Topic starter
24/06/2026 10:23 pm
TL;DR: Twitter is restricting SMS-based 2FA to paid subscribers after reporting more than $60 million in annual losses from abuse, according to 1Kosmos, while Wired noted that only 2.6% of users had 2FA enabled and the FTC put social-media impersonation fraud at up to $1.2 billion in 2022. SMS remains a weak account-security factor, and paywalls do not fix the underlying authentication problem.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Twitter Ending SMS-based 2FA for Free Users âBut Here's a Better Way to Save $60 Million”.
Key questions
Q: When does SMS-based 2FA create more risk than it reduces?
A: SMS-based 2FA becomes net-risky when the account has high takeover value, users can be phished or socially engineered, and recovery paths still allow a weaker channel to override the stronger one.
Q: Why do attackers still bypass two-factor authentication on social accounts?
A: Attackers bypass two-factor authentication by targeting the channel that delivers the second factor, the recovery process, or the user into revealing what looks like a legitimate login step.
Q: How should security teams choose between SMS MFA, authenticator apps, and security keys?
A: Start with the sensitivity of the system and the attack paths you most need to stop.
Practitioner guidance
- Retire SMS as a primary 2FA option for high-risk accounts Remove text-message authentication from administrator, creator, and brand-account flows where account takeover would create outsized trust or fraud impact.
- Prioritise phishing-resistant methods Use security keys or similarly resistant authentication methods for accounts with public visibility, recovery authority, or monetisation value.
- Review account recovery paths Check whether recovery can still bypass a stronger factor through email, phone, or support-mediated reset workflows.
Bottom line: SMS-based 2FA can expand coverage while still leaving accounts exposed to takeover through a weak delivery channel.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:02 am
SMS 2FA is a coverage mechanism, not an assurance mechanism: The article shows why broad availability of a weak factor can create the appearance of protection without materially changing takeover risk. SMS remains vulnerable to interception, redirection, and abuse, so the control expands access to a second step without reliably improving trust. Practitioners should read that as a warning that adoption metrics can hide weak assurance.
A question worth separating out:
Q: What should organisations do when an account takeover has already been detected?
A: Once takeover is confirmed, organisations should move quickly to contain the account, stop fraudulent use, and recover control of the session and credentials. The article implies that delayed remediation narrows options, so response should include disabling or restricting the account, re authenticating the user, and reviewing linked payment and shipping data for abuse.
👉 Read our full editorial: Twitter's SMS 2FA rollback exposes the limits of account security