SMS 2FA vs. Authenticator Apps: Why SMS Is Being Phased Out

SMS-based two-factor authentication was once considered good enough. You log in with your password, receive a text message with a six-digit code, type it in, and you are verified. For years, this was the default two-factor authentication method offered by banks, email providers, and social media platforms. It was simple, it required no additional software, and it was a genuine improvement over passwords alone.

That era is ending. Security standards bodies, regulators, and major services are moving away from SMS as a second factor – not because SMS 2FA is worse than no 2FA (it is not), but because its weaknesses have been documented, exploited at scale, and cannot be fixed from your side. This guide compares SMS codes with authenticator-app (TOTP) codes, explains the attacks behind the shift, and shows what to do about your own accounts.

SMS vs. Authenticator App Codes at a Glance

The rest of this article explains each row.

How an SMS Code Reaches You

When a service texts you a verification code, the message passes through several systems:

1. The service’s server generates the code and hands it to an SMS gateway provider.
2. The gateway passes it to a carrier’s SMS center.
3. The message is routed across the carrier signaling network (SS7) to your carrier.
4. Your carrier delivers it to whatever SIM is currently assigned to your number.

The code is readable at every hop, and it passes through infrastructure that neither you nor the service controls. Step 4 is the one attackers like best: the code goes to whichever SIM your carrier says is yours.

SMS also fails in mundane ways. Messages can be delayed by congestion, fail to arrive when you are roaming abroad, or never reach a tablet or laptop that has no phone number. An authenticator app computes its codes locally from the shared secret and the current time, so it works on a plane, in a basement, or in another country.

Put this guide into practice PanicVault keeps your passwords in an encrypted KeePass file you own — offline-first, no subscription, on iPhone, iPad & Mac.

Get the app

The NIST Turning Point

The most influential signal came from the National Institute of Standards and Technology (NIST). A public draft of NIST Special Publication 800-63B in 2016 proposed deprecating SMS as an out-of-band authenticator. The final version, published in June 2017, softened that to a “restricted” authenticator: agencies could keep using SMS, but had to treat it as a known weakness and plan to move away from it.

The current revision, SP 800-63B-4 (finalized in July 2025), keeps SMS and voice codes as the only restricted authenticator and spells out what that means. A service that uses them must also offer at least one non-restricted alternative, tell users about the risks, and maintain a plan to migrate away. NIST also says out-of-band codes are not phishing-resistant, and requires services at its middle assurance level to offer at least one phishing-resistant option, such as a security key or passkey.

The message is clear: SMS 2FA is a transitional technology, not a long-term solution.

SS7: The Protocol That Cannot Be Secured

Signaling System 7 (SS7) is the protocol suite carriers use to route calls and text messages to each other, handle roaming, and look up where a phone is.

Why SS7 Is Vulnerable

SS7 was designed in the 1970s and 1980s, when only a handful of national telephone companies had access to the network. There was no authentication between nodes – any node was assumed to be legitimate. Today hundreds of carriers, virtual operators, and interconnect providers have access, and access can be bought. Security researchers have repeatedly shown that someone with an SS7 foothold can:

• Redirect SMS messages to a device they control, receiving your verification codes instead of you.
• Track a phone’s location by asking which cell it is connected to.
• Divert calls through their own infrastructure.

This is not just a lab demonstration. In 2017, German media reported – and the carrier O2 Telefónica confirmed – that criminals had stolen banking logins through phishing and malware, then used access to a foreign operator’s network to redirect customers’ SMS transaction codes and drain their bank accounts.

Why SS7 Cannot Be Fixed

The problem is architectural. Retrofitting authentication into SS7 would require coordinated changes across thousands of carriers in hundreds of countries. Carriers deploy SMS firewalls and filtering, which help, but as long as any operator on the network is weak, the whole network is exposed. For authentication, the conclusion is simple: an SMS code can be intercepted by a determined attacker without ever touching your phone.

SIM Swapping: The Low-Tech Attack

SS7 attacks take technical access. SIM swapping takes only social engineering – and it is the most common attack against SMS-based 2FA.

How SIM Swapping Works

1. Research the target. The attacker collects your name, phone number, address, date of birth, and account details from data breaches, social media, and public records.
2. Contact the carrier. They call customer support, visit a store with a fake ID, use your carrier’s website with stolen credentials, or bribe an insider, and ask to move your number to a new SIM or eSIM.
3. Take the number. Your phone suddenly shows “No Service” or “SOS only.” Every call and text to your number now reaches the attacker.
4. Reset and log in. The attacker triggers password resets and logins on your accounts and receives the SMS codes, often within minutes.

