SMS two-factor authentication is much safer than a password alone and is still a sensible default for most consumer accounts. It is not strong enough on its own for high-value accounts, because codes can be stolen through SIM swap, signalling interception and phishing.
This guide explains how each attack works, what NIST now says about SMS codes, when SMS 2FA is still the right call, and how to harden it. If you are building the flow, an SMS verification API handles code generation, expiry and fallback for you.
How does SMS 2FA work?
The user signs in with a password (something they know). Your service then sends a short one-time password to the phone number on the account (something they have). The user types the code back, and access is granted only if it matches and has not expired. A stolen password alone is no longer enough.
How much protection does SMS 2FA give?
More than its reputation suggests. In a 2019 study of its own sign-in challenges, Google found that an SMS code sent to a recovery phone blocked 100% of automated bots, 96% of bulk phishing attacks and 76% of targeted attacks. On-device prompts did better, at 99% of bulk phishing and 90% of targeted attacks (Google Security Blog).
Two lessons follow. SMS stops the cheap, high-volume attacks that make up most account takeover attempts. But against a determined attacker going after one account, it leaves a meaningful gap, and stronger factors close more of it.
What are the main attacks on SMS codes?
| Attack | How it works | Who can do it | Main defence |
|---|---|---|---|
| SIM swap | Attacker persuades or bribes a mobile operator to move the victim’s number to a new SIM | Anyone with personal data and some social engineering skill | Operator controls; treat number changes as risk signals |
| Port-out fraud | Attacker ports the number to another operator in the victim’s name | Similar to SIM swap | Operator port-out PINs; porting as a risk signal |
| Signalling interception | Abuse of SS7 or Diameter access to redirect or read SMS | Attackers with access to operator signalling networks | Operator firewalls; non-SMS factors for high-value targets |
| Phishing and code relay | A fake site asks for the password and then the code, and relays both in real time | Anyone with a phishing kit | Origin-bound codes, clear message wording, phishing-resistant factors |
| Social engineering | A caller posing as support asks the user to read out the code | Anyone | “Never share this code” in every message |
SIM swap
SIM swap is the best-known risk because it gives the attacker every future code, not just one. The FBI’s Internet Crime Complaint Center recorded 982 SIM swap complaints and $25,983,946 in reported losses in 2024 (IC3 2024 Internet Crime Report). In the UK, Cifas reported nearly 3,000 unauthorised SIM swaps in 2024, a 1,055% rise on the year before (Cifas). These are reported cases, so the real totals are likely higher.
SS7 and signalling interception
SMS travels between networks over signalling protocols, SS7 in older networks and Diameter in 4G. The US Federal Communications Commission has noted that these protocols route calls and text messages between networks and that their security weaknesses have been widely reported (FCC Public Notice DA 24-308). The best-known case came in 2017, when O2 Telefónica in Germany confirmed that criminals had combined banking malware with SS7 access to redirect SMS transaction codes and empty accounts (The Register).
This attack needs access to operator signalling networks, so it is expensive and usually aimed at specific people. That is why the US Cybersecurity and Infrastructure Security Agency’s mobile guidance, written for highly targeted individuals in senior government and political roles, advises them not to use SMS as a second factor (CISA mobile communications guidance). For a mass-market app, the risk profile is different, but for admin accounts and large balances the same logic applies.
Phishing and code relay
Real-time phishing needs no telecom access at all. A fake login page collects the password, triggers your real login, then asks the victim for the code they just received. Because the code is genuine, your system accepts it. Every factor that shows a code the user can type, whether SMS, WhatsApp, email or an authenticator app, is exposed to this.
What does NIST SP 800-63B say about SMS 2FA?
