SMS-based two-factor authentication gets a lot of criticism from security researchers — but it also protects billions of accounts from being compromised every day. The truth is more nuanced than "SMS 2FA is bad." Here is an honest assessment of what SMS 2FA protects against, where it fails, and when you should upgrade.
In This Guide
What SMS 2FA Protects Against
SMS 2FA is highly effective against the most common forms of account attack. It blocks virtually all automated credential stuffing attacks — where attackers test billions of leaked username/password combinations against websites. Even if your password has been exposed in a data breach, an attacker with just your password cannot access your account because they do not have your phone.
It also stops most phishing attacks. A phishing page that captures your password cannot use it without also capturing your SMS code, and SMS codes expire quickly. This requires the attacker to operate in real time, which significantly raises the bar.
Google's research found that adding any 2FA — including SMS — blocks 100% of automated bot attacks on their platform. For most people, SMS 2FA is a major improvement over password-only security.
Where SMS 2FA Falls Short
SIM swapping: This is the most well-known weakness. An attacker contacts your mobile carrier, impersonates you using personal information gathered from social media or data breaches, and requests a transfer of your phone number to a new SIM. Once successful, they receive all your SMS messages including 2FA codes. SIM swapping has been used to steal millions of dollars in cryptocurrency and take over high-profile social media accounts.
SS7 attacks: SS7 is the ageing signalling protocol that underpins the global phone network. Security researchers have demonstrated that attackers with access to SS7 infrastructure (typically nation-states or well-resourced criminal organisations) can intercept SMS messages anywhere in the world. This is a sophisticated attack beyond the reach of typical cybercriminals.
Malware: If your phone is infected with malware that has access to your SMS messages, an attacker can read your 2FA codes in real time. This is rare but possible.
Real-time phishing: A sophisticated phishing proxy can relay your SMS code to the real service before it expires. This requires a targeted, well-crafted attack rather than a mass campaign.
Who Is Most at Risk from SMS 2FA Weaknesses?
The weaknesses of SMS 2FA are most relevant to high-value targets. If you hold significant cryptocurrency, are a public figure with a large social media presence, run a business with financial accounts, or are otherwise likely to be specifically targeted, SMS 2FA is not adequate protection. Use an authenticator app or hardware security key instead.
For the average person protecting a social media account, email, or streaming subscription, SMS 2FA provides very strong protection against the realistic threats you actually face. Opportunistic attackers running credential stuffing campaigns do not attempt SIM swaps — they move on to easier targets.
The Verdict: Use SMS 2FA If It Is Your Only Option
SMS 2FA is far better than no 2FA. If a service only offers SMS as its 2FA method — which is still the case for many banks and financial services — use it. Do not skip 2FA because SMS is imperfect.
If a service offers both SMS and an authenticator app, choose the authenticator app. It is more secure, works offline, and cannot be compromised by SIM swapping or carrier-level attacks. The extra effort of opening an app to copy a code is minimal compared to the additional protection it provides.
Upgrading from SMS to an Authenticator App
Most services that offer SMS 2FA also support authenticator apps. To switch, go to your account's security settings, find the 2FA section, and look for an option to add or change your verification method. You will typically scan a QR code with your authenticator app and confirm with a code. Once the authenticator app is verified, you can remove SMS as your primary method (though keeping it as a fallback is reasonable).