Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery. SMS can remain a contact route, but it should not be treated as proof of identity. The goal is to make account recovery independent of a single mutable channel.
Why SMS Should Stop Being the Identity Proof
SMS is useful as a contact channel, but it is a weak basis for identity proof because the phone number can change, be reissued, or be redirected through social engineering and carrier-level abuse. Once an organisation treats a text message as evidence of who someone is, it creates a recovery path that is only as strong as the least protected phone number in the process. For a deeper governance lens on digital identity assurance, eIDAS 2.0 — EU Digital Identity Framework is useful because it separates identity assurance from an ordinary communications channel.
That distinction matters most when the account can unlock finance, admin access, customer data, or other sensitive functions. If SMS is used for recovery, attackers do not need to break the whole identity system; they only need to compromise the number, the carrier workflow, or the help desk exception path. In practice, many security teams discover that SMS-based trust fails first during account recovery, not during normal sign-in.
What a Safer Verification Stack Looks Like
A better model is to reserve SMS for notification or low-friction contact, while moving actual verification to methods that are harder to hijack and easier to govern. For privileged users, that usually means phishing-resistant authentication and stronger proofing before any reset is allowed. For ordinary users, the key question is not whether SMS is convenient, but whether the fallback path is as trustworthy as the account being protected.
Organisations should think in layers:
- Use SMS for alerts, reminders, and second-channel communication, not as the sole proof of identity.
- Require a separate authoritative proofing step before resets, recovery, or contact detail changes.
- Detect number changes or SIM-related changes and treat them as a risk signal, not a routine update.
- Apply stronger controls to high-privilege, high-value, or high-impact accounts first.
The practical issue is that SMS fails as a security control when the process assumes a phone number is stable and personally controlled. It is not stable in the way a cryptographic authenticator or a governed identity proofing workflow is stable. If the organisation cannot explain how a reset would resist number recycling, SIM swap abuse, or help desk impersonation, then the recovery design is too dependent on the mobile channel.
For policy-heavy identity ecosystems, the useful comparison is with assurance-based frameworks that separate enrolment, binding, and recovery decisions from everyday communications. FATF Recommendations — AML and KYC Framework is relevant where verification decisions need a stronger evidential basis, especially for regulated onboarding and high-risk identity events.
Where this guidance breaks down is in environments that cannot yet replace SMS immediately, such as legacy consumer journeys or markets with poor authenticator adoption. In those cases, the organisation should reduce reliance incrementally rather than pretending a weak factor becomes strong because it is convenient.
Edge Cases That Change the Answer
Tighter verification usually increases user friction and support load, so organisations have to balance recovery speed against the cost of account takeover and fraudulent reset. The right answer changes when the account is privileged, the user is remote, or the recovery action can trigger material harm.
Some organisations still keep SMS as a backup route, but that is only defensible when it is clearly subordinate to a stronger identity proofing path. The strongest exceptions are operational, not conceptual: temporary fallback for migration, constrained geographies, or low-risk service accounts with limited impact. Even then, the fallback should be time-bound, monitored, and paired with an alternate way to re-establish trust.
The main trap is treating “better than nothing” as a permanent architecture. Once SMS sits inside a recovery flow, it tends to expand from convenience into policy, and then into a de facto identity control. In practice, organisations usually learn where that boundary was too soft only after a reset path is abused or a high-value account has already been exposed.
Risk and Threat Considerations
The material risk is account takeover through weak recovery or verification flows. SMS creates exposure when a mutable phone number is allowed to stand in for identity, because the channel can be redirected through SIM swap, number recycling, port-out fraud, or social engineering of support processes.
Failure mechanism: An attacker targets the recovery path rather than the primary login, then uses control over the number, carrier metadata, or help desk workflow to receive or bypass verification codes. In mixed environments, the same weakness can also let an insider or fraudster change contact details and preserve access through the fallback channel.
Impact: The organisation loses assurance that the person requesting reset, recovery, or step-up access is the real account holder. That can lead to account takeover, privilege escalation, fraudulent transactions, exposure of personal data, and unreliable audit trails for identity events.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | IAL — Identity Assurance Level | Identity proofing strength should match recovery risk, not rely on SMS. |
| AAL — Authenticator Assurance Level | Phishing-resistant authenticators are the safer replacement for SMS-based verification. | |
| Recommendation — Apply stronger identity proofing before allowing resets or high-risk recovery. Move privileged users to phishing-resistant authenticators instead of SMS codes. | ||
| NIST CSF 2.0 | PR.AA — Identity Management, Authentication, and Access Control | The subject is fundamentally about authentication strength and recovery access control. |
| Recommendation — Harden authentication and recovery paths so SMS is not treated as proof of identity. | ||
| CIS Controls v8 | 6 — Access Control Management | Reducing SMS dependence requires stronger account and recovery access governance. |
| 5 — Account Management | Number changes and recovery flows are account lifecycle events that need control. | |
| Recommendation — Restrict recovery access and remove SMS from high-risk authentication decisions. Track and review account recovery and contact-detail changes as sensitive lifecycle events. | ||
Practitioner Guidance
What to prioritise: Treat the recovery journey as the highest-risk part of SMS dependence, not the sign-in screen. If the organisation is only replacing SMS at login but leaving reset and contact-change flows untouched, the real exposure remains.
What to verify: Check whether the recovery process has a separate proofing step, whether number changes trigger risk review, and whether privileged users are excluded from SMS-only recovery entirely. The control is not trustworthy unless the exception path is explicitly weaker than the primary assurance path never the other way around.
Practitioner takeaway: SMS can stay as a messaging channel, but it should never be the organisation’s evidence of identity; resilience comes from making recovery independent of any single mutable phone-based trust signal.
Related resources from NHI Mgmt Group
- How should organisations reduce identity verification friction without weakening FINTRAC compliance?
- How can organisations reduce repeated identity verification without losing assurance?
- How should organisations reduce privacy risk in identity verification workflows?
- How should organisations reduce bias in manual identity verification?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 6, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
