SMS forwarding is the redirection of text messages from one phone number or device to another. In security practice, it can move one-time passcodes and account alerts away from the intended handset, which weakens SMS-based authentication and can expose accounts if forwarding rules are misused or unauthorised.
How SMS forwarding changes the security meaning of a text message
SMS forwarding is not just a convenience feature. It changes the trust boundary around a phone number, because a message received by one handset can be silently redirected to another device or number. In security terms, that matters because many services still treat SMS as proof of presence, possession, or awareness.
Once forwarding exists, the security value of the original recipient device drops. A one-time code, reset link, or fraud alert may still be delivered, but not necessarily to the person or device the service expected. That creates a gap between message delivery and actual account control.
Forwarding can be built into the carrier, the device, or an app, and each layer has different visibility and governance. The practical issue is not the forwarding mechanism itself, but whether users and administrators can prove where messages are going and whether that route is authorised.
Why SMS forwarding weakens SMS-based authentication
SMS-based authentication depends on the assumption that the intended handset is the only practical place a code can be read quickly. Forwarding breaks that assumption. If an attacker, rogue insider, or misconfigured rule can redirect messages, they may receive one-time passcodes, password reset prompts, or account verification notices before the legitimate user notices anything unusual.
This is why SMS forwarding is especially dangerous when SMS is used as a fallback factor. It can preserve the appearance of normal delivery while quietly moving the security signal to a different endpoint.
That weakness is not limited to login flows. Account alerts, transaction warnings, and support callbacks can also be diverted, which reduces the chance that the real owner sees early signs of compromise.
Where the exposure comes from
Exposure usually comes from weak visibility, shared access to a device or account, or an overlooked forwarding setting that survives after a phone change, SIM swap, or device transfer. The risk rises when the forwarding destination is outside normal enterprise management, because the organisation may not control or monitor it.
Forwarding also creates a persistence problem. Even when a password is changed, an attacker who already has message redirection may continue to collect sensitive texts until the forwarding rule is discovered and removed.
For services that still rely on SMS, the core exposure is simple: the channel can be observed indirectly, so the message content may remain confidential in transit but still be operationally exposed at the endpoint.
How organisations should treat it in practice
SMS forwarding should be treated as an account and endpoint governance issue, not just a telecom setting. The important question is whether message redirection is expected, documented, and reviewable. If it is not, it should be treated as a suspicious condition.
Organisations should also assume that SMS forwarding can defeat weak assumptions about user presence. Where possible, the safer posture is to reduce dependence on SMS for authentication and high-value alerts, especially when stronger factors or out-of-band channels are available.
When a forwarding route is legitimate, it still needs ownership, periodic review, and clear separation between business messaging and personal redirection. Without that discipline, a convenience feature becomes a hidden access path.
Risk and Threat Considerations
SMS forwarding can create a silent compromise path because it preserves the appearance of normal message delivery while moving security-relevant texts to an unintended recipient. The danger is highest when organisations still rely on SMS for one-time passcodes, password resets, or fraud alerts.
Failure mechanism: A forwarding rule, device compromise, carrier setting, or unmanaged redirection path intercepts messages after they leave the intended number, allowing an attacker or unauthorised party to receive authentication codes or security notifications.
Impact: Account takeover becomes easier, alerting is weakened, and response to suspicious activity may be delayed because the real user no longer sees the messages first.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SMS forwarding can undermine the lifecycle and use of one-time authenticators. |
| IA-2 — Identification and Authentication (Organizational Users) | The term affects how users are authenticated when SMS is used as a login factor. | |
| AC-2 — Account Management | Forwarding rules and message delivery paths need ownership and periodic review. | |
| Recommendation — Review and restrict SMS-delivered authenticators and rotate away from weaker message-based factors where possible. Require stronger user authentication than SMS when account access is sensitive. Monitor account-linked forwarding settings and remove unauthorised redirection paths promptly. | ||
| NIST SP 800-63 | Authenticator Assurance Levels — Authenticator Assurance Levels | The topic concerns the weakness of SMS as a factor in digital identity workflows. |
| Recommendation — Prefer phishing-resistant authenticators instead of SMS for higher-assurance access. | ||
| MITRE ATT&CK | T1114 — Email Collection | Message forwarding is an analogous collection path for intercepting security notifications and codes. |
| Recommendation — Hunt for post-compromise collection paths that redirect security messages away from the intended user. | ||
| CIS Controls v8 | CIS-6 — Access Control Management | Forwarding settings are a control path that can expand access to security-relevant messages. |
| Recommendation — Enforce least privilege over messaging and telephony settings that can redirect sensitive texts. | ||
Practitioner Guidance
What to watch for: Look for unexplained changes in message delivery, new forwarding destinations, or authentication flows that still rely on SMS after a device, number, or carrier change. Those are common signals that the message path is no longer trustworthy.
Governance implication: Treat message redirection as part of access control and account hygiene, because the control question is not only who owns the number, but who can actually read what arrives there.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org