The security limits of SMS one-time passcodes

It has become fashionable to call SMS two-factor authentication insecure. That framing is lazy, and it leads people to the wrong conclusions. SMS one-time passcodes are extraordinarily good at the job they were designed for and genuinely weak against a narrow band of sophisticated attacks. The useful question is never whether SMS is secure in the abstract — it is which threats it defeats, which it does not, and how to layer accordingly.

What SMS codes are genuinely good at

The vast majority of account compromise is not a targeted operation against you personally. It is bulk, automated, and opportunistic: credentials leaked in some unrelated breach, replayed against a thousand sites by a script, hoping you reused a password. Against that flood, an SMS code is a wall.

• Credential stuffing dies instantly, because the attacker has your password but not the phone the code lands on.
• Mass fake-account creation slows to a crawl, because each account needs a distinct number that can receive a real message.
• Casual account takeover — a guessed password, a shoulder-surfed login — is stopped cold by a second factor the attacker cannot see.
• It works for everyone, on any handset, with no app to install, which means the protection actually gets switched on rather than skipped.

Measured against the attacks that actually happen to ordinary accounts at scale, SMS verification removes most of the risk for almost none of the friction. That is not a weak security control. That is one of the most cost-effective ones ever deployed.

Where it genuinely breaks

The weaknesses are real, but they share a common trait: they require an attacker who has singled you out and is willing to spend real effort. Three matter most.

• SIM swapping: an attacker social-engineers your mobile carrier into moving your number to their SIM, after which your codes ring on their phone. This targets a specific, usually high-value victim.
• Network interception: legacy signalling weaknesses in the phone system can, in the wrong hands, allow messages to be intercepted in transit. It is expensive and far from universal, but it exists.
• Real-time phishing: a fake login page relays your password and the code you just typed straight to the real site while the code is still valid. The SMS worked perfectly; you handed the output to the wrong door.

Notice what none of these are: a script hitting a million accounts. They are hands-on, per-target attacks. If you are a specific person guarding a specific high-value asset — a large crypto balance, a public figure's accounts, an admin panel — you should assume a motivated adversary and not rely on SMS as your only line. For the ordinary account, none of these is the threat you actually face.

Why phishing is the one to fear

Of the three, real-time phishing is the most democratic. SIM swaps and interception take resources; a convincing fake login page takes a weekend. And crucially, it defeats every code-based factor equally — an authenticator app's rotating number is just as phishable as an SMS code, because in both cases you are typing a secret into a page that forwards it onward.

A one-time code protects you from someone who does not have it. It does nothing to protect you from cheerfully typing it into an attacker's website yourself.

This is why the security world is drifting toward passkeys and hardware keys for the highest-value logins: they bind the login to the real site's origin, so a look-alike domain simply cannot complete the handshake. That is a genuine step up. But it is a complement to SMS for the accounts that warrant it, not a reason to rip codes out of the ninety-nine percent of signups where they do their job beautifully.

Using SMS OTP wisely

The right posture is not all-or-nothing. It is matching the factor to the stakes and closing the gaps you can close for free.

• Use unique passwords everywhere, so an SMS second factor never has to compensate for a reused, already-leaked one.
• For genuinely high-value accounts, add an authenticator app or a hardware key on top of, or instead of, SMS.
• Slow down before typing any code: check the domain in the address bar, and never enter a code on a page you reached from a link in a message.
• Keep the number that anchors an important account under your control, and be wary of tying critical recovery to a line you cannot defend.

The takeaway

SMS one-time passcodes are not the strongest factor and were never meant to be. They are the universal one — the layer that raises the floor for everybody against the automated attacks that make up the bulk of real-world abuse. Understand the three narrow ways they fail, reserve stronger factors for the accounts that truly need them, and treat every code as something you reveal deliberately rather than reflexively. Do that, and SMS earns its place: not perfect, but quietly stopping most of what would otherwise get through.