Why SMS Codes for MFA Are a Trap—and What to Use Instead

Imagine you're at a coffee shop, checking your email on your phone. You get a text message with a six-digit code. You type it into the login page, and boom—you're in. But so is the attacker who just convinced your carrier to port your number to their SIM. That's SIM swapping, and it's why SMS codes are the weakest form of MFA.

The question this article answers: If SMS codes for MFA are so vulnerable, what should you use instead? The answer: phishing-resistant MFA, specifically FIDO2 hardware keys or passkeys. Let's dig into why.

The Problem with SMS Codes

SMS codes are better than no MFA—but only just. They stop casual password thieves. But they don't stop a determined attacker. Here's the thing: SMS codes are vulnerable to SIM swapping, where the attacker convinces your mobile carrier to transfer your number to a SIM they control. Once they have your number, they receive your SMS codes. CISA names SIM swapping as one of the four ways traditional MFA is bypassed (CISA, Implementing Phishing-Resistant MFA).

But SIM swapping isn't the only hole. Phishing is the big one. A clever phishing email can trick you into typing your SMS code into a fake website. The attacker captures it in real time and uses it to log in. Push notification fatigue is another: you get a flood of "Approve login?" notifications, you tap approve just to make them stop, and the attacker gets in.

That's why CISA ranks phishing-resistant MFA as the gold standard. It's resistant to phishing, push bombing, SS7 attacks, and SIM swapping (CISA, Implementing Phishing-Resistant MFA).

What Phishing-Resistant MFA Looks Like

Phishing-resistant MFA comes in two main flavors: hardware security keys (like YubiKey) and passkeys (which are based on the same FIDO2 standard but built into your phone or computer). Both use public-key cryptography. When you log in, the website sends a challenge to your key. The key signs it with its private key, which never leaves the device. The website verifies with your public key. There's no code to phish, no SMS to intercept.

Hardware keys are the most secure option. They're small USB or NFC devices that you plug in or tap. They cost around $20–$50. Passkeys are more convenient—they sync across your devices via your Apple or Google account, so you can log in with your fingerprint or face. But they're only as secure as the cloud account that syncs them. If that account has weak MFA, an attacker could potentially access your passkeys.

Here's a comparison table to make it clear:

What to Do Right Now

Don't panic. You can upgrade your MFA without throwing away your phone. Start with your most critical accounts: email, banking, and cloud storage.

• If your bank only offers SMS codes, that's better than nothing—but push for app-based codes or hardware keys.
• For email and cloud, set up passkeys if they're supported. If not, use an authenticator app and turn on number matching for push notifications.
• Buy a hardware key for your primary email and password manager. That's the key to your kingdom.

And remember: MFA blocks over 99.9% of account compromise attacks (Microsoft, Microsoft Security Blog). That's a massive win. But phishing-resistant MFA blocks the attacks that SMS can't.

One more thing: don't forget your passwords. Even with MFA, a strong, unique password matters. NIST recommends at least 15 characters for passwords used alone, and at least 8 when used with MFA (NIST SP 800-63B). Use a password manager to generate and store them (CISA, Secure Our World).

The Bottom Line

SMS codes are a trap. They give you a false sense of security. The attackers know how to bypass them, and they do it every day. Switch to phishing-resistant MFA—hardware keys or passkeys—for your most important accounts. It's the single best move you can make to stop phishing dead. Don't wait for a breach to prove the point.

Sources

• CISA - Implementing Phishing-Resistant MFA
• Microsoft - One simple action to prevent 99.9% of account attacks
• NIST - SP 800-63B Digital Identity Guidelines
• CISA - Secure Our World