Is an authenticator app better than SMS for two-factor authentication?
Short answer
Yes, an authenticator app is significantly more secure than SMS for two-factor authentication. SMS verification codes travel over cellular networks where attackers can intercept them through techniques like SIM swapping. An authenticator app generates one-time passcodes locally on your device without relying on mobile carriers. This prevents phone-based interception and provides stronger defense for your accounts.
The details
Text messages were not designed for secure identity verification. Attackers can bribe or trick mobile carrier representatives to transfer your phone number to a new card, a tactic known as SIM swapping. They can also exploit weaknesses in telecommunication protocols. Once an attacker controls your phone number, they can intercept login texts and reset passwords across multiple services.
Authenticator apps generate time-based codes directly on your smartphone. Because these codes never travel across cellular networks, remote attackers cannot intercept them by manipulating carrier records. To breach an account secured by an app, an adversary must possess the physical device or compromise it directly. NIST SP 800-63B digital identity guidelines restrict out-of-band SMS methods in higher assurance tiers due to these inherent transmission risks.
What to do
- Install an authenticator app from an official device app store.
- Sign in to your account and locate the security settings.
- Select the authenticator app option instead of text messaging.
- Scan the displayed QR code with your authenticator app.
- Save the provided backup codes in a secure password manager.
Useful next reads and tools
Terms explained
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- SIM swapping
- SIM swapping is fraud where a criminal convinces or bribes a mobile carrier to move a victim’s phone number to a SIM the criminal controls, to receive their calls and SMS codes.