Warning signs include repeated OTP delivery abuse, evidence of SIM swap fraud, account takeovers that bypass the second factor, and growing dependence on text messages for routine logins. If users can be attacked through carrier-level weaknesses or bot-driven OTP abuse, the control is no longer providing the assurance teams assume it does.
When SMS Stops Being the “Safer Than Nothing” Option
SMS-based 2FA starts to fail as a safe default when the organisation is no longer treating it as a weak fallback, but as a dependable second factor. That shift usually shows up in real abuse patterns, not in policy language: OTP reuse, message interception, bot-driven request floods, and login journeys where the text message is the only practical protection left.
One practical sign is that SMS is doing too much work for too many users. If it remains the common recovery path, the default for high-risk accounts, and the everyday login method for privileged access, it becomes a concentration point that attackers can target at scale. The control can still reduce casual account theft, but it no longer provides the assurance teams often assume.
Another warning sign is when the threat model has moved from simple password guessing to MFA fatigue and social engineering, or to carrier-side compromise and message abuse. At that point, the question is not whether SMS “works” in a narrow technical sense, but whether it still meaningfully raises the cost of takeover for the accounts it is meant to protect.
What the Failure Patterns Usually Look Like
SMS 2FA weakens when the adversary can get around the phone number instead of the password. SIM swap fraud, number porting abuse, and message forwarding compromise the delivery channel itself. Bot activity also matters: repeated OTP requests can desensitise users, overwhelm support, and create openings for phishing or relay attacks that harvest or replay codes before they expire.
Repeated account takeover attempts that stop showing a second-factor prompt are especially important. That usually indicates the attacker has moved beyond the password layer and is exploiting either recovery flows, carrier controls, or the user’s own response habits. When that happens, SMS has become a brittle control with a predictable failure mode, not a strong second factor.
A useful comparison is with the kinds of identity abuse seen in incidents where attackers bypassed weak or legacy authentication paths, such as the Microsoft Midnight Blizzard breach. The pattern is the same: once an authentication path can be socially engineered, intercepted, or bypassed at the infrastructure layer, it stops being a trustworthy default.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK address the attack and risk surface, while CIS Controls v8, NIST CSF 2.0, NIST SP 800-63 and NIST Zero Trust (SP 800-207) set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CIS Controls v8 | 6 — Access Control Management | SMS 2FA is part of account access control and should be retired where weaker than needed. |
| Recommendation — Replace SMS with stronger authenticators for accounts where takeover risk is material. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication and Access Control | The question concerns when an authenticator no longer provides adequate assurance. |
| Recommendation — Reassess authenticator strength when it no longer resists the relevant attack paths. | ||
| NIST SP 800-63 | AAL2 — Authenticator Assurance Level 2 | SMS is an authenticator choice whose adequacy depends on the required assurance level. |
| Recommendation — Use phishing-resistant authenticators where SMS cannot meet the required assurance. | ||
| NIST Zero Trust (SP 800-207) | ID — Identity | Zero Trust requires stronger identity assurance than weak or interceptable factors. |
| Recommendation — Base access decisions on stronger identity assurance than SMS alone can provide. | ||
| MITRE ATT&CK | T1111 — Multi-Factor Authentication Interception | SMS OTP abuse and interception map directly to MFA interception techniques. |
| Recommendation — Hunt for OTP interception, relay abuse, and takeover paths that bypass SMS. | ||
Practitioner Guidance
What to prioritise: Treat SMS as a risk-managed fallback, not a universal default, for any account where takeover would create material business impact. The strongest signal to retire it first is not abstract guidance, but evidence of real abuse: SIM swap exposure, repeated OTP bombing, or takeovers that succeed despite the second factor.
What to verify: Check whether SMS is still used for privileged users, recovery flows, and new-device enrolment. If the answer is yes, validate whether those paths can be protected with stronger authentication or step-up controls before you accept SMS as a remaining option.
Practitioner takeaway: SMS-based 2FA is no longer a safe default when the delivery channel, the recovery path, or the user behaviour around OTPs has become the real attack surface, because at that point the “second factor” is no longer reliably acting as an independent barrier.
Related resources from NHI Mgmt Group
- What are the signs that SMS-based verification is no longer a strong authentication control?
- Why do secrets stay dangerous even when they are no longer actively used?
- What do organisations get wrong about SMS-based 2FA and fraud risk?
- Who is accountable when organisations rely on SMS-based 2FA and later fall short of strong-authentication expectations?
