TL;DR: SMS two-factor authentication is much better than a password alone, but it’s the weakest kind of 2FA. Text codes can be stolen through SIM swaps, intercepted inside the SMS delivery chain, or typed into a phishing site. The US cybersecurity agency CISA now says plainly: “Do not use SMS as a second factor for authentication.” For most accounts, switch to an authenticator app (Google Authenticator, Microsoft Authenticator or Apple Passwords). For your most important accounts, use passkeys or a security key, the only options that resist phishing. Then turn SMS off, because adding an app doesn’t remove the text-message fallback.
Last updated: October 14, 2026. Checked against CISA, FBI IC3, Microsoft, Apple, Google and US carrier documentation.
You turned on two-factor authentication, and every login now sends a six-digit code to your phone. Then you read that SMS 2FA is “broken.” So which is it? Is SMS 2FA safe, or are you only slightly better off than before?
The honest answer is somewhere in between. Here’s what the real risks are, who should worry most, and exactly how to move to something stronger.
Is SMS 2FA safe?
It’s safe enough to stop most mass attacks, but not safe enough for valuable accounts. A text code stops an attacker who only has your leaked password, which is how most account takeovers start. It doesn’t stop a targeted attacker who can get your codes another way.
CISA’s mobile communications guidance, written for high-risk people but useful for everyone, says SMS messages “are not encrypted” and that “SMS MFA is not phishing-resistant.” It recommends authenticator codes for less valuable accounts and phishing-resistant FIDO methods, such as passkeys and security keys, for the rest.
Microsoft has reached the same conclusion for business accounts. Its Entra ID service says “SMS and voice are no longer positioned as secure authentication methods,” made passkeys the default from September 1, 2026, and retires Microsoft-provided SMS and voice sign-in from February 1, 2027.
Is SMS 2FA better than nothing?
Yes, clearly. If a site only offers SMS codes, turn them on. Without 2FA, anyone with your password from a breach can sign in. With SMS 2FA, they also need your phone number, which takes far more effort. The problem isn’t that SMS is useless. It’s that people stop there for accounts that deserve better.
What are the risks of SMS 2FA?
Four main ones: SIM swapping, interception in the SMS supply chain, phishing, and weak recovery.
| Risk | How it works | Stops it |
|---|---|---|
| SIM swap | Criminal talks your carrier into moving your number to their SIM | Carrier SIM lock; not using SMS |
| SMS interception | Codes read by someone with access to telecom or SMS gateway systems | Authenticator app or passkey |
| Phishing | You type the code into a fake site, which relays it instantly | Passkeys or security keys only |
| SMS fallback / recovery | Attacker picks “text me a code” even after you add an app | Turning SMS off |
What is SIM swapping?
A SIM swap is when a criminal gets your phone number moved to a SIM card they control. The FBI explains that criminals contact your carrier in a store or by phone, pass identity checks with your personal details, and get the number transferred. Your texts, including 2FA codes, then go to them.
The FBI’s Internet Crime Complaint Center received 971 SIM swap complaints in 2025, with reported losses of about $17.4 million. That’s down from 982 complaints and about $26 million in 2024, and about $48.8 million in 2023, according to the 2024 report. Those are only reported cases.
Can SMS codes be intercepted?
Yes, by anyone with access to the networks and companies that deliver them. Most services send codes through third-party bulk-SMS gateways. In April 2025, the Security Alliance (SEAL) reported a compromised SMS gateway that let a Telegram bot intercept codes from at least 50 services, including Google, Microsoft, Apple and Amazon. Claims of new SMS-provider breaches surface regularly, and big breach headlines, such as the recent Stop & Shop cyber attack, tend to bring a wave of fake “verify your account” texts. You can’t control which gateway a company uses, so the safest assumption is that a text isn’t private.
SMS 2FA vs authenticator app: which is safer?
An authenticator app is safer because the code never leaves your phone. The app and the website share a secret when you set it up, and both calculate the same code every 30 seconds. There’s nothing to intercept and no phone number to steal.
| SMS codes | Authenticator app | Passkey / security key | |
|---|---|---|---|
| SIM swap | Vulnerable | Safe | Safe |
| Interception | Vulnerable | Safe | Safe |
| Phishing | Vulnerable | Vulnerable | Resistant |
| Works without signal | No | Yes | Yes |
| Setup effort | Lowest | Low | Low (per site) |
Authenticator apps aren’t perfect. CISA notes they’re “still vulnerable to phishing,” because you can still type an app code into a fake page. That’s why passkeys sit at the top.
