Most services offer both SMS and authenticator app 2FA. They're not equally secure. Here's a clear breakdown of the differences so you can make the right choice.
In This Guide
How Each Method Works
SMS 2FA
The service sends a one-time code to your phone number via text message. You enter the code to complete login. The code lives on the phone network and travels through SMS infrastructure.
Authenticator App (TOTP)
An app on your phone generates a 6-digit code every 30 seconds using a shared secret key and the current time. The code never leaves your device. You enter it to complete login.
Why SMS 2FA Is Vulnerable
SIM Swapping
An attacker calls your mobile carrier, impersonates you, and convinces them to transfer your phone number to a new SIM. Once they control your number, they receive all your SMS 2FA codes. This attack has been used to steal millions from crypto accounts.
SS7 Protocol Attacks
The SS7 protocol — the backbone of the global phone network — has known vulnerabilities that allow sophisticated attackers to intercept SMS messages in transit. This is a known attack vector used by intelligence agencies and advanced threat actors.
Phishing
Fake login pages can prompt you to enter your SMS code in real-time, forwarding it to the attacker who simultaneously logs in with your credentials.
Why Authenticator Apps Are More Secure
- Offline generation: Codes are generated on your device — no network required, nothing to intercept
- Not tied to your phone number: SIM swapping doesn't affect TOTP codes
- Short expiry: Codes expire in 30 seconds, making replay attacks impractical
- No SS7 vulnerability: The phone network is not involved at all
Verdict
Use an authenticator app whenever the option is available. SMS 2FA is significantly better than no 2FA at all, but it has real vulnerabilities that authenticator apps completely avoid.
The only scenario where SMS might be preferable is if you frequently lose access to your phone and need carrier-based recovery — but in that case, make sure your phone number is on a carrier with strong identity verification for SIM changes.