SMS codes for two-factor: better than nothing, weaker than it looks

What people mean by “SMS code”

“SMS code” names at least three different things. The most common sense, and this page’s subject, is a one-time passcode that a bank, an email provider or a social network texts to confirm a sign-in. NIST’s own glossary of secrets describes it as an out-of-band secret: “a short-lived secret generated by a verifier and independently sent to a subscriber’s device to verify its possession”.

A second sense belongs to marketing, not account security. The Short Code Registry, run by the wireless trade association CTIA, defines a short code as “a five- or six-digit number that can be used to send and receive text messages”, leased for $500 to $1,000 a month to send alerts, loyalty offers and coupons — not to verify a sign-in. Amazon Web Services, which sells short-code infrastructure, notes that OTP and two-factor codes can also travel over one, part of why the two meanings blur together.

A third sense is a product in its own right: a phone number sold so a buyer can receive someone else’s verification code. SMSCodes.io, which sells access to real SIM numbers for exactly this, advertises them as a way to create and verify accounts, and Get SMS Code, an Android app selling temporary virtual numbers, markets the same idea as a way to register without handing over a personal phone number. Neither product is the one-time code itself — both are a stand-in for the phone number behind the code. The rest of this page is about the first meaning.

Is an SMS code better than no second factor at all?

Yes, measurably. CISA, the US cybersecurity agency, puts it plainly: “any MFA is better than no MFA”, even while ranking some methods well above others. A 2019 study by Google, with researchers from NYU and UC San Diego on real Google Accounts, put a number on that gap: an SMS code to a recovery phone number blocked 100% of bot attacks, 96% of bulk phishing and 76% of attacks aimed at a specific person.

The same study measured a safer alternative side by side: an on-device prompt, which Google calls “a more secure replacement for SMS”, blocked 100%, 99% and 90% against the identical three attack types. Simply adding a recovery phone number, without ever sending a code to it, already blocked up to 100%, 99% and 66%; without one, Google’s fallback knowledge challenges saw phishing protection drop as low as 10%. Zero users who relied exclusively on a physical security key fell victim to targeted phishing during the whole investigation — the ceiling the SMS code does not reach.

Why NIST calls the SMS code a restricted authenticator

The US federal digital-identity standard gives the clearest answer. NIST finished a full rewrite, Special Publication 800-63, Revision 4, in July 2025, after nearly four years and almost 6,000 public comments. It states flatly: “there is one restricted authenticator: the use of the PSTN for out-of-band authentication” — PSTN meaning the ordinary phone network carrying an SMS or voice call. Nothing else used for a second factor carries that label.

Restricted is not a ban. NIST still lets an organisation use the method, but only under conditions: offer at least one alternative that is not restricted, give subscribers meaningful notice of the risks, and keep a migration plan ready. The reasoning is direct: “Out-of-band authentication is not phishing-resistant.” The split between two-factor and two-step is separate — a method can be a genuine second factor and still sit in NIST’s weakest tier.

One more requirement matters for a common habit: NIST says a device should not show the secret on a locked screen, and should ask for a PIN, passcode or biometric first. It also tells verifiers to weigh risk signals such as a device swap, SIM change or number port before trusting the phone network to deliver a code — the mechanism the next section explains.

What a SIM swap and a port-out actually do to the code

The two frauds behind most of this risk have official, distinct definitions from the FCC, the US telecoms regulator. “SIM swapping takes place when a bad actor convinces a victim’s wireless carrier to transfer the victim’s service from the victim’s cell phone to a cell phone in the bad actor’s possession”, the FCC states. Port-out fraud is a separate route: “the bad actor, posing as the victim, opens an account with a carrier other than the victim’s current carrier”. Either way, the FBI’s IC3 explains what follows: criminals use the SMS code sent to the stolen number to log in and reset passwords.

The FBI’s own figures show the problem growing: 320 SIM-swap complaints and about $12 million in adjusted losses from January 2018 to December 2020; in 2021 alone, 1,611 complaints and more than $68 million. One case shows what a single swap can be worth: journalist Brian Krebs reported that three Americans were charged with stealing more than $400 million in a November 2022 SIM-swap tied to the FTX exchange, after impersonating an AT&T customer at a retail store with a fake ID. An independent blockchain-analysis firm, Elliptic, put the stolen value at $477 million. The FCC’s 2023 rules now require carriers to use secure authentication before moving a number, and to notify the customer whenever a SIM change or port-out request is made. The FTC, the US consumer-protection agency, adds that “text message verification may not stop a SIM card swap” and recommends a PIN or password on the cellular account. A swap already underway needs different steps than the ones here.

How a code gets phished in real time

A SIM swap is not the only way an SMS code changes hands. CISA’s own account of a real intrusion describes an employee talked through the theft by a caller posing as IT support, who received the employee’s username, password and six-digit MFA code. CISA calls it a real risk, not a theoretical one: “these ‘MFA bypass’ attacks are not theoretical risks but are happening in the wild even against well-funded companies with excellent security staff”. It sums up the moment that defeats the code: “The employee then gets an authentication code on their phone, they type that in and bam! Problem solved. Disaster averted.” — except the code went to the attacker’s page.

The code never has to be intercepted: the victim hands it over, believing the request is legitimate. This is why CISA’s case for a resistant alternative is mechanical, not procedural: because only the key owner has physical access to the device, CISA says, “phishing scams don’t work”. Even Login.gov, a government service that still offers SMS, describes text and phone-call codes as convenient but “extremely vulnerable to theft, hackers, and other attacks”. The habit that defeats this attack is simple: never hand a verification code to someone who calls or messages asking for it.

What Google, Apple and Microsoft recommend instead

All three companies now steer people away from the SMS code in their own words. Microsoft, announcing it is phasing SMS out of personal accounts, states the reasoning outright: “SMS-based authentication is now a leading source of fraud” and “one of the most targeted vectors for account takeover”. In its place, Microsoft offers “a recovery email address, Microsoft Authenticator, or a passkey”, describing passkeys as “secure, phish-resistant replacements for your password”.

Google’s own help page recommends Google prompts instead of SMS verification codes, while listing another signed-in phone, a backup code, a security key or a passkey as recovery options. Apple keeps the six-digit code as its everyday method but offers a stronger step: “physical security keys provide extra protection for your Apple Account against phishing attacks”, because, once enabled, they become the only way to sign in, stopping the second factor being “remotely intercepted or requested by an attacker”. The trade-off: lose every device and key at once, and the account can be locked for good. Of the options available today, CISA singles out one: “The only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” An authenticator app rejecting codes, rather than the SMS code itself, is a different problem.