Why SMS Codes Are the Weakest Common Second Factor
A text-message code adds a second checkpoint to a password, but that checkpoint depends on a phone number—and phone numbers can be taken over. In a SIM-swap attack, a criminal persuades a mobile carrier to move a victim’s number to a SIM card or eSIM the criminal controls. The victim may suddenly lose service while incoming verification texts go to the attacker.
A related tactic is number porting: tricking a carrier into transferring the number to another provider. Older mobile-network signaling systems can also expose some text messages, though exploiting them is not a routine option for most attackers. In addition, phone numbers are sometimes reassigned, creating risks for accounts still tied to an old number.
A Code Can Be Stolen Without Intercepting the Text
SMS codes are also vulnerable to phishing. A fake sign-in page can ask for both a password and the texted code, then pass them to the real service immediately. Because the code is legitimate and may work only briefly, a short expiration window does not necessarily stop this kind of real-time attack.
That does not make text-message verification useless: it can block someone who has only guessed or stolen a password. But it is a weaker barrier than methods that do not rely on the phone network or hand a reusable code to a person. Authenticator apps generate codes on the device; passkeys and physical security keys can bind authentication to the genuine website, making common phishing tricks harder.
The Practical Tradeoff
Texting is familiar and works on basic phones, so services often offer it when stronger options are unavailable. When a service supports passkeys, a security key, or an authenticator app, switching can reduce exposure to number takeovers and code phishing. SMS is best understood as a backup layer—not a guarantee that whoever receives a text is the account’s rightful owner.