Real Cases

• Michael Terpin (2018). About $24 million in cryptocurrency was stolen from the investor in January 2018 after a SIM swap. Nicholas Truglia pleaded guilty and was sentenced in 2022 to 18 months in prison and ordered to pay more than $20 million in restitution; Ellis Pinsky, who was 15 at the time, later agreed to a $22 million civil judgment. Terpin also sued his carrier, AT&T, for $224 million; his lawyers say the case was later settled.
• Jack Dorsey (2019). Twitter said the phone number on its own CEO’s account was “compromised due to a security oversight by the mobile provider,” and the attackers posted to his account through a text-to-tweet service. Twitter switched off tweeting by SMS soon after.
• The SEC’s X account (2024). In January 2024 the US Securities and Exchange Commission’s account posted a fake Bitcoin ETF approval. The SEC said the attacker had obtained control of the phone number on the account “via the telecom carrier,” and that multi-factor authentication had been disabled at staff request months earlier. The man who did the swap, using a fake ID at a carrier store, was sentenced to 14 months in prison in 2025.

The Scale of the Problem

The FBI’s Internet Crime Complaint Center (IC3) received 1,611 SIM-swapping complaints with more than $68 million in losses in 2021 alone – up from 320 complaints and about $12 million across the three previous years combined. Reported losses have fallen since (about $17 million in 2025), but complaints still run at roughly a thousand a year, and those are only the victims who reported to the FBI.

Why Carriers Cannot Fully Prevent It

Carriers face a tension between security and customer service: people who genuinely lose their phones want their number back fast. A 2020 Princeton study made 10 SIM-swap attempts against prepaid accounts at each of five US carriers and succeeded 39 times out of 50 – every time at AT&T, T-Mobile, and Verizon – largely because representatives fell back on weak checks that an attacker can look up or manipulate. The same researchers found 17 of the more than 140 websites they checked could be taken over with a SIM swap alone.

In November 2023 the FCC adopted rules requiring carriers to authenticate customers securely before moving a number to a new SIM or carrier, to notify customers of such requests, and to offer free account locks. As of October 2026, though, the FCC has not yet set the date by which carriers must comply, so for now the protections that matter are the opt-in ones each carrier offers (see Lock Your Number Against SIM Swaps below).

eSIM does not solve the problem either. It removes the plastic card, but a carrier can still move your number to a new eSIM, and an attacker who fools the carrier gets the same result.

Real-Time Phishing: SMS’s Hidden Weakness

Even without a SIM swap or SS7 access, SMS codes can be phished. The attacker builds a convincing fake login page. When you enter your password, their server immediately submits it to the real site. The real site texts you a code, the fake page asks for it, and the attacker relays it – all while the code is still valid. Modern phishing kits do this automatically as a reverse proxy.

SMS codes typically stay valid for several minutes, which gives a relay plenty of time. TOTP codes rotate every 30 seconds, but a live relay still uses them in time, so this is a weakness both methods share. By contrast, passkeys and hardware security keys use a cryptographic challenge bound to the website’s domain, so a code-relaying fake site gets nothing it can use.

What Is Replacing SMS 2FA

TOTP (Time-Based One-Time Passwords)

TOTP codes generated by an authenticator app or a password manager remove the delivery channel entirely. The shared secret is exchanged once, by QR code, and never travels again. There is no SMS to intercept, no SIM to swap, and no carrier employee to fool – an attacker would need the secret itself, from your device or the service’s servers. TOTP also needs no phone number at all, which is better for privacy and means changing carriers or numbers never breaks your 2FA. Apple users can manage TOTP codes alongside their passwords in PanicVault, a native macOS/iOS app that stores everything in the open KeePass KDBX format.

TOTP is the most practical immediate replacement for SMS 2FA. The best authenticator apps make setup a matter of scanning a QR code, and the technical details of TOTP are an open standard (RFC 6238), so any compliant app generates the same codes.

Hardware Security Keys

FIDO U2F and FIDO2 hardware keys (such as YubiKey) provide the strongest second factor currently available. Authentication uses public-key cryptography bound to the website’s origin and requires physically touching the key. It resists phishing, interception, and replay. The trade-offs are cost and carrying the key; for high-value accounts, hardware keys are worth evaluating.

Passkeys

Passkeys are FIDO2 credentials stored on your devices (or synced between them) that replace both the password and the second factor. They are phishing-resistant by design and do not require carrying a separate device. Apple, Google, and Microsoft all support them, and they are widely seen as the long-term replacement for the password-plus-SMS model.

Push-Based Authentication

Push prompts (Microsoft Authenticator, Google’s sign-in prompts, Duo) ask you to approve a login on a registered device. Number matching – typing a number shown on the login screen into the prompt – stops “push bombing,” where an attacker spams prompts until you approve one. Push is not phishing-resistant the way security keys and passkeys are, but it is tied to a specific device rather than a phone number.

