What happens when universities keep using low assurance authentication methods like SMS for critical access?

Why Low Assurance Access Becomes a Campus-Scale Problem

Universities rarely use authentication for one system in isolation. The same identity layer often reaches student records, payroll, grant data, research repositories, email, collaboration tools, and administrator consoles, so a weak factor can become a shared failure point across very different trust zones. SMS is especially problematic because it can be intercepted, redirected through SIM swap abuse, or defeated when an attacker only needs the second factor once to pivot into more sensitive systems. The issue is not that the control is absent, but that its assurance level is too low for the value of the access it protects.

That matters more in higher education because access tends to be distributed, seasonal, and heavily delegated. Temporary staff, researchers, students, contractors, and third-party services all create a broad authentication surface where recovery from compromise is slow and attribution is often unclear. In practice, many universities discover the weakness only after a mailbox, portal, or admin account has already been used as the entry point for broader account takeover.

How It Works in Practice

Low assurance authentication fails when the factor does not meaningfully bind the login to the intended user or device. SMS codes rely on a telephone network that was not designed as a strong security boundary, so the code may be exposed through social engineering, number porting, malware on the handset, or carrier-level interception. Even when an SMS code is delivered correctly, it is still a short-lived shared secret that can be replayed fast enough to satisfy many web logins.

In a university environment, that weakness is amplified by the way access is organised. Students may enter from unmanaged devices, faculty may retain access to multiple systems across departments, and administrators often hold privileges that reach finance, HR, and research operations. When SMS is used for critical access, the institution is effectively trusting a factor that is easier to redirect than to prove.

• For ordinary account recovery, a weak second factor may create inconvenience but limited damage.
• For privileged or high-value access, the same factor can convert a single credential theft into full account compromise.
• For shared service processes, weak authentication can also hide who actually approved the action.

Current guidance increasingly favours phishing-resistant methods such as authenticator-app based cryptographic flows, hardware-bound credentials, or other stronger identity proofing where the access is sensitive. The main operational question is not whether multi factor authentication exists, but whether the factor can withstand interception, redirection, and social engineering under real attack conditions. These controls tend to break down in help-desk-heavy environments where recovery and exception handling are easier to manipulate than the login itself.

Common Variations and Edge Cases

Tighter authentication often increases friction, so universities have to balance usability against the consequences of a compromise. That tradeoff is real for students and guest users, but it becomes much less acceptable for systems that hold research data, payroll, admissions decisions, or privileged administrative access. Best practice is evolving, but there is no universal standard that treats SMS as equally suitable across every access class.

Not every account needs the same assurance level. A low-impact self-service portal may tolerate weaker controls for a limited period, while sensitive systems should require stronger authentication and tighter recovery rules. Hybrid environments also create edge cases where one weakly protected identity can reach many higher-value services through single sign-on, so the real assessment should focus on what the account can access after login, not just how the login screen looks.

NHI Management Group’s research shows that 90% of IT leaders say properly managing non-human identities is essential for a successful zero-trust implementation, which is a useful reminder that assurance gaps are not only a human-user issue. In practice, universities often inherit weak authentication through legacy exception handling, then preserve it because the operational cost of fixing it is visible long before the security cost of keeping it.

Risk and Threat Considerations

The main risk is account takeover with downstream access to academic, financial, research, or administrative systems. Low assurance factors create a wide attack surface because they are easier to intercept, socially engineer, or bypass than stronger possession-based methods.

Failure mechanism: An attacker steals or redirects the first factor, then uses SMS interception, SIM swap, or help-desk abuse to satisfy the second factor and complete login. Once inside, they can reset passwords, persist through recovery channels, and move into higher-value systems that trust the same identity.

Impact: The institution may lose confidentiality over records and research, lose integrity over student or staff data, and expose privileged workflows to misuse. The broader the credential reuse across campus services, the larger the blast radius from a single compromised account.

Practitioner Guidance

What to prioritise: Classify authentication by access value, not by application label. If the account can reach research, finance, HR, privileged administration, or bulk data export, treat SMS as an exception condition rather than an acceptable default.

What to verify: Check whether the second factor is actually phishing-resistant, whether recovery steps are weaker than login, and whether a help desk can override controls without strong identity verification. Those are the paths attackers usually target first.

Decision rule: If the factor can be redirected, replayed, or socially engineered more easily than the account’s value justifies, require stronger authentication and tighten recovery before expanding access further.

Practitioner takeaway: The key judgement is not whether MFA exists, but whether the method is strong enough to defend the systems it opens; in universities, weak factors often turn identity recovery into the real attack surface.

Related resources from NHI Mgmt Group

• Why do SMS and email OTP methods fall short for high-assurance access?
• What happens when MFA protects privileged access but not the rest of the environment?
• What happens when stolen credentials are combined with computer-using AI agents?
• What happens when a trusted identity is used to access sensitive systems from an unexpected environment?