Is SMS two-factor allowed under NIST SP 800-63B? Restricted explained

Yes, but with conditions. NIST SP 800-63B treats SMS and other PSTN based out of band verification as a RESTRICTED authenticator. It is allowed, but a service that offers it must also offer an alternative, warn users of the risk, and plan for the day the method is no longer acceptable.

What the text says

SP 800-63B covers authentication and lifecycle management. Section 5.1.3.3 states that using the public switched telephone network for out of band verification is restricted. The SMS or voice call travels over a mobile network, so a SIM based device can only be reached that way.

The same section adds practical requirements:

• The verifier must confirm that the pre-registered phone number is associated with a specific physical device.
• Changing the pre-registered number counts as binding a new authenticator, and has to follow the post-enrolment binding process in Section 6.1.2.
• Verifiers should consider risk indicators such as a device swap, a SIM change, number porting or other abnormal behaviour before sending a secret over the PSTN.
• NIST may change the restricted status over time as the threat landscape and PSTN operation evolve.

Section 5.1.3.1 adds that methods which do not prove possession of a specific device, such as VoIP or email, must not be used for out of band authentication.

What RESTRICTED requires

Section 5.2.10 covers restricted authenticators. The organisation using one must assess, understand and accept the risks, and acknowledge they will likely increase over time. The credential service provider must:

1. Offer at least one alternate, non-restricted authenticator that can meet the required assurance level.
2. Give subscribers meaningful notice of the security risks and of the alternatives.
3. Address the added subscriber risk in its risk assessment.
4. Create a migration plan in case the restricted authenticator becomes unacceptable later.

What that means for product teams

If you offer SMS codes, the standard expects more than a text box. It expects a second option that users can pick, a plain explanation of why SMS is weaker, and a written plan to move away from it.

It also expects you to watch for signals that a number has changed hands recently. A SIM change followed by a login attempt deserves more scrutiny than a login from a number registered for two years. Your phone carrier may or may not expose such signals, so check what you can get before promising anything.

What it does not say

The text does not ban SMS. It also does not claim that every SMS code is easy to steal. It says the method carries added risk that is likely to grow, and it asks you to manage that openly.

A short decision rule

• Offering SMS as the only second factor: expect to be questioned in a review.
• Offering SMS next to a stronger option, with notice and a migration plan: this matches the structure the standard describes.
• Requiring SMS for administrators: reconsider.

This is an interpretation of the document, so confirm against the full text and your own assurance level before relying on it.

Quick check

Sources

• NIST SP 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management

Last reviewed: 19 October 2026.