Is SMS Two-Factor Authentication Safe?
The short answer: SMS 2FA is significantly better than no 2FA, but it has well-documented weaknesses that make it the weakest form of second-factor authentication available. Security experts and the US government's NIST guidelines have all recommended moving away from SMS-based authentication.
How SMS 2FA Works
When you log in with SMS 2FA, the server generates a code and sends it to your registered phone number via text message. You enter the code to prove you have access to that phone number. Simple in theory, but the weaknesses are in the delivery mechanism.
The Vulnerabilities of SMS 2FA
1. SIM Swapping (The Biggest Threat)
SIM swapping is when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they receive all your SMS messages, including 2FA codes.
Attacks typically work like this:
- Attacker researches you on social media, data breaches, and public records
- Calls your carrier impersonating you, armed with your personal details (last 4 of SSN, address, account PIN)
- Convinces the carrier to port your number
- Immediately resets passwords using SMS 2FA
High-profile SIM swap victims include Twitter CEO Jack Dorsey, multiple crypto exchange executives, and hundreds of regular users who lost hundreds of thousands in cryptocurrency. The FBI has issued multiple warnings about SIM swapping.
2. SS7 Network Vulnerabilities
SS7 (Signalling System No. 7) is the 1970s-era protocol that telecom networks use to route calls and SMS globally. It has well-known security flaws that allow sophisticated attackers (nation-state actors, criminal groups with telecom connections) to intercept SMS messages in transit without touching your phone or your carrier.
Researchers have demonstrated SS7 attacks live on television. While this requires significant technical resources, it has been used in targeted attacks against bank customers in Germany and elsewhere.
3. Malware on Your Phone
If your phone is infected with malware, the malicious app can read your incoming SMS messages, extract 2FA codes, and forward them to an attacker, all without you knowing.
4. Social Engineering
Attackers call victims, pretending to be from the bank's fraud department, creating a sense of urgency and asking them to read out the 6-digit "verification code" they just received. Many people comply. Authenticator app codes can also be phished this way, but the 30-second window makes it harder.
5. Phone Number Recycling
Carriers recycle phone numbers after an account is closed. If you change numbers and a previous account had your old number associated with SMS 2FA, the new holder of that number could potentially receive your codes.
How Authenticator Apps Fix These Problems
TOTP authenticator apps solve all of the above:
- No carrier involved — codes are generated on-device using a shared secret and the current time
- No SMS sent — nothing to intercept via SS7 or SIM swap
- Works offline — no network required at all
- 30-second expiry — intercepted codes are useless almost instantly
Generate and test TOTP codes right now with our free browser-based TOTP generator to see how it works without an app.
When SMS 2FA Is Acceptable
Despite its weaknesses, SMS 2FA is still worth using when:
- It's the only 2FA option offered by the service (better than nothing)
- The account doesn't contain high-value assets (a streaming account, a forum)
- You're protecting against mass automated attacks rather than targeted ones
SMS 2FA blocks 96% of bulk phishing attacks and 76% of targeted attacks, according to Google's research. It's just not in the same league as TOTP or hardware keys.
How to Switch from SMS to Authenticator App
- Download an authenticator app (Google Authenticator, Authy, Aegis, or Bitwarden)
- Log in to the account you want to upgrade
- Go to Security → Two-Factor Authentication settings
- Look for "Authenticator App" or "TOTP" as an option
- Scan the QR code or enter the secret key manually
- Enter the 6-digit code from the app to confirm
- Save your backup codes
- Optionally remove SMS as a 2FA method (or keep it as a backup)
Frequently Asked Questions
Should I disable SMS 2FA if I switch to an authenticator app?
For high-value accounts: yes, remove SMS as a 2FA method (or at minimum as the primary method) once you have an authenticator app set up. Attackers can often select which 2FA method to use leaving SMS enabled gives them a weaker target. For low-risk accounts, keeping SMS as a backup is fine.
Is email 2FA safer than SMS?
Not meaningfully. Email shares many of the same weaknesses if your email is compromised, it's useless as a second factor. Email codes also tend to have longer expiry times, increasing the window for interception.
My bank only offers SMS 2FA. What should I do?
Enable it it's still much better than nothing. Contact your bank to request TOTP or hardware key support. Consider using a separate, dedicated phone number (like a Google Voice number) specifically for banking SMS that isn't publicly associated with your identity.
Has anyone actually been SIM-swapped?
Yes, thousands of people. The FCC has documented widespread SIM-swapping fraud. In the crypto space alone, millions in losses are attributed to SIM swap attacks annually. It's not theoretical, it's an active, common attack.
