Why SMS Codes Are Still Winning—and How to Beat Phishing for Good

Here’s a contrarian take that will annoy the security purists: SMS codes aren’t the enemy—complacency is. For years, we’ve been told to “just enable two-factor authentication,” and millions of us dutifully typed in those six-digit codes, feeling smug and safe. Then the phishing emails got smarter, the SIM swaps got bolder, and suddenly that six-digit code was the digital equivalent of a paper lock on a bank vault. I’m not here to trash SMS codes entirely—they’re better than nothing—but if you’re still relying on them to protect your email or bank account, you’re doing it wrong. The real fix is phishing-resistant MFA, and it’s not as painful as you think.

What’s Actually Breaking When Phishing Works?

Let’s start with the obvious: phishing works because we’re human. Verizon’s 2024 Data Breach Investigations Report found that more than two-thirds of breaches—68%—involve a non-malicious human element, like someone clicking a link they shouldn’t have. That’s not a dig at your grandma; it’s a statistical reality. The FBI’s IC3 logged 193,407 phishing and spoofing complaints in 2024 alone, making it the most-reported crime category. And those aren’t just annoying spam emails—they’re the entry point for ransomware, business email compromise, and identity theft.

But here’s the thing: phishing doesn’t just steal your password. It steals your trust in the interface. You see a login page that looks exactly like your bank’s, you type your credentials, and then—if you have MFA enabled—you type that six-digit code that arrived via SMS. Congratulations, you’ve just handed the attacker everything they need. The code was supposed to be a second factor, but in a phishing scenario, it’s just another password.

Why SMS Codes Are a Weak Link (and Not Just Because of SIM Swaps)

Let’s be fair: SMS codes are better than no MFA. Microsoft says MFA can block over 99.9% of account compromise attacks, so if you’re using SMS, you’re already ahead of the pack. But CISA is blunt about the limitations. They document four ways traditional MFA gets bypassed: phishing, push bombing (where attackers spam you with push notifications until you finally tap “approve” out of frustration), exploitation of SS7 protocol vulnerabilities, and SIM swapping. SMS codes are vulnerable to at least three of those—phishing, SS7 exploits, and SIM swapping. Push bombing hits app-based push notifications, but SMS is just as susceptible to phishing.

SIM swapping is the scariest because it’s not even a technical hack—it’s social engineering. CISA describes it as convincing your cellular carrier to transfer your phone number to a SIM card the attacker controls. Once they have your number, they receive your SMS codes. That’s why CISA ranks SMS and voice codes as the least preferred MFA method, calling them a “last resort” when phishing-resistant options aren’t available.

So what’s the gold standard? CISA is explicit: phishing-resistant MFA, which includes hardware security keys (FIDO2) and passkeys. These are resistant to phishing, push bombing, SS7, and SIM swap attacks because they use public-key cryptography that never shares a secret with a website. Even if you’re tricked into visiting a fake site, the key won’t authenticate because it’s bound to the real domain.

What to Do When You Can’t Go Full Hardware Key (Yet)

I get it—hardware keys are a hard sell for most people. They cost money, they’re easy to lose, and not every website supports them. So let’s talk about the realistic ladder, straight from CISA’s fact sheet on implementing phishing-resistant MFA:

• Best: Hardware security keys or passkeys (FIDO2/WebAuthn).
• Better: App-based one-time passwords (like Google Authenticator or Microsoft Authenticator) or push notifications with number matching.
• Worst (but still better than nothing): SMS or voice codes.

If you can’t jump straight to a hardware key, at least get off SMS and onto an authenticator app. But here’s the catch: app-based codes are still phishable. If you type that six-digit code into a fake site, you’ve still lost. The difference is that app-based codes aren’t tied to your phone number, so SIM swapping won’t help an attacker. That’s a meaningful upgrade.

Why Passwords Alone Are a Lost Cause (and What Actually Works)

Now, let’s zoom out. MFA is a band-aid if your password is already compromised. The reality is that passwords alone are a disaster. Microsoft reports more than 300 million fraudulent sign-in attempts to its cloud services every day, and a big reason is password reuse. CISA and NSA list poor credential hygiene—like passwords shorter than 15 characters—among the top ten network misconfigurations. And the NCSC’s “three random words” advice is a step up from “P@ssw0rd!” but it’s not enough if those words are on a breach list.

Here’s a concrete scenario: you use “applenemobiro” as your password because the NCSC recommended three random words. Good for you. But if that phrase appeared in a data breach—say, from a forum you joined in 2015—an attacker can use it in a credential-stuffing attack against your bank. That’s why NIST requires passwords to be screened against a blocklist of compromised values. And that’s why you need a password manager to generate unique, random passwords for every account. CISA recommends this, and it’s the only sane way to avoid reuse.

But even a strong password is worthless if you hand it to a phisher. That’s where phishing-resistant MFA comes in. It’s the only way to make that stolen password useless.

What I’d Actually Do

If you take one thing from this, it’s this: stop using SMS codes for anything that matters. I’d start with your email, because that’s the master key to everything else—password resets, bank notifications, you name it. Get a hardware key if you can afford it (they’re under $50) and use it on your primary accounts. If that’s too much, switch to an authenticator app with number matching, and at minimum, make sure you’re not using SMS.

And while you’re at it, check if your email has been in a breach using Have I Been Pwned. If it has—and there’s a good chance it has, given that the service has been tracking breaches since 2013—change that password immediately, and make it unique. Use a password manager so you never have to remember it.

Yes, this is a bit of a hassle. But the alternative is worse: in 2024, the FBI’s IC3 received 859,532 complaints with reported losses of $16.6 billion—a 33% increase over 2023. And the average loss per complaint was $19,372. I don’t know about you, but I’d rather spend an hour setting up a security key than be part of that statistic.

Sources

• CISA (Secure Our World) - https://www.cisa.gov/secure-our-world
• CISA (Implementing Phishing-Resistant MFA) - https://www.cisa.gov/sites/default/files/2023-01/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
• FBI IC3 (2024 Internet Crime Report) - https://www.ic3.gov/Media/PDF/AnnualReport/2024_IC3Report.pdf
• Verizon (2024 Data Breach Investigations Report) - https://www.verizon.com/about/news/2024-data-breach-investigations-report-vulnerability-exploitation-boom
• Microsoft Security Blog (MFA) - https://www.microsoft.com/en-us/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/
• Have I Been Pwned (About) - https://haveibeenpwned.com/About