Why shouldnt you use SMS for two-factor authentication and what are the alternatives?

Two-factor authentication (2FA) adds an important layer of security to your online accounts, but unfortunately, not all methods are created equal. Many people rely on SMS-based 2FA, thinking it's a secure option. Unfortunately, SMS isn't perfect. Here's why you should stop using SMS for 2FA and what you can use instead…

SIM Swapping Lets Hackers Steal Your Phone Number

One of the most alarming risks of using SMS for 2FA is SIM swapping, a technique where attackers trick your mobile service provider into transferring your phone number to a new SIM card. Once they have control of your number, they can intercept any SMS messages sent to that number.

Here's how it works: An attacker contacts your mobile carrier, pretending to be you. Using stolen personal information—such as your address or the last four digits of your Social Security number—they convince the carrier to port your phone number to their SIM card. Once the porting is complete, the attacker intercepts text messages sent to your number, including the 2FA code meant to protect your account.

The damage doesn't stop there. Many of us associate our phone numbers with multiple accounts, from email to social media to banking apps. A successful SIM swap can give an attacker access to multiple accounts linked to your phone number, from email to banking apps. Our previous guide to what SIM swapping is and how to protect yourself can help you avoid this increasingly common scam.

SMS messages can be intercepted

Even if you avoid SIM swapping, SMS messages themselves are still not secure. They travel over networks that are vulnerable to interception. Hackers can exploit weaknesses in Signaling System No. 7 (SS7), the global telecommunications protocol that allows carriers to route calls and text messages. By exploiting SS7, attackers can intercept SMS messages without having access to your physical phone.

This isn’t just theoretical; SIM hacking is a known problem. Cybercriminals and even some state-sponsored groups have used the SS7 vulnerability to spy on communications and steal sensitive information. Since SMS messages are not encrypted, the contents of the message, including one-time passcodes, are exposed in transit.

Another way messages can be compromised is through malicious apps or spyware installed on your device. These programs can monitor your incoming SMS messages and relay 2FA codes to the attacker without your knowledge.

SMS is linked to your phone number

Another significant drawback of SMS-based 2FA is that it relies on your phone number. Your ability to receive codes is directly tied to your cellular service. If you’re in an area with poor coverage, SMS-based 2FA will be completely useless, even over Wi-Fi . Unlike other authentication methods that can work over an Internet connection, SMS requires a stable cellular signal.

This reliance can leave you stranded in situations where you need to access your account but can’t receive a code. Whether you’re traveling to a remote location or simply in a building with poor reception, this limitation makes SMS less reliable than alternative methods.

Alternative: Authenticator App

Instead of relying on SMS for 2FA, turn to 2FA authenticator apps. Apps like Google Authenticator, Microsoft Authenticator, and Authy generate timed one-time passwords (TOTP) directly on your device, providing a much more secure and reliable alternative to SMS.

The first big advantage of authenticator apps is security. Unlike SMS, these apps generate codes locally on your phone, meaning they aren't transmitted over a network where they can be intercepted or exploited. They're also protected by additional layers of security — many require a passcode, fingerprint, or facial scan to access the code.

Another reason people like authenticator apps is their offline functionality. Since the codes are generated directly on the device, you don’t need a cellular connection to use them. Whether you’re in a remote area without service or just in a house with poor reception, you can still access your codes as long as you have your device.

People prefer Authy over other authenticator apps because it offers cloud backups, making it easy to restore your account if you lose your phone. It also secures those backups with encryption, ensuring that only you can access them. Google Authenticator is another popular choice. Both options are free, widely supported, and easy to set up.

Using an authenticator app is simple. Once set up, usually by scanning a QR code provided by the website during the 2FA setup process, you just open the app to access the code whenever you log in. The code refreshes every 30 seconds, so even if someone steals a code, it becomes useless immediately.

Two-factor authentication is essential to keeping your accounts safe, but the method you use matters. While SMS-based 2FA may seem convenient, it’s fraught with vulnerabilities—from SIM swapping to interception methods to even practical issues like poor cell coverage. These risks make SMS an unreliable safeguard for your online security.