Skip to content
Deepak Gupta markTech Graveyard

Tech Graveyard/authentication

SMS-Based MFA (2011 to Dying)

The most cited example of cybersecurity inertia. NIST restricted SMS MFA in 2017. SIM swaps against Twitter's co-founder in 2019 and the SEC's X account in 2024 kept the risk in the headlines.

Born 2011 · Still dying, projected end 2027 · Status: dying

By Deepak Gupta · Published · Last updated

Paired prediction: what replaces it in Future Tech

Certificate of Death

Name of decedent

SMS-Based MFA

Born
2011
Died
Not yet
Age
15+

Cause of death

SIM-swap attacks on high-profile accounts forced regulatory action

Survived by

TOTP apps, push notifications, passkeys, hardware security keys

Invented by

Popularized by Google 2-Step Verification, February 2011

Status: DyingProjected final breath: 2027

Filed by D. Gupta · guptadeepak.com

The hook

The final NIST Special Publication 800-63B classified SMS as a restricted MFA channel in 2017. Years later, many US banks still rely on it.

Thesis. SMS MFA survived not because it works, but because the cost of replacing it falls on companies while the cost of breach falls on users.

The story

The origin

Google launched 2-Step Verification in February 2011. SMS was the obvious channel: everyone has a phone, the carriers already deliver text messages, no app install required. The first 10 years of mainstream MFA were built on a primitive nobody designed for security.

The peak

By 2018 SMS MFA was the standard 'we take security seriously' feature. Banks, social platforms, exchanges. Every signup flow that added MFA added SMS first because it was the easiest factor to ship.

The first crack

The 2016 draft of NIST SP 800-63B proposed deprecating SMS for out-of-band authentication. The final 2017 version classified it as RESTRICTED instead: still allowed, but only if the organization assesses and accepts the risk. The technical community already knew SS7 attacks and SIM swaps were trivial; the regulatory acknowledgment was the news.

The breach pattern

Twitter co-founder Jack Dorsey's account was hijacked through a SIM swap in August 2019. In January 2024, attackers SIM-swapped the phone number tied to the SEC's X account and posted a fake bitcoin ETF approval. Public, named, embarrassing. The pattern got harder to ignore.

The slow death

TOTP apps and push-based MFA already dominate new deployments. SMS persists in legacy systems and regulated industries where switching costs are real and regulators move slowly. Final breath projected 2027.

Key data points

  • Google 2-Step Verification launch: February 2011
  • NIST SP 800-63B classifies SMS as RESTRICTED: 2017
  • Jack Dorsey SIM-swap incident: August 2019
  • SEC X account hijacked via SIM swap: January 2024
  • FCC adopts rules against SIM-swap fraud: November 2023

Contrarian angle

SMS MFA is not being killed by attackers. It is being killed by the SMS providers raising prices faster than companies can budget for them.

The flip side

What replaces it

The paired prediction in Future Tech.

Read the prediction

FAQ

Is SMS MFA still better than no MFA?

Yes, barely. It blocks unsophisticated credential-stuffing attacks. It does not block phishing kits, SIM-swap attacks, or SS7 interception. Treat it as a floor, not a ceiling.

Are TOTP apps actually phishing-resistant?

No. TOTP codes can be phished in real time on a fake login page. They are better than SMS for SIM-swap protection, but they are not phishing-resistant. Only WebAuthn-class factors are.

Why didn't NIST's restriction kill SMS MFA immediately?

NIST guidance is advisory for the private sector. Federal contractors comply faster than banks. Banks tend to move when their own regulators or examiners push, and that usually lags NIST by years.

More from guptadeepak.com

Further reading

Related obituaries

More from the authentication graveyard.