Adding an authenticator app or security key to an account usually does not remove the old SMS option. An attacker who can intercept texts or take over your number can still use it. After you enroll a stronger method, go back and delete the phone number as a sign-in factor.
Why the old method stays
Most services treat a new second factor as an addition. CISA's guidance for highly targeted individuals makes the point directly: enrollment in authenticator-based MFA does not automatically unenroll SMS, which can leave a weak fallback that threat actors exploit.
The same document says SMS messages are not encrypted and that SMS is not phishing-resistant. It also notes that authenticator codes are better than SMS but can still be phished. Only FIDO authentication is phishing-resistant.
A safe order of operations
Do this one account at a time, starting with your primary email.
- Add the new factor first. Register a passkey or hardware key, or an authenticator app.
- Test it. Sign out and sign back in with the new method.
- Save recovery codes in your password manager or a printed copy kept at home.
- Remove the phone number from the two step verification settings.
- Check the recovery options. Look for a separate recovery phone or recovery email and decide whether each still makes sense.
- Sign out other sessions if the service offers it.
Do not remove the old method until step 2 has worked. People lock themselves out by doing it in the wrong order.
The recovery flow problem
CISA notes that some online services default to SMS during account recovery, so you may not be able to remove text messages entirely. If an account insists on a phone number for recovery, treat the number as a sensitive asset. Put a PIN on your carrier account and use a number that is not widely known.
Our post on why account recovery is where good authentication fails goes deeper on fallback design.
Which accounts first
Start with the accounts that can reset others:
- Primary email
- Your Apple, Google or Microsoft account
- Mobile carrier account
- Password manager
- Banking and brokerage
- Social accounts that carry your name and reputation
If an attacker owns your email, they can request resets for nearly everything else.
When SMS is still fine
For low value accounts, SMS is better than nothing. The guidance says that for less valuable accounts you can use authenticator codes. The point is not that every account needs a hardware key. It is that the accounts that matter most should not have a weaker door sitting next to a strong one.
Quick check
If I add an authenticator app, is SMS automatically removed?
No. CISA notes that enrolling in authenticator MFA does not unenroll SMS, so you must remove it yourself.
Are authenticator app codes phishing-resistant?
No. They are stronger than SMS, but a fake sign-in page can still capture them. Only FIDO passkeys and security keys resist phishing.
Sources
Last reviewed: 19 October 2026.
