Two Passwords Don't Equal Two Factors
"Enable 2FA" is advice you hear everywhere. But most people enable the SMS version — a 6-digit code texted to their phone — and consider themselves secure. They're more secure than without 2FA, yes. But SMS-based 2FA has real, well-documented weaknesses that you should know about.
This isn't to scare you away from SMS 2FA. It's to help you understand what you're actually getting, and when to use something stronger.
What Is Two-Factor Authentication?
Authentication factors come in three types:
- Something you know — password, PIN
- Something you have — phone, hardware key, authenticator app
- Something you are — fingerprint, face ID
Two-factor authentication (2FA) means using two different types. A password + SMS code is "something you know" + "something you have." That's real 2FA — and it's dramatically better than a password alone.
The problem isn't 2FA itself. The problem is that "something you have (a phone)" can be hijacked without physically stealing your phone.
Why SMS 2FA Can Be Intercepted
SIM Swapping
The most common SMS attack. Here's how it works:
- An attacker calls your mobile carrier pretending to be you
- They claim they lost their phone and need the number moved to a new SIM
- The carrier transfers your number to their SIM
- Every SMS sent to "your" number now goes to the attacker
- They request password resets + SMS codes for your accounts
This has happened to prominent figures. Cryptocurrency exchange accounts, email accounts, social media — SIM swapping is a well-known vector because carrier verification is inconsistently enforced.
SS7 Protocol Vulnerabilities
The SS7 protocol is the 40-year-old technical backbone that routes phone calls and SMS worldwide. It has known security vulnerabilities that allow nation-state attackers and sophisticated criminal groups to intercept SMS messages in transit without touching your phone or your carrier.
For most people, SS7 attacks are theoretical. For high-value targets (executives, journalists, activists), they're a real threat.
Phishing for SMS Codes in Real-Time
The most common attack against regular users: a fake login page captures your password AND your SMS code simultaneously, then replays them to the real site before the code expires.
You enter your credentials on a convincing fake site → they log in to the real site → the real site sends you an SMS → you enter the SMS on the fake site → attacker has your session.
This is called a "real-time phishing attack" or "adversary-in-the-middle" (AiTM) attack. It works against SMS 2FA even though you never gave up your phone.
What's Stronger Than SMS
Authenticator Apps (TOTP)
Apps like Google Authenticator, Authy, or any TOTP-compatible app generate time-based codes locally on your device. No SMS, no carrier involved.
Why it's better: codes are generated on your device, not sent over a network. A SIM swap doesn't help — the code is on your original phone. Real-time phishing still works (if you enter the code on a fake site), but SS7 attacks don't apply.
Use for: any service that supports it. Prefer this over SMS.
Hardware Security Keys (FIDO2/WebAuthn)
Physical devices (YubiKey, Google Titan, etc.) that plug into USB or tap via NFC. When you log in, you physically touch the key to confirm.
Why it's stronger: cryptographic proof, no codes to intercept, phishing-resistant (the key verifies it's talking to the real site by checking the domain). Real-time phishing doesn't work — the key won't authenticate to a fake domain.
Use for: your most critical accounts — email, banking, company accounts. Worth the investment.
Passkeys
Passkeys replace passwords entirely using public-key cryptography stored on your device. Supported by Apple, Google, Microsoft, and growing lists of services.
Why it's stronger: no password to steal, no code to intercept, phishing-resistant by design (cryptographic domain binding). The private key never leaves your device.
Use for: any service that supports them (Apple ID, Google Account, GitHub, PayPal, 1Password, and more).
The Honest Ranking
From least to most secure:
- No 2FA — password only (avoid)
- SMS 2FA — better than nothing, vulnerable to SIM swap + AiTM phishing
- Authenticator app (TOTP) — SIM swap immune, still vulnerable to AiTM phishing
- Hardware key (FIDO2) — phishing-resistant, requires physical presence
- Passkeys — phishing-resistant, no password, best UX of the strong options
What to Actually Do
For most people:
- Use an authenticator app (not SMS) wherever possible
- Use SMS if it's the only option — it's still much better than nothing
- Enable 2FA on email first — it's the master key to all your other accounts
For high-value accounts (banking, crypto, company access):
- Hardware security key or passkeys
- Unique, strong password (use a Password Generator)
- Check if your email has been in a breach (Email Breach Checker)
For everyone:
- Never reuse passwords across sites
- If a breach happens: change the password, check if the same password was used elsewhere, enable 2FA if you haven't
The Bottom Line
SMS 2FA is better than no 2FA. If it's the only option, use it. But if a service offers an authenticator app or hardware key option, take it — the improvement in security is significant.
The most important thing is having 2FA on your email account. Email is the recovery mechanism for everything else — if an attacker controls your email, they can reset every other password you have.
Check if your email has been in a breach — then enable 2FA on it today.