually own.

Print the recovery codes. Store them in your password vault or a sealed envelope, because account recovery is where 2FA setups die. For the services that still force SMS, and some banks and government portals are still stuck there, keep it but know what it is: a weak second factor, not a strong one. The day the service adds TOTP or passkeys, switch. Do not wait for a prompt.

Drop the SMS-only default from your policies and your checklists. Require authenticator apps or passkeys, and treat any account that can only do SMS as an exception that needs extra monitoring, not as a box you can tick and forget.

Still using SMS codes on your email or bank? What did you move to, and what did the switch cost you? Drop it in the comments.

Until next time, keep your systems thoughtful.