SMS text messaging is the exchange of short text messages over the Short Message Service on mobile networks. It uses a phone number and carrier infrastructure rather than an app-specific internet connection, and is often used for alerts, notifications and verification codes, although it is weaker than stronger authentication channels because messages can be intercepted or redirected.
How SMS Text Messaging Works
SMS text messaging sends short messages through the mobile carrier signalling and messaging infrastructure linked to a phone number. That makes it broadly available and simple to use, but it also means delivery depends on telecommunications routing and trust in the mobile network rather than a dedicated application security model.
Because SMS is transport-based rather than app-based, it is often used for notifications, alerts, and one-time verification codes. It is also one of the most familiar channels for users, which is why organisations still rely on it even when stronger options exist.
Why SMS Is Still Used
SMS remains common because it works on almost every mobile device, does not require an app installation, and can reach users even when data connectivity is limited. That practicality makes it useful for time-sensitive communication where wide reach matters more than rich features.
In security workflows, SMS is often chosen as a fallback or convenience channel for account recovery, login verification, and out-of-band notifications. It is easy to deploy operationally, but ease of deployment should not be confused with strong assurance.
Security Strengths and Limits
SMS can provide a second communication channel, but it is not a strong authenticator by itself. Messages can be intercepted, forwarded, redirected through telecom abuse, or exposed through device compromise, so SMS should be treated as weaker than phishing-resistant authentication methods.
The main limitation is that the phone number is not the same thing as possession of a secure authenticator. If an attacker can take over a SIM, hijack a number, or read messages on the device, SMS-based verification can be bypassed.
Common Enterprise Use Cases
Organisations use SMS for user alerts, service notifications, appointment reminders, and low-friction verification where the business need is reach rather than high assurance. In some environments it also appears in password reset and recovery flows, which is where its security weaknesses matter most.
For that reason, SMS is best understood as a delivery channel with security implications, not as a full identity or access control mechanism. When it is used in verification, the surrounding process matters as much as the message itself.
Risk and Threat Considerations
SMS becomes risky when organisations treat it as a strong proof of identity. Attackers can exploit SIM swap, number porting, message interception, or mobile malware to capture codes and defeat recovery or step-up verification.
Failure mechanism: The attacker gains control of the phone number, the handset, or the message path, then uses the intercepted code or notification to complete account access or reset a credential.
Impact: This can lead to account takeover, unauthorized transaction approval, recovery-channel abuse, and compromise of downstream systems that trusted the SMS event as sufficient verification.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST SP 800-63, NIST SP 800-53 Rev 5, CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines authenticator assurance and why SMS is weaker than stronger authenticators. |
| Recommendation — Prefer phishing-resistant authenticators over SMS for high-assurance verification. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SMS verification depends on managed authenticators and recovery secrets. |
| IA-2 — Identification and Authentication (Organizational Users) | SMS is often used in user authentication and recovery workflows. | |
| AU-2 — Event Logging | SMS-driven verification and recovery events should be logged for review. | |
| Recommendation — Apply IA-5 to govern credential lifecycle and avoid relying on SMS alone. Use stronger identification and authentication controls than SMS for organizational access. Log SMS-based verification and recovery actions for later investigation. | ||
| CIS Controls v8 | 5 — Account Management | SMS commonly appears in account recovery and login flows that need account governance. |
| Recommendation — Restrict SMS to low-risk use cases and govern recovery paths tightly. | ||
| NIST CSF 2.0 | PR.AA-05 — Authentication | SMS is an authentication channel that should be evaluated against stronger access controls. |
| Recommendation — Use stronger authentication mechanisms for access decisions instead of SMS. | ||
Practitioner Guidance
Why practitioners should care: SMS is acceptable for broad-reach messaging, but it should not be the default choice for high-assurance authentication or sensitive recovery paths. Where stronger authenticators are available, SMS should be the fallback rather than the primary trust anchor.
What to watch for: Review whether SMS is being used for password resets, step-up authentication, or approval flows that would materially change access if intercepted. If so, the process likely needs a stronger channel or an additional control.
Practitioner takeaway: Use SMS for convenience and reach, not for strong assurance, and align its use with the sensitivity of the action it enables.
Related resources from NHI Mgmt Group
- Why do attackers increasingly move phishing conversations from email to SMS or other messaging channels?
- What happens when mobile messaging providers do not filter malicious SMS before transmission?
- What should teams do when a suspicious text asks them to continue the conversation on WhatsApp or another messaging app?
- How should healthcare organisations evaluate secure text messaging for HIPAA compliance beyond basic encryption?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org