Stop Using SMS for Two-Factor Authentication. Here's What to Use Instead
A former colleague lost access to a fairly significant amount of money through a SIM swap that started with nothing more exotic than a phone call to their carrier's support line. The technical part of the attack was almost boring. That is what makes it worth explaining properly.
A code sent by text is only as secure as the phone number it travels to, and phone numbers can be stolen.
In this post
- Why SMS 2FA became the default in the first place
- SIM swapping, in plain terms
- SS7 interception: the less common but real backup risk
- What to use instead, ranked by strength
- How to actually switch over without locking yourself out
Two-factor authentication is genuinely one of the highest-value security habits an average person can adopt, and I do not want this post to be read as an argument against using it. The argument is narrower and more specific: the method matters, and SMS, while much better than no second factor at all, is the weakest common option available, for reasons that have nothing to do with the strength of the code itself.
Why SMS 2FA became the default in the first place
SMS-based codes became standard for an understandable reason: almost everyone already has a phone number, and no app download or extra setup step is required. From an adoption standpoint, that convenience mattered, and it is a large part of why SMS 2FA rolled out as widely as it did years before stronger alternatives were common. The convenience that made it spread is the same convenience that keeps it the weakest option, since the security of the method rests entirely on trusting the phone network itself, a system that was never designed with this use case in mind.
SIM swapping, in plain terms
This is the attack that matters most for ordinary people. A SIM swap does not require hacking your phone at all. An attacker who has gathered enough of your personal information, often from data breaches, social media, or basic research, contacts your mobile carrier pretending to be you, and convinces a support representative to transfer your phone number to a SIM card they control. From that point forward, any SMS code meant for you, including account recovery codes and 2FA codes, goes straight to them instead.
This attack has been responsible for a well-documented wave of cryptocurrency theft and account takeovers, serious enough that the Federal Communications Commission has published guidance directly addressing SIM swap fraud and the steps carriers and consumers can take against it. The vulnerability is not in your phone's security, it is in a stranger's ability to talk a call center employee into making a change.
SS7 interception: the less common but real backup risk
A second, less common attack targets a decades-old telecom signaling protocol called SS7, used to route calls and texts between carriers globally. Documented vulnerabilities in SS7 have allowed sophisticated attackers to intercept SMS messages in transit without ever touching your device or your carrier account directly. This attack requires considerably more resources and access than a SIM swap, so it is a lower everyday risk for most people, but it is a real, demonstrated weakness that has nothing to do with anything you personally did wrong, and no amount of personal caution defends against it.
What to use instead, ranked by strength
| Method | How it works | Strength |
|---|---|---|
| Authenticator app | Generates a rotating code locally on your device, no network transmission involved | Strong, and free |
| Hardware security key | A physical device you plug in or tap to confirm login, resistant to phishing by design | Strongest widely available option |
| Passkeys | Device-bound cryptographic credentials replacing the password and 2FA step entirely | Very strong, and growing fast in support |
| SMS codes | A code sent by text message | Weakest, but still far better than no second factor |
Authenticator apps, like Google Authenticator, Authy, or Aegis, generate a time-based code entirely on your device, with nothing transmitted over the phone network at all, which closes off both the SIM swap and SS7 risks completely, since there is no phone number involved in the process to attack.
How to actually switch over without locking yourself out
- Start with your most sensitive accounts: your primary email, your bank, and anything tied to financial or identity recovery, since a compromised email account often becomes the key to resetting everything else
- When enabling an authenticator app, always save the backup codes the service provides during setup, somewhere secure and separate from the device running the app itself
- If a service offers a hardware security key option and you are willing to buy one, register it as your primary method with the authenticator app as backup
- Do not remove SMS as a fallback option immediately if that is all a particular service supports, some smaller services still only offer SMS, in which case it remains meaningfully better than nothing
- Ask your mobile carrier about adding a PIN or passphrase requirement for any account changes, which adds a real obstacle against SIM swap attempts even if you still use SMS somewhere
To be clear: SMS 2FA is still a meaningful improvement over a password alone, and if it is genuinely the only option a service offers, use it rather than skipping two-factor authentication entirely. The point of this post is not to scare anyone away from SMS 2FA into using nothing. It is to make the case that fifteen minutes spent switching your most important accounts to an authenticator app is one of the higher-value security habits available to an average person, for very little ongoing effort.
The gap between SMS and an authenticator app is not subtle once you understand what each one is actually resistant to. If you take one concrete action after reading this, make it switching your primary email account away from SMS-based 2FA specifically, since that one account is usually the master key to recovering everything else.