Why do passwords and SMS codes no longer provide enough identity assurance?

Because they confirm a secret, not a real actor. AI-generated phishing and voice or video spoofing can capture or mimic those factors while still leaving the organisation exposed. Modern assurance has to prove presence, device integrity, and behavioural consistency, not just successful credential entry.

Why This Matters for Security Teams

Passwords and SMS codes still matter as signals, but they no longer provide enough assurance on their own because they only prove knowledge or possession of a factor, not that the actor behind the login is genuine. AI-driven phishing, number porting, and real-time spoofing make those factors easy to capture or replay. NIST SP 800-63 Digital Identity Guidelines makes clear that authenticator strength must be evaluated in context, not treated as a universal guarantee. For identity teams, the real issue is that modern attacks target the session and the human decision point, not just the login form.

This is especially true when identity is also being used to authorize access to secrets, APIs, and production tooling. NHIMG’s Ultimate Guide to NHIs shows how often organisations still rely on weak identity hygiene, and the same logic applies to human-facing assurance when attackers can automate persuasion at scale. Password reuse, MFA fatigue, and SIM swap attacks collapse the assumption that a successful prompt means a trustworthy actor. In practice, many security teams discover this only after account takeover has already been used to move laterally or impersonate a legitimate user.

How It Works in Practice

Modern assurance shifts from static factor checking to layered evidence about the session, device, and behaviour. That means using phishing-resistant authenticators where possible, binding access to managed or trusted devices, and evaluating risk signals at runtime rather than only at enrollment. NIST guidance supports this direction, and eIDAS 2.0 also reflects the broader move toward stronger, verifiable digital identity assertions for higher-assurance use cases.

For security teams, the practical model is:

• Prefer phishing-resistant MFA over SMS wherever the risk is meaningful.
• Use device posture, certificate binding, or hardware-backed keys to raise confidence that the claimant is operating from a trusted endpoint.
• Add step-up checks when behavior changes, such as unusual geolocation, impossible travel, or atypical transaction patterns.
• Reduce the lifetime of privileged sessions so stolen credentials have less value.
• Review access to high-risk systems separately from ordinary user logins, because the assurance bar should match the asset.

This is not only a human identity problem. The same assurance gap appears when systems rely on long-lived secrets and broad trust once authentication succeeds. NHIMG’s 52 NHI Breaches Analysis and Top 10 NHI Issues show how often identity failure becomes a credential compromise problem, especially when secrets are reused or left valid too long. These controls tend to break down in remote-first environments with unmanaged devices and fragmented identity stacks because there is no reliable signal to distinguish a real user from a replayed or socially engineered session.

Common Variations and Edge Cases

Tighter identity assurance often increases user friction and support overhead, so organisations have to balance resistance to takeover against business usability. That tradeoff is real, and current guidance suggests matching stronger controls to higher-risk actions instead of forcing the same process everywhere.

There is no universal standard for this yet across every workload and jurisdiction. Some environments can adopt passkeys or hardware keys quickly, while others still depend on SMS as a transitional control for workforce or customer populations. The important nuance is that SMS should be treated as a lower-assurance option, not a destination state. For privileged access, financial transactions, or admin workflows, it is better to require stronger authentication and runtime checks than to assume a second factor alone solves identity assurance.

Another edge case is recovery. Account recovery often becomes the weakest link because teams harden sign-in but leave help desk procedures and fallback channels exposed. That is where attackers often pivot. In those situations, assurance fails not at the first prompt but at reset, escalation, or session hijack. Security teams should treat those paths as part of the identity control plane, not administrative afterthoughts, and align them with stronger assurance expectations from the outset.

Related resources from NHI Mgmt Group

• How do passkeys compare with passwords and SMS codes for identity assurance?
• Why is SMS OTP no longer enough for marketplace identity verification?
• When does a machine identity become a compliance problem?
• Why is it important to integrate identity and data governance?