How do I switch from SMS 2FA to an authenticator app?
Add the app in each account’s security settings, test it, then remove the phone number as a 2FA method. You can use any standard authenticator. Three free options:
- Apple Passwords (iPhone, iPad, Mac): in the site’s security settings, choose the authenticator app option. Then, per Apple, open Passwords, select the account, and choose Set Up Verification Code. On iPhone you can touch and hold a QR code and choose Add Verification in Passwords. Codes then autofill.
- Google Authenticator: for your Google Account, go to 2-Step Verification in your Google Account security settings, choose Authenticator, and scan the QR code.
- Microsoft Authenticator: works the same way for other sites, and adds push approvals for Microsoft accounts.
The step people miss: turn SMS off afterward. CISA warns that “enrollment in authenticator-based MFA does not automatically unenroll the account’s SMS,” leaving “a weak fallback mechanism.” Save the backup codes the site gives you somewhere safe, such as your password manager, so you don’t need SMS as a fallback.
Some banks and services still only offer SMS. Keep it on there, and protect your number (below).
Passkeys vs 2FA: should I use passkeys instead?
Yes, wherever a site offers them. A passkey replaces both the password and the code with a cryptographic key on your device, unlocked by your face, fingerprint or PIN. It only works on the real website, so a phishing page gets nothing. CISA calls FIDO authentication the only phishing-resistant option and tells people to enroll their “Microsoft, Apple, and Google accounts” first.
Start with your email account. Whoever controls your email can reset almost everything else.
How to protect your phone number from SIM swaps
Turn on your carrier’s free SIM lock. The big three US carriers all offer one:
- Verizon: SIM Protection blocks SIM and device changes, and Number Lock blocks transfers to another carrier. Both are in the My Verizon app or website, per Verizon.
- T-Mobile: SIM Protection is free for postpaid customers, under Security in the T-Life app or on T-Mobile.com, per T-Mobile.
- AT&T: Wireless Account Lock, in the AT&T app, blocks SIM swaps and number transfers, per AT&T.
UK carriers offer account PINs and security checks too; ask yours what protects against SIM swaps and number porting. Also, remember to switch the lock off before you move to a new phone or eSIM, or the transfer will fail.
If your phone suddenly shows “No service” while others nearby have signal, call your carrier from another phone right away. It can be the first sign of a SIM swap.
Which accounts need more than SMS?
Email, your Apple or Google account, banks, investment and crypto apps, your password manager and your main social accounts. These hold money or can reset other accounts. For low-value accounts, such as a store loyalty login, SMS 2FA is fine.
Keeping your phone’s software current matters as well. Our iOS 26.7.1 security update note explains why patching is part of account security, and our October 2026 Patch Tuesday guide covers the same for Windows PCs.
Verdict
SMS 2FA is safe enough to keep on and not safe enough to rely on for anything important. Spend 30 minutes this week to protect your key accounts properly. Move email, Apple or Google, banking and your password manager to passkeys or an authenticator app. Turn SMS off on those accounts and save the backup codes. Then switch on your carrier’s SIM lock. Leave SMS in place only where it’s the only option.
FAQ
Is SMS 2FA safe?
It’s better than a password alone, but it’s the weakest form of 2FA. Codes can be stolen through SIM swaps, intercepted in SMS delivery systems, or phished. Use an authenticator app or passkeys for important accounts.
Is SMS 2FA better than nothing?
Yes. It blocks attackers who only have your password, which covers most account takeovers. Turn it on wherever nothing stronger is offered.
What is a SIM swap attack?
A criminal convinces your carrier to move your phone number to a SIM they control, so your calls and text codes go to them. Carrier SIM locks make this much harder.
Is an authenticator app safer than SMS?
Yes. Codes are generated on your phone, so they can’t be intercepted or redirected by a SIM swap. They can still be phished, which passkeys prevent.
Should I turn off SMS after adding an authenticator app?
Yes, where the site allows it. Adding an app doesn’t remove SMS, and attackers can choose the text-message option instead. Keep backup codes so you’re not locked out.
Are passkeys better than 2FA?
Passkeys are stronger than password-plus-code 2FA because they can’t be phished or intercepted. Use them wherever sites support them, starting with your email account.
Sources checked October 14, 2026.