The Transition: Where Things Stand

Organizations That Have Moved

• X (Twitter) stopped allowing SMS 2FA for anyone except paying subscribers after March 20, 2023, steering everyone else to authenticator apps and security keys.
• GitHub still offers SMS only as a fallback in a list of supported countries, for people who cannot use an authenticator app, and warns that it is open to interception and phishing.
• Google pushes users toward its sign-in prompts and passkeys, with SMS as a fallback.
• Banks in Singapore began phasing out one-time codes for logins in July 2024, under a plan announced by the Monetary Authority of Singapore and the Association of Banks, for customers who have a digital token in their banking app. The UAE’s central bank told banks to phase out SMS and email codes starting in July 2025. In the European Union, the strong customer authentication rules of the PSD2 directive pushed many banks toward approvals in their own apps.
• Cloudflare has said that the FIDO2 security keys its employees use are what stopped a 2022 SMS phishing campaign that breached other companies.

Organizations Still Using SMS

• Many US banks still rely primarily on SMS, though this is changing gradually.
• Government services in some countries offer only SMS codes.
• Smaller services that lack the engineering resources to implement TOTP or FIDO2.

SMS 2FA will not disappear overnight. It will persist for years in legacy systems and in regions where smartphone use is lower. But the direction is clear.

When SMS Is Still Acceptable

SMS 2FA, with all its flaws, is still far better than no 2FA. The attacks above have to be aimed at you specifically. A password alone is vulnerable to every automated credential-stuffing bot on the internet, and those bots move on as soon as they hit any second factor.

• If a service offers only SMS, keep it on. Removing it would leave you with a password alone.
• SMS is a reasonable fallback behind a stronger primary method. Many services let you enroll an authenticator app and a phone number, so you are not locked out if you lose the app.
• If you are a likely target, drop it where you can. Cryptocurrency holders, public figures, journalists, and anyone with privileged access at work should use TOTP at a minimum, and security keys or passkeys on their most critical accounts. For these people, an SMS fallback can be the weak door an attacker uses.

What You Should Do Now

Audit Your Accounts

Identify every account where SMS is your second factor. Prioritize them by importance – email first, then financial services, cloud storage, and social media. Our guide to your most important accounts has the full priority order and a table of where each major service keeps its 2FA settings.

Switch to an Authenticator App, One Account at a Time

For each account:

1. Open the account’s security or two-factor settings.
2. Add an authenticator app (services label it “authenticator app,” “authentication app,” or similar).
3. Scan the QR code with your authenticator or password manager, or enter the text key it shows.
4. Enter the six-digit code to confirm.
5. Save the backup codes the service gives you.
6. Decide whether to keep SMS as a fallback or remove it (see above).

Then make sure the secrets themselves are backed up. If they live in your password manager, your vault backup covers them; with a standalone app, see how to back up 2FA.

Enable Stronger Methods Where Available

If a service supports security keys or passkeys, use them on your most critical accounts (email, financial, cloud infrastructure). Keep TOTP as a backup if you like.

Lock Your Number Against SIM Swaps

Until SMS is gone from your important accounts, make your number harder to steal. The major US carriers each offer free protections, but you have to turn them on:

On other carriers, ask for an account PIN or passcode and any SIM-change or port-out lock they offer. Beyond the carrier:

• Keep your number out of public profiles, and give random answers to security questions (stored in your password manager) rather than facts someone can look up.
• Consider a separate number for SMS codes. A Google Voice number cannot be SIM-swapped at a carrier store, though it is only as secure as the Google account behind it.

Know the Warning Signs

A SIM swap usually announces itself:

• Your phone suddenly shows “No Service” or “SOS only” where it normally has signal.
• You get an unexpected message about a SIM or eSIM change, or a number transfer.
• Calls and texts stop arriving.
• You receive emails about password resets or new sign-ins you did not start.

If you see these, act immediately: call your carrier from another phone, then secure your email account first (change its password and sign out other sessions), followed by your financial accounts. Attackers move within minutes.

The Bigger Picture

The old model – something you know plus a code delivered to you – relied on a delivery channel that turned out to be insecure. The new model – something you know plus something you hold (an authenticator app, a security key, a passkey) – removes the delivery channel entirely. That is the direction of the future of multi-factor authentication: phishing-resistant, cryptographically bound, and independent of telephone carriers.

SMS 2FA did its job. It taught billions of people that a password alone is not enough. But the transition does not have to happen all at once. Start with your priority accounts, switch them to TOTP or passkeys, and work through the rest over time. Every account you move off SMS is one less account exposed to SIM swapping, SS7 interception, and number-based account recovery.