Your SMS security codes are easier to steal than you think

A phone vibrates on a desk. A six-digit number appears in a text message. This is Two-Factor Authentication, or 2FA. It means using two different things to prove an identity: something the user knows, like a password, and something the user has, like a mobile phone.

For many years, this seemed like a perfect solution. Most people carry a phone everywhere. A company does not need to send out expensive hardware keys to every customer or employee in an organisation. It is simple for the user. The belief grew because it was an easy win over passwords alone. Using a password only is like having a door with one lock. Adding a text code adds a second bolt to that door. For a long time, this was enough to stop most basic attacks.

The hidden gaps#

The problem is that SMS relies on the mobile phone network, which was designed for convenience rather than high security. One common attack is called SIM swapping. A criminal contacts a mobile provider and pretends to be the customer. They convince the provider to move the phone number from the victim’s SIM card to a new one owned by the thief. Once this happens, all text codes go to the thief instead of the owner. The thief can then reset passwords and take over accounts while the original user wonders why their phone has lost its signal.

Then there is real-time phishing. Phishing is when a fraudster creates a fake website that looks like a real bank or email provider. In a relay attack, the fraudster asks for the SMS code on this fake site. The moment the user types it in, the fraudster sends it to the real site. The one-time code is used before the victim even realises something is wrong. It happens quickly, often while the user is still staring at the screen. The phone network simply delivers the message to the right number, but that does not mean the person typing the code into a website is who they claim to be.

A better way#

Security experts and browser developers have moved toward phishing-resistant factors. This means the security check cannot be tricked by a fake website. Passkeys are a prime example of this shift. A passkey uses a digital signature to prove identity through a process called public key cryptography. The private key stays locked in the device hardware and is never shared.

The device and the website perform a handshake that only works if the website is legitimate. If a user lands on a fake site, the passkey simply will not work. There is no code for a criminal to steal or relay because the secret never leaves the device. It removes the human element from the verification process. A person cannot be tricked into giving away a passkey in the same way they can be tricked into typing a six-digit number into a box.

SMS is far better than nothing, but it is much weaker than these modern alternatives. It provides a sense of safety that does not always match the technical reality. The mobile network was built to connect people, not to serve as a secure identity layer for the internet.

Review the security settings for an email account or a bank portal. If there is an option for passkeys or an authenticator app, choose that over SMS. It takes a few minutes to set up and removes a significant point of failure.