Is SMS two-factor authentication safe?
Short answer
SMS codes are much safer than a password alone, but they are the weakest common form of MFA. Codes can be stolen through SIM swapping, fake login pages that relay the code in real time, or malware on the phone. Use an authenticator app, passkey or security key where the service offers one.
The details
If SMS is the only option, keep it on, and add a PIN or port-out protection with your mobile carrier to make SIM swapping harder. Never read an SMS code out to someone who calls you.
Terms explained
- Passkey
- A passkey is a phishing-resistant sign-in credential based on public-key cryptography, stored on a device or in a password manager and unlocked with a biometric or device PIN.
- SIM swapping
- SIM swapping is fraud where a criminal convinces or bribes a mobile carrier to move a victim’s phone number to a SIM the criminal controls, to receive their calls and SMS codes.
- Malware
- Malware is any software designed to harm, spy on or gain unauthorized control of a device, network or account.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
Related Guides
GuidePersonal Security
Binance Hacked: $6.3 Billion Stolen — What Happened and How to Protect Your Crypto
Binance suffered a massive cryptocurrency theft on October 29, 2026. Here's what we know about the breach, what remains unclear, and how to protect your crypto from hackers and increasingly convincing scams.
Read more GuidePersonal Security
10 Ways to Keep Your Funds Safe on a Crypto Exchange After the Binance Hack Reports
Binance is investigating a suspected hot wallet hack. Here are 10 practical steps to protect crypto held on any exchange: account security, withdrawal limits, self-custody and scam awareness.
Read more GuidePersonal Security
How to Turn On MFA for Your Most Important Accounts
Learn how to turn on MFA across your email, financial, and business accounts. Follow practical steps to configure authenticator apps and passkeys securely.
Read more GuidePersonal Security
How to Secure Accounts: What to Do After a Data Breach
Learn what to do after a data breach exposes your personal information. Follow these practical steps to secure your logins, freeze credit, and stop fraud.
Read more