When should organisations stop trusting mobile numbers as an authentication factor?

Why mobile numbers stop being a trustworthy factor

Mobile numbers are useful as a contact channel, but they are a weak authentication anchor because they can be reassigned, ported, recycled, or intercepted. Once a number is being used to unlock anything with meaningful impact, it stops functioning as a durable proof of possession and starts behaving like an easily changed recovery path.

That distinction matters because many organisations still treat the phone number itself as if it were equivalent to a stable device, a verified person, or a hardened second factor. It is none of those things. A number can support step-up messaging, but it should not be the thing that stands between an attacker and an account that controls money, sensitive data, or account recovery.

For sign-in design, the key question is not whether SMS or voice is convenient, but whether the number is carrying too much trust for the business consequence attached to the account. If losing control of that account would expose customer records, payment functions, or admin capabilities, the authentication standard needs to move to a stronger factor such as phishing-resistant MFA and stronger recovery controls, as reflected in NIST SP 800-63 Digital Identity Guidelines and Passwordless and Passkeys Guide.

Where the trust boundary breaks in practice

The practical failure is usually not that SMS never arrives. It is that the phone number can be separated from the person who originally enrolled it. SIM swap fraud, number recycling, carrier account takeover, phishing for one-time codes, and help desk abuse can all defeat a workflow that assumes “the number belongs to the right user, therefore the user is trusted.”

Those failure modes become especially serious when the number is used for password reset, account recovery, or high-risk transaction approval. In that case, the number is no longer a convenience channel. It has become a root of trust for recovery, which makes it a high-value target and a weak point of failure at the same time. The same pattern shows up in real breaches where weak or legacy authentication paths gave attackers entry into larger environments, as illustrated by MFA Guide and Workforce Identity Security Guide.

Once a mobile number is linked to a reset flow, attackers do not need to defeat the primary login every time. They can target the recovery path instead. That is why organisations should treat any phone-number-based factor as lower assurance by default, then decide whether the surrounding controls are strong enough to absorb that weakness.

What organisations should require instead

The replacement decision should follow account risk, not channel preference. If an account can move money, expose regulated data, alter privileges, or unlock other credentials, the authentication design should prefer phishing-resistant methods, stronger identity proofing, and recovery options that do not collapse back to the same phone number. In many environments, that means passkeys, security keys, authenticator-based step-up, or tightly controlled support workflows.

Recovery deserves the same scrutiny as sign-in. If the user can regain access through a call centre script, a texted code, or a new SIM on file, the organisation has only shifted the weak point. Good practice is to make recovery harder to exploit than the login itself, then review whether the policy still allows SMS only for low-risk notifications or low-consequence step-up. A useful implementation reference is MFA Guide, and the supporting standards view is covered by OpenID Connect Core 1.0 for federation-aware authentication design.

Organisations should also define where mobile numbers remain acceptable: notifications, low-risk verification, or legacy fallback for constrained users. The control decision is not “ban phones everywhere,” but “stop treating them as the trust anchor for anything that matters.”

Risk and Threat Considerations

Using a mobile number as an authentication factor creates a predictable takeover path when the number is exposed to SIM swapping, recycling, phishing, or support-channel abuse. The risk increases sharply when the same number is also accepted for password reset or account recovery, because the attacker can bypass the primary login and target the weaker path directly.

Failure mechanism: The phone number is mutable and externally controlled, so ownership of the number can change without a corresponding change in the user’s true authority over the account.

Impact: Attackers can intercept one-time codes, take over accounts, reset credentials, and gain access to sensitive services or downstream accounts that trust the compromised recovery channel.

Practitioner Guidance

What to verify: Treat any account that can unlock money, sensitive data, admin functions, or other credentials as out of scope for mobile-number trust. If the phone number can recover the account, it is part of the attack surface and must be reviewed as such.

Decision rule: If the number is used only as a contact point or low-risk notification channel, SMS may remain acceptable in limited cases; if it is used for login, step-up, or recovery on a high-value account, replace it with phishing-resistant authentication and separate recovery controls.

Practitioner takeaway: The key boundary is not whether a phone number is convenient, but whether the organisation can tolerate it being reassigned, intercepted, or socially engineered without losing control of the account.

Related resources from NHI Mgmt Group

• Why do legacy mobile MFA methods still leave organisations exposed even when users have two-factor authentication?
• What should organisations do when mobile numbers or inboxes are the second factor?
• Why is it crucial to adopt new authentication methods in MCP usage?
• When should organisations stop using SMS for authentication?