The code that arrives by text message protects the wrong asset: your phone number, not your account. That design flaw makes SMS two-factor authentication a last resort. The upgrade path runs from authenticator apps to passkeys, then to hardware FIDO2 keys for accounts you cannot afford to lose.
- SMS codes follow the number, not the device: SIM swapping lets an attacker receive one-time codes without touching your handset.
- Regulators are tightening the rules: NIST calls telecom authentication a restricted authenticator, and CISA advises against SMS as a second factor.
- Better options exist: authenticator apps raise the bar, passkeys resist phishing by design, and FIDO2 keys protect critical accounts.
The SIM-swap weakness built into SMS
The code goes to the number, not the handset, and the number can be duplicated. In SIM-swapping fraud, someone impersonates you to your carrier, obtains a new SIM tied to your number, and receives your SMS codes. INCIBE explains that attackers often target the one-time code a bank sends by SMS. To request the duplicate, they need personal data—name, ID number, birth date, billing address, or bank account digits—which can come from phishing, fake shops, surveys, breaches, or social media. A warning sign, says INCIBE, is suddenly losing coverage where you normally have it.
The Spanish Data Protection Agency (AEPD) fined operator Digi €70,000 in July 2023 for giving a SIM duplicate to a third party who was not the line’s owner, then dismissed its appeal. The resolution says that on 26 October 2022 the line was active irregularly from 16:30 to 17:44; during those hours, scammers made several transfers from the victim’s account. NIST also lists malicious apps reading SMS codes as a threat, typical of spyware and other malware.
What standards bodies and regulators say
The reference is NIST SP 800-63B-4, the US government’s digital authentication guideline, finalized in July 2025. As of publication, authentication over the telephone network—SMS or voice call—is the only “restricted authenticator.” Anyone accepting it must assume its risks, offer at least one non-restricted alternative, warn users, and maintain a migration plan. NIST also recommends watching for a SIM change or portability request before sending a code.
“Do not use SMS as a second authentication factor.” — CISA
The Cybersecurity and Infrastructure Security Agency (CISA) was more direct in its December 2024 mobile communications guide. The advice targets “highly exposed” people such as senior political and government officials, though CISA says it applies to anyone.
The secure upgrade ladder
1. Authenticator apps
Authenticator apps generate codes on the phone itself, so the code lives on the device, not the line. CISA says they are better than SMS but remain vulnerable to phishing: if a fake site asks for the code and you type it in, the attacker can use it immediately. This is the minimum change for email and social accounts.
2. Passkeys
A passkey is a FIDO Alliance credential stored on your phone, computer, or security key and unlocked like the device: fingerprint, face, PIN, or pattern. Passkeys replace the password with a cryptographic key pair, resist phishing by design, and leave no shared secret to steal. A FIDO Alliance-commissioned 2024 survey found 53% had activated passkeys on at least one account and 22% on every account they could—a useful trend, though it comes from the organization promoting them.
3. FIDO2 hardware keys
This is the highest level. CISA calls FIDO authentication “the strongest form of MFA” and says it resists techniques for bypassing the second factor. NIST’s highest level, AAL3, requires a phishing-resistant authenticator with a non-exportable private key, which excludes synced passkeys. For most people, a hardware key—ideally two, one as backup—makes sense for two or three critical accounts: primary email, Google or Apple account, and password manager.
What to do this week
- Review accounts using SMS as a second factor and move email and social media to an authenticator app or passkey.
- Enable passkeys wherever offered.
- Ask your carrier for a PIN or password for sensitive operations such as duplicates and portability. CISA recommends it; the AEPD resolution says Digi proposed a keyword to the victim for future duplicates.
- If coverage suddenly disappears, call your carrier and, if you see strange charges, your bank. INCIBE adds changing credentials, reviewing recovery options, and saving evidence for a report; the 017 line offers free guidance.
One caveat: many Spanish banks still use SMS to confirm payments, and you cannot always switch. There, defense means hardening the line and monitoring coverage. The problem is no longer technical but inertia: better, more convenient alternatives exist, and keeping SMS as the main lock on an important account now works in the attacker’s favor.