SMS-Based 2FA

How SMS-Based 2FA Works

SMS-based 2FA adds a second step to password login by sending a one-time code to a phone number. That extra code is intended to confirm possession of the registered number, but in practice the factor is tied to the mobile network, SIM lifecycle, and the security of the handset itself.

It is often chosen because it is easy to deploy and familiar to users. The trade-off is that the second factor is not as strong as phishing-resistant methods, so its protection is weaker when an attacker can redirect calls or texts, compromise the device, or take over the number through account recovery or carrier processes.

Why SMS-Based 2FA Is Used

Organisations still use SMS-based 2FA because it is broadly available and works on almost any phone without extra apps or hardware. That makes it a practical fallback for large user populations, legacy systems, and recovery flows where adoption speed matters more than stronger assurance.

It is usually better than password-only authentication, especially against opportunistic attacks such as credential stuffing. But it is not equivalent to phishing-resistant MFA, because the code can be observed, relayed, or intercepted, and the phone number itself becomes part of the trust chain.

For a broader comparison of second-factor options and common bypass paths, see the MFA Guide.

Common Failure Modes and Attack Paths

SMS-based 2FA fails when the attacker can exploit the phone number rather than the password. SIM swapping, SS7-style interception, malicious call forwarding, and phishing kits that relay one-time codes can all defeat the intended second factor. Account recovery abuse is especially dangerous because it can let an attacker rebind the number or reset access through weak support processes.

Another common weakness is session theft after successful login. If the attacker captures the code and immediately uses it, the login succeeds even though the user never intended to authenticate. That is why SMS codes should be treated as a weak possession factor, not as proof that the rightful user is present.

The danger is not theoretical, because real intrusions often combine weak MFA with social engineering or stolen credentials. The Twilio 0ktapus breach 2022 shows how SMS phishing can expose downstream accounts, while CitrixBleed exploitation 2023 illustrates how session theft can bypass MFA entirely.

How to Assess Exposure and Reduce Dependence

To understand exposure, organisations should identify every place SMS-based 2FA is used: primary login, step-up authentication, password reset, and account recovery. They should then check whether those paths are internet-facing, whether the mobile number is reused elsewhere, and whether the help desk can be socially engineered into changing the registered number.

The strongest reduction is to move high-value accounts to phishing-resistant methods such as passkeys or security keys. Where SMS cannot be removed immediately, it should be confined to lower-risk scenarios and paired with compensating controls such as risk-based step-up checks, strict recovery verification, and detection for number changes, unusual resets, and repeated OTP failures.

For a practical migration path away from SMS codes, the Passwordless and Passkeys Guide explains how to move toward stronger sign-in and recovery. The broader Workforce Identity Security Guide covers recovery, session theft, and phishing-resistant rollout patterns that matter when SMS is still in the mix.

Practitioner Guidance

Why practitioners should care: SMS-based 2FA is usually a transitional control, not a long-term assurance strategy. It can reduce exposure compared with passwords alone, but it should not be treated as strong protection for privileged users, administrators, or high-impact workflows.

What to watch for: repeated OTP prompts, unexpected recovery requests, number-porting events, help desk resets, and login attempts from unusual geographies or devices. Those signals often indicate that the second factor, not the password, is the part under attack.

Practitioner takeaway: Use SMS-based 2FA as a stepping stone, then prioritise phishing-resistant authentication for the accounts and workflows where account takeover would matter most.

Related resources from NHI Mgmt Group

• What do organisations get wrong about SMS-based 2FA and fraud risk?
• Who is accountable when organisations rely on SMS-based 2FA and later fall short of strong-authentication expectations?
• What breaks when social media platforms rely on SMS-based 2FA for high-profile users?
• What are the signs that SMS-based 2FA is no longer a safe default?