The MFA Level-Up: Why SMS Codes Are No Longer Enough (and What to Use Instead)

Multi-Factor Authentication (MFA) has long been a cornerstone of good security. Adding a second step beyond a password dramatically reduces the risk of account compromise.

However, the threat landscape has moved on — and unfortunately, SMS-based MFA hasn’t kept up. While text message codes are better than passwords alone, they’re now one of the weakest forms of MFA still in common use.

Cybercriminals have developed reliable ways to intercept or bypass SMS codes entirely. For any business handling sensitive data, relying on text messages for authentication is no longer enough.

Why SMS Was Never Designed for Security

SMS was created for convenience, not protection. It relies on mobile carrier infrastructure that contains known weaknesses — particularly within signalling protocols such as SS7, which enable communication between telecom networks.

Attackers exploit these weaknesses to:

• Intercept messages in transit
• Redirect texts to another device
• Inject or suppress messages entirely

In other words, hackers can steal MFA codes without ever touching your phone. Because SMS traffic travels across multiple networks, it’s difficult to secure end-to-end.

Why SMS MFA Is a Popular Target

Attackers focus on what’s widely used. Since many organisations still rely on SMS for MFA, it’s an attractive and efficient target.

SMS codes are also highly vulnerable to phishing. If a user enters their username, password, and SMS code into a fake login page, attackers can capture everything in real time and immediately log in to the real service.

Understanding SIM-Swapping Attacks

One of the most dangerous threats to SMS-based security is the SIM swap.

In a SIM-swapping attack, a criminal contacts your mobile provider pretending to be you. By using social engineering, they convince support staff to transfer your phone number to a new SIM card that the attacker controls.

Once successful:

• Your phone loses service
• The attacker receives all calls and SMS messages
• MFA codes for email, banking, and cloud services go straight to them

This type of attack requires very little technical skill — but the consequences can be devastating.

💡 If your business still relies on SMS codes, our Cybersecurity services can help you upgrade authentication safely.

Why Phishing-Resistant MFA Is the New Gold Standard

To stop modern attacks, businesses need to remove the weakest link: human-readable codes. Phishing-resistant MFA uses cryptographic authentication that verifies both the user and the website being accessed.

A widely adopted standard is FIDO2, which uses public-key cryptography to create device-bound credentials (often called passkeys). These credentials only work on the legitimate domain they were created for.

Even if a user clicks a phishing link, their authenticator simply won’t release credentials because the domain doesn’t match.

Hardware Security Keys

Hardware security keys are one of the strongest MFA options available. These physical devices plug into a computer or tap against a mobile phone.

To authenticate, the user inserts the key or taps it — triggering a cryptographic challenge. There’s nothing to type, which means there’s nothing for attackers to steal remotely.

Unless someone physically steals the key, they cannot access the account.

Authenticator Apps (Done Properly)

If hardware keys aren’t practical, authenticator apps such as Microsoft Authenticator or Google Authenticator are a strong alternative.

These apps generate codes locally on the device, avoiding the risks of SMS interception or SIM swapping.

However, basic push notifications can still be abused through MFA fatigue attacks, where users are spammed with approval requests. Modern apps counter this with number matching, requiring users to confirm a code shown on their screen — proving they initiated the login.

Passkeys: The Future of Authentication

Passkeys eliminate passwords entirely. They’re stored securely on a device and protected by biometrics such as fingerprints or Face ID.

They’re phishing-resistant by design and can sync securely across platforms like iCloud Keychain or Google Password Manager.

From an IT perspective, passkeys also reduce support workload — there are no passwords to reset, expire, or manage.

Balancing Security and User Experience

Moving away from SMS MFA often meets resistance. Text messages feel simple and familiar, while new methods can seem intimidating at first.

Clear communication is essential. When users understand the real risks of SIM swapping and phishing, they’re far more willing to adopt stronger authentication.

A phased rollout works well for most organisations. However, privileged accounts — administrators, finance teams, and executives — should move to phishing-resistant MFA immediately.

The Cost of Standing Still

Sticking with outdated MFA methods creates a false sense of security. While SMS MFA may tick compliance boxes, it leaves real gaps attackers actively exploit.

The cost of upgrading authentication is tiny compared to the financial, legal, and reputational damage of a breach. Few security upgrades offer a higher return on investment.

👉 Ready to move beyond SMS codes? Our Managed IT Services help businesses deploy modern, user-friendly MFA without disrupting day-to-day work.

Article used with permission from The Technology Press.

---