• Blog

Why SMS Codes Are No Longer Enough (and What to Use Instead) 

For years, Multi-Factor Authentication (MFA) has been a fundamental layer of defence for protecting user accounts, systems, and data. MFA itself remains essential. What has changed is the effectiveness of certain methods, particularly those that rely on SMS text messages. 

The most widely used form of MFA still involves four- or six-digit codes sent via SMS. It’s familiar, quick to deploy, and unquestionably better than relying on passwords alone. However, SMS is built on legacy telecommunications technology that was never designed with modern cybersecurity threats in mind. Today’s attackers understand this weakness and actively exploit it. 

For organisations that handle sensitive personal data, financial information, or regulated workloads, SMS-based MFA no longer provides sufficient protection. To stay ahead of modern threats, businesses must adopt phishing-resistant authentication methods that are built for today’s attack landscape. 

Why SMS MFA Is Inherently Weak

SMS was never intended to function as a secure authentication channel. It relies on cellular network infrastructure that contains well-documented vulnerabilities, particularly within Signaling System No. 7 (SS7), the protocol used by mobile carriers to exchange messages and route calls. 

Attackers know that many organisations still depend on SMS for MFA, making it a high-value target. By exploiting SS7 weaknesses, cybercriminals can intercept or redirect text messages without ever accessing the victim’s device. Techniques such as message interception, redirection, and injection can occur within carrier networks or during over-the-air transmission. 

SMS-based MFA is also highly vulnerable to phishing attacks. If a user unknowingly enters their username, password, and SMS code into a fake login page, attackers can capture all three in real time and immediately access the legitimate account. At that point, MFA offers little more protection than a password alone. 

For organisations already investing in broader security controls, such as endpoint protection and Microsoft 365 hardening, continuing to rely on SMS MFA creates a significant gap in the security chain. 

Understanding SIM Swapping Attacks

One of the most damaging threats associated with SMS MFA is SIM swapping. In a SIM swap attack, a criminal contacts a mobile network provider while impersonating the victim and claims their phone has been lost or damaged. The attacker then convinces support staff to transfer the victim’s phone number to a new SIM card that the attacker controls. 

Once the number is ported, the victim’s phone loses service, and the attacker begins receiving all calls and SMS messages, including MFA codes for email, banking, and cloud services. From there, password resets and account takeovers can happen very quickly. 

SIM swapping does not require advanced technical skills. It relies on social engineering and procedural weaknesses within telecoms support processes, which makes it a low-effort, high-impact attack method. This is why it continues to feature heavily in data breach investigations and financial fraud cases. 

Why Phishing-Resistant MFA Is the New Gold Standard

To counter these threats, organisations need to remove as much human dependency from authentication as possible. Phishing-resistant MFA achieves this by using cryptographic methods that bind authentication requests to a specific service or domain. 

Modern standards such as FIDO2 use public-key cryptography to create secure credentials that are tied to a specific device and website. When a user attempts to sign in, the authentication process validates both the device and the domain. If the domain does not match, authentication fails automatically, even if the user is tricked into clicking a phishing link. 

Because no shared secrets or one-time passcodes are transmitted, attackers cannot intercept or replay credentials. This approach aligns closely with guidance from bodies such as the UK National Cyber Security Centre (NCSC), which strongly discourages SMS-based MFA for high-risk accounts (see: https://www.ncsc.gov.uk/guidance/multi-factor-authentication-online-services). 

Implementing Hardware Security Keys

Hardware security keys represent one of the strongest forms of phishing-resistant authentication currently available. These physical devices, often resembling USB sticks, connect directly to a computer or mobile device. 

During login, the key performs a cryptographic handshake with the service, confirming both user presence and device authenticity. There are no codes to type and nothing that can be intercepted remotely. Unless an attacker physically steals the key, they cannot access the account. 

Hardware keys are commonly used to protect administrator accounts, privileged users, and senior leadership access. They are particularly effective when combined with identity controls within Microsoft Entra ID (Azure AD) and conditional access policies, learn more: https://www.sedcom.net/microsoft-365-security. 

Mobile Authenticator Apps and Push Notifications

If hardware keys are not practical for all users, mobile authenticator apps such as Microsoft Authenticator or Google Authenticator provide a more secure alternative to SMS MFA. These apps generate time-based codes locally on the device, removing reliance on cellular networks and eliminating the risk of SIM swapping. 

However, simple push notifications can introduce a different risk known as MFA fatigue. Attackers may repeatedly send login requests until a user mistakenly approves one. To address this, modern authentication platforms now support number matching, requiring users to enter a displayed number from their login screen into the authenticator app. This ensures the approval is intentional and context-aware. 

Sedcom routinely helps organisations configure these protections as part of identity and access management reviews see: https://www.sedcom.net/cyber-security-services. 

Passkeys: The Future of Authentication

With passwords routinely exposed in breaches, many platforms are now adopting passkeys as a replacement. Passkeys are device-based credentials secured by biometrics such as fingerprint or facial recognition. They are inherently phishing-resistant and cannot be reused or shared. 

Passkeys can synchronise securely across trusted ecosystems such as iCloud Keychain or Google Password Manager, offering the security of hardware-based authentication with the convenience of everyday devices. 

From an operational perspective, passkeys significantly reduce IT support overhead. There are no passwords to reset, store, or manage, which lowers both risk and administrative cost while improving the user experience. 

Balancing Security With User Experience

Moving away from SMS MFA requires a shift in mindset. Users are accustomed to text messages, and introducing new authentication methods can initially feel disruptive. 

Clear communication is essential. Explaining the real-world risks of SIM swapping and phishing helps users understand why changes are necessary. When people understand that these measures protect both the business and their own personal data, adoption improves significantly. 

A phased rollout can ease the transition for general users, but phishing-resistant MFA should be mandatory for privileged accounts from day one. Administrators and executives should never rely on SMS-based authentication. 

The Cost of Standing Still

Continuing to rely on legacy MFA methods creates a dangerous false sense of security. While SMS MFA may satisfy basic compliance requirements, it leaves organisations exposed to account compromise, data breaches, and reputational damage. 

Upgrading authentication controls delivers one of the highest returns on investment in cybersecurity. The cost of implementing modern MFA solutions is negligible compared to the financial and operational impact of an incident. 

Is your organisation ready to move beyond passwords and text codes? Sedcom specialises in deploying modern identity and access solutions that strengthen security without disrupting your teams. Get in touch to discuss how we can help you implement a secure, future-proof authentication strategy.