SMS-based 2FA fails when attackers use SIM swapping, number porting fraud, or access to the user’s mobile account to intercept codes. It also creates a false sense of protection because the second factor can be redirected without the account owner’s consent. For high-risk users, SMS should be treated as a fallback, not the primary defence.
Why This Matters for Security Teams
SMS-based 2FA is often positioned as a simple upgrade from passwords, but high-profile accounts change the risk calculus. Attackers do not need to defeat the platform directly if they can redirect a phone number through SIM swapping or account takeover at the telecom layer. That means the second factor can be captured outside the platform’s control, undermining the assumption that possession of a phone equals possession of the user. NIST SP 800-63 Digital Identity Guidelines treats SMS as weaker than phishing-resistant authenticators for higher assurance use cases.
The practical issue is not just interception. For public figures, journalists, executives, and creators, phone numbers are often exposed, reused across services, or tied to recovery flows that expand the blast radius of one compromise. As NHIMG notes in the Ultimate Guide to NHIs — The NHI Market, 79% of organisations have experienced secrets leaks, with 77% resulting in tangible damage, which is a useful reminder that exposed credentials and recovery paths rarely stay contained. In practice, many security teams encounter SMS weakness only after an account recovery abuse or number porting incident has already succeeded, rather than through intentional hardening.
How It Works in Practice
For high-profile users, the problem is less “does 2FA exist” and more “can the second factor be silently rerouted.” SMS delivery depends on the mobile ecosystem, so an attacker who controls the number through port-out fraud, carrier insider abuse, or malware on the device can receive the one-time code and complete login. That is why current guidance from NIST SP 800-63 Digital Identity Guidelines favors phishing-resistant authenticators, such as FIDO2-based methods, for stronger assurance.
Practitioners should think in terms of layered account protection rather than a single second factor:
- Use phishing-resistant MFA for primary access, especially for admins and public-facing accounts.
- Remove SMS from recovery wherever possible, since recovery often becomes the weakest path.
- Protect telecom accounts with carrier PINs, port-freeze features, and separate contact data.
- Apply step-up verification for risky actions such as password changes, recovery updates, or device enrollment.
- Monitor for anomalous login geography, number changes, and session token resets.
This approach aligns with the control logic in NIST SP 800-53 Rev 5 Security and Privacy Controls, which emphasizes authentication strength, access monitoring, and account recovery safeguards. NHIMG’s research on the New York Times breach is a useful reference point for how identity recovery and access pathways can be exploited when the trust model is too forgiving. These controls tend to break down when carriers lack strong anti-port protections and the platform still allows SMS as a fallback for recovery or step-up approval.
Common Variations and Edge Cases
Tighter account protection often increases user friction and support overhead, requiring organisations to balance usability against takeover risk. That tradeoff is especially visible for high-profile users who travel frequently, use multiple devices, or rely on assistants and social teams to manage access.
There is no universal standard for this yet, but best practice is evolving toward phishing-resistant MFA as the default and SMS as a constrained fallback only. Some platforms still permit SMS because it improves enrollment rates, yet that convenience can conflict with high-assurance requirements. In riskier environments, platforms should also limit recovery routes, require re-verification for sensitive profile changes, and alert on any authenticator downgrade. The ENISA Threat Landscape is a helpful external reference for understanding how identity abuse and social engineering keep evolving across sectors.
For regulated or politically exposed accounts, the operational question is not whether SMS is convenient, but whether it can be trusted against a motivated adversary with telecom leverage. In that environment, SMS should be treated as a recovery convenience, not a control that meaningfully resists targeted compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST SP 800-63, NIST CSF 2.0 and NIST AI RMF set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | AAL2 | SMS is weaker than phishing-resistant authenticators for high-assurance accounts. |
| NIST CSF 2.0 | PR.AA-5 | Covers strong authentication and verification of user access. |
| NIST AI RMF | Risk management applies to identity recovery and account takeover scenarios. | |
| OWASP Non-Human Identity Top 10 | NHI-05 | Weak recovery and secret exposure patterns mirror broader identity compromise risks. |
Limit fallback channels and monitor for unauthorized credential or recovery changes.
Related resources from NHI Mgmt Group
- Who is accountable when organisations rely on SMS-based 2FA and later fall short of strong-authentication expectations?
- What breaks when organisations rely only on managed AI platforms for high-volume workloads?
- What breaks when organisations rely on SMS codes and knowledge-based checks for identity assurance?
- What breaks when organisations rely only on endpoint controls to stop browser-based social engineering attacks?