The current version, NIST SP 800-63B-4, published in July 2025 (NIST CSRC), classes out-of-band codes sent over the public telephone network, including SMS and voice, as a restricted authenticator. Restricted is not banned. It means a service using SMS codes must:
- Offer every user at least one alternative authenticator that is not restricted
- Give users meaningful notice of the security risks
- Cover the risk in its own risk assessment and plan for a possible future move away from it
- Consider risk indicators such as device swap, SIM change and number porting before sending a code
The same document sets baseline rules that apply to any SMS code flow: codes of at least six digits, authentication completed within 10 minutes, and no more than 100 consecutive failed attempts before the authenticator is disabled. It also says email must not be used for out-of-band authentication (NIST SP 800-63B-4).
When is SMS 2FA still the right choice?
SMS remains the practical choice when reach matters more than maximum assurance:
- Phone number verification at signup. Here the goal is proving the user controls a number, and SMS is the most universal way to do it.
- Mass-market consumer logins. Many users will never install an authenticator app, and SMS 2FA beats no 2FA by a wide margin.
- Users without smartphones or data. SMS works on any handset, anywhere there is signal.
- Fallback. When WhatsApp or Viber does not deliver, SMS is the safety net. Our guide to multichannel OTP flows with fallback shows how to order the channels.
Move beyond SMS-only for admin and staff accounts, crypto withdrawals, large payouts and changes to security settings. Use an authenticator app, a passkey or a hardware key there, and keep SMS as a recovery or secondary option.
How do you make SMS 2FA safer?
- Use six-digit codes with short expiry. Give risky actions shorter windows than routine logins, and cap wrong attempts well below NIST’s outer limit.
- Say what the code is for. “Your code to approve a payment of 250.00 is…” tells the user something is wrong if they did not start a payment. Always add “Never share this code”.
- Bind codes to your domain on the web. Ending the message with a line such as
@example.com #123456lets supporting browsers autofill the code only on that origin, which blunts phishing sites (Chrome WebOTP documentation). - Treat number changes as high risk. Require an existing factor before changing the phone number on file, and add extra checks after a recent change or port. An MNP lookup tells you whether a number has been ported; see our guide to MNP lookups.
- Rate-limit every endpoint that sends a code. Limits per number, IP address and device also protect you from SMS pumping, where bots trigger codes to numbers whose networks share the termination fees with the fraudster.
- Offer a stronger factor and nudge high-value users towards it. NIST requires the alternative anyway.
- Consider encrypted OTT channels first. WhatsApp and Viber codes are end-to-end encrypted, which removes network interception, though not phishing.
If you are choosing a provider for this, our checklist on how to choose a Verify API lists the security controls to ask for.
How SMS.to handles SMS 2FA
The SMS.to Verify API sends codes over SMS, WhatsApp, Viber and Telegram with automatic fallback, so you can lead with an encrypted app channel and keep SMS as the universal net. You set code length or format, expiry, templates and language in a Verify App and override them per request, so a payout approval can have a shorter window than a routine login.
The Verify page recommends layering rate limits per user, IP and device, shorter expiry for risky actions, CAPTCHA on repeat attempts and HLR or MNP lookups to keep numbers clean. Webhooks and logs record every attempt, which helps when you investigate a suspected takeover. SMS.to is operated by Intergo Telecom, a licensed telecom and CPaaS operator.
FAQs
Is SMS 2FA better than no 2FA?
Yes. Google’s 2019 research found that an SMS code to a recovery phone blocked all automated bot attacks and most bulk phishing in its study. A password alone offers no second barrier.
Has NIST banned SMS for two-factor authentication?
No. NIST SP 800-63B-4 classes SMS and voice codes as a restricted authenticator. You can use them, but you must offer an unrestricted alternative, explain the risk to users and assess it.
Can a SIM swap be detected before sending a code?
Not reliably from the SMS itself. Treat recent number changes, porting and new devices as risk signals, add extra checks when they appear, and give high-value accounts a factor that does not depend on the phone number.
Is WhatsApp OTP more secure than SMS?
It removes network-level interception because messages are end-to-end encrypted, but a user can still be tricked into sharing the code on a fake site. It reduces one risk, not all of them.
Want to add SMS 2FA with app-channel fallback to your product? Create a free account, no credit card needed, and send your first verification in minutes.
