Neither channel is strong on its own. NIST treats the public telephone network, meaning SMS and voice, as a restricted authenticator and expects an unrestricted alternative. Email codes avoid per-text fees and pumping abuse, but they are only as safe as the mailbox. Offer a passkey or authenticator app where you can.
Definition
An email code and an SMS code are both out-of-band secrets: your system sends a short code through a second channel and the user types it back. The channel changes the risks, not the idea.
Comparison
| Factor | Email code | SMS code |
|---|---|---|
| Cost per send | Usually low | Per message charge you pay |
| Pumping abuse | Less exposed to inflated traffic fraud | A known target |
| Account takeover paths | Attacker with mailbox access gets the code | SIM change or number porting can redirect it |
| NIST position | Out-of-band secret; verifier rules apply | Restricted; must offer an unrestricted alternative |
| Reach | Needs internet access | Works on basic phones |
| Delivery delay | Varies by mailbox | Varies by carrier |
| Phishing resistance | Low | Low |
Search guidance on SMS pumping from messaging providers says email codes are generally less susceptible to the large scale network abuse that inflates SMS costs, and authenticator apps are another option. Those sources also sell protection, so verify claims against your own traffic. See what SMS pumping is.
What NIST says about SMS
NIST's digital identity guidance says use of the public telephone network for out-of-band verification is restricted. Verifiers must offer at least one unrestricted alternative and should consider risk indicators such as SIM changes or number porting. For both channels, secrets are invalid unless completed within 10 minutes and accepted once. See how long a code should last.
A decision guide
- Does your audience have reliable email access at sign-in time? If yes, email is a reasonable default for low-risk flows.
- Do you need phone reach for users without smartphones? Keep SMS, with tight limits.
- Is the account high value? Offer passkeys, security keys or an authenticator app, and treat codes as fallback. See which MFA to require.
- Can attackers reach the user's mailbox easily, for example a shared inbox? Avoid email as the only factor.
- Is there any chance of cost abuse? Add send limits and spend alerts either way.
Steps
- Offer at least two channels, including one unrestricted by NIST's definition.
- Rate limit sends and failed attempts per account.
- Do not reveal whether an address or number is registered.
- Alert users when a new factor is added or changed.
- Plan to move high value accounts to phishing resistant methods. See turning off SMS fallback.
Where Safeguard fits
Safeguard's API security scanning helps find verification endpoints without send limits, and its policy gates keep the fix in your release process. The free scan is at https://gold.safeguard.sh/scan.
Quick check
Is email always safer than SMS?
No. It avoids per-text abuse, but a compromised mailbox gives an attacker the code. Strength depends on the mailbox's own protection.
Do I need an alternative to SMS?
NIST guidance says verifiers must offer at least one unrestricted alternative when they use the telephone network for out-of-band verification.
Sources
Last reviewed: 19 October 2026.
