Topic starter
24/06/2026 10:23 pm
TL;DR: SMS-based 2FA can widen access while still leaving accounts open to takeover through a weak delivery channel, 1Kosmos reports, with abuse and low adoption showing the problem is governance as much as user friction. Phishing-resistant authentication and stronger recovery controls are needed when SMS remains the weakest factor.
Editorial analysis by NHI Mgmt Group, based on content published by 1Kosmos: “Twitter Ending SMS-based 2FA for Free Users âBut Here's a Better Way to Save $60 Million”.
Key questions
Q: Why do attackers still bypass two-factor authentication on social accounts?
A: Attackers bypass two-factor authentication by targeting the channel that delivers the second factor, the recovery process, or the user into revealing what looks like a legitimate login step.
Q: How should security teams choose between SMS MFA, authenticator apps, and security keys?
A: Start with the sensitivity of the system and the attack paths you most need to stop.
Q: When does SMS-based 2FA create more risk than it reduces?
A: SMS-based 2FA becomes net-risky when the account has high takeover value, users can be phished or socially engineered, and recovery paths still allow a weaker channel to override the stronger one.
Practitioner guidance
- Retire SMS as a primary 2FA option for high-risk accounts Remove text-message authentication from administrator, creator, and brand-account flows where account takeover would create outsized trust or fraud impact.
- Prioritise phishing-resistant methods Use security keys or similarly resistant authentication methods for accounts with public visibility, recovery authority, or monetisation value.
- Review account recovery paths Check whether recovery can still bypass a stronger factor through email, phone, or support-mediated reset workflows.
Bottom line: SMS-based 2FA can expand coverage while still leaving accounts exposed to takeover through a weak delivery channel.
Glossary terms: Phishing-Resistant Authentication, Account Takeover, Second Factor, Recovery Path
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 15 hours ago by NHI Mgmt Group
25/06/2026 7:02 am
SMS 2FA is a coverage mechanism, not an assurance mechanism: The article shows why broad availability of a weak factor can create the appearance of protection without materially changing takeover risk. SMS remains vulnerable to interception, redirection, and abuse, so the control expands access to a second step without reliably improving trust. Practitioners should read that as a warning that adoption metrics can hide weak assurance.
A question worth separating out:
Q: What should organisations do when an account takeover has already been detected?
A: Once takeover is confirmed, organisations should move quickly to contain the account, stop fraudulent use, and recover control of the session and credentials. The article implies that delayed remediation narrows options, so response should include disabling or restricting the account, re authenticating the user, and reviewing linked payment and shipping data for abuse.
👉 Read our full editorial: Twitter's SMS 2FA rollback exposes the limits of account security