SMS MFA Is Not MFA

NIST Special Publication 800-63B restricted SMS as an out-of-band authenticator in 2017. Eight years later, most consumer banks and a depressing number of B2B apps still call a text message "two-factor authentication." It is a second channel. It is not a second factor you should bet an account on.

I have watched SIM-swap takeovers hit founders, and I have watched support teams treat "we sent a code to the phone" as if that sentence were a security control. The phone number is not something you have. It is something a carrier employee or an SS7 path can reroute. The longer cultural version is in SMS-Based MFA on Tech Graveyard. This page is what to rip out, and what to put in.

Why a text message fails as a factor

MFA is supposed to combine independent factors: something you know, have, or are. SMS claims to be "have the phone." In practice it is "control the number," and control of the number lives at the carrier.

SIM swap. An attacker social-engineers the carrier, ports the number, and receives your codes. High-profile cases at Coinbase and against public figures made this visible. The pattern is ordinary.

SS7 and redirect. The signaling system that routes texts was not designed to be a security boundary. Messages can be intercepted without touching the handset.

Phishing in real time. The user types the code into a fake login page. The attacker relays it. SMS has no origin binding. Neither does TOTP typed into the same form. Only WebAuthn binds the response to the real site.

Support override. The help desk that will "just send a new code" or reset to SMS after a sob story is the actual second factor. Attackers know this.

A one-time code to email has the same shape. It is slightly harder to port and slightly easier to phish. Do not treat it as a promotion from SMS. Treat it as the same class.

What still uses it, and why

Banks, ride-share, and a long tail of SaaS keep SMS because it works without an app install and because the cost of a swap falls on the user. That is inertia plus misaligned cost, not a security argument.

There is one honest remaining use: a low-assurance recovery hint when every stronger factor is gone, with step-up, delay, and a human review. It is not a login factor. If your admin console, production cloud, or customer identity accepts SMS as sufficient MFA, you do not have MFA on that path.

What to put in its place

Push notifications (Duo, Authy-style) are better than SMS and still phishable if the user approves a prompt they did not start. Number matching helps. It is not phishing-resistant. Save that word for FIDO.

If you are on a managed CIAM, this is configuration: disable SMS as a sufficient factor, offer passkeys, keep TOTP for a transition year. If you rolled your own, you are on the hook for the recovery design the passkeys guide spends half its length on.

How to migrate off SMS without a revolt

1. Measure. How many accounts have SMS as their only second factor. That is your blast radius.
2. Enroll a better factor first. Prompt passkey or TOTP on the next successful SMS login. Do not announce a cutoff before the prompt exists.
3. Demote SMS. After 30 to 90 days, SMS can start a recovery, not a session. Say that in the UI.
4. Kill it for privileged roles immediately. Founders, billing admins, production. This week, not the project plan.
5. Tell customers the reason. "NIST deprecated this in 2017 and SIM swaps are routine" is clearer than "we are enhancing your experience."

The solo-founder stack already says turn MFA on for your own team before you worry about customer-facing fashion. That MFA is not SMS.

Failure modes

1. Calling SMS "2FA" in a SOC 2 narrative. Auditors are catching up. Buyers already have.
2. SMS as the passkey recovery. You rebuilt the hole behind a modern front door.
3. Cutoff with no enrolled alternative. You will flood support and then turn SMS back on.
4. Push-without-number-matching as the end state. Better than SMS. Not the destination.
5. Leaving founder and root accounts on SMS because "we know our numbers." Those are the accounts that get swapped.