Two-factor authentication (2FA) is a method that strengthens account security by requiring a second authentication factor in addition to a password. The basic principle combines two or more of three factors: "knowledge" (password), "possession" (smartphone), and "biometrics" (fingerprint/face). SMS codes sent to phone numbers are the most widely used "possession" factor. Stacking two steps that draw on the same factor, such as a password plus a secret question, is not strictly two-factor authentication, because only one type of factor is involved.
SMS authentication works simply. When logging in with a password, a 4-6 digit confirmation code is sent via SMS to the registered phone number. Entering this code proves "possession of the device with that phone number." Services across banking, social media, email, and e-commerce widely support SMS authentication, and its popularity comes from the convenience of requiring no additional apps or hardware.
However, SMS authentication has serious vulnerabilities. SIM swap attacks can hijack phone numbers, redirecting SMS codes to attackers. Interception of SMS via SS7 (phone network signaling protocol) vulnerabilities is also technically possible. Furthermore, smishing can direct victims to fake login pages where SMS codes are entered in real-time for man-in-the-middle attacks. The digital identity guidelines published by NIST (National Institute of Standards and Technology), SP 800-63B, classify the use of the PSTN to deliver one-time codes as a "restricted" authenticator. In revision 4, which became the current version on August 1, 2025, this is the only restricted authenticator: the party issuing credentials must offer at least one unrestricted alternative and give subscribers meaningful notice of the risks, while verifiers are urged to check indicators such as SIM changes and number porting before sending a code over the PSTN.
Safer authentication methods include: authenticator apps (Google Authenticator, Authy, Microsoft Authenticator) that generate time-based one-time passwords (TOTP) on-device, eliminating interception risk. Hardware keys (YubiKey, Titan Security Key) are physical USB/NFC devices with the highest phishing resistance. Passkeys (FIDO2) combine biometrics with cryptographic keys, eliminating passwords entirely. Even when only SMS authentication is available, enabling it is safer than having no 2FA at all. Still, hold one line: never give out a verification code to someone who calls you, even if they claim to be your bank or a service desk. Enter codes only on a login screen you opened yourself. Compare authentication methods in Risks of Phone-Based Two-Factor Authentication and Safer Alternatives.