A text message proves control of a number—not necessarily a person
SMS two-factor authentication adds a second step to a password login: a service sends a temporary code to your phone number, and you type it in. That can stop someone who has stolen only your password. The weakness is that the code travels through the phone network, where your number can be redirected or the message can be tricked out of you.
One risk is a SIM-swap attack. A criminal persuades a mobile carrier to move your number to a SIM card they control. Calls and texts then reach the attacker, including login codes. In other cases, attackers exploit weaknesses in the systems that route text messages. Neither method is effortless or equally likely for everyone, but both target the phone number rather than the security of the account itself.
A code can also be phished in real time
Even if a message reaches the right phone, SMS does not protect against a convincing fake sign-in page. A scammer can ask for your password and the freshly delivered code, then enter both on the real site before the code expires. Because the user is relaying the code, it offers little defense against this kind of real-time trick.
Better options bind approval more tightly to you
An authenticator app generates codes on your device instead of receiving them by text, reducing the risk of number hijacking. It can still be fooled by a fake login page that captures a code as you enter it. Passkeys provide stronger protection against that tactic: they use cryptographic credentials tied to the legitimate website, so a look-alike site cannot simply collect a reusable password and code.
SMS is still generally safer than relying on a password alone, especially when no alternative is available. But when a service offers an authenticator app or passkey, switching means a stolen phone number is less likely to become the key to your account.
