SMS codes are better than a password alone but weaker than other second factors. NIST classes sending codes over the phone network as a restricted authenticator, and OWASP lists SIM swapping, number porting, SS7 interception and phishing among the risks. Use SMS only when nothing stronger is available.
The specific weaknesses
OWASP lists these for SMS and phone delivered codes:
- SIM swapping and number porting, where an attacker moves the victim's number to a new SIM
- SS7 interception
- phishing, since the user types the code into whatever page asks
- codes previewed on a locked screen
- interception by malicious apps
- receiving the code on the same device that is signing in
Each message also costs money, so an attacker can trigger many messages to run up a bill.
What NIST says
In SP 800-63B-4, PSTN out-of-band use is restricted. Changing a pre-registered phone number counts as binding a new authenticator. Verifiers should consider risk indicators such as a SIM change or number porting, and must make sure alternatives are available to every subscriber. The page also states that out-of-band authentication is not phishing resistant, and that email shall not be used for it.
When SMS is still defensible
- A consumer service where many users have no other option, and any MFA beats none.
- A temporary step while you roll out stronger methods.
- A low-value account where takeover has small impact.
Document the choice and the plan to move away from it.
How to reduce your reliance
- Offer passkeys and TOTP first in the enrollment screen, with SMS shown last.
- Check for number port or SIM change signals before sending a code, where your provider exposes them.
- Rate limit sends per account and per destination to control cost abuse.
- Do not allow SMS as a fallback for staff with stronger methods.
- Tell users to ask their carrier about port-out protection, as OWASP suggests.
- Plan a date to retire SMS for admin and staff roles.
Related reading
Which MFA to require ranks the options, and push fatigue covers the approval-tap problem.
If you must keep SMS for customers, be honest about it in your threat model and in your security page. Say which methods are stronger and encourage their use. Track how many accounts rely on SMS alone, and set a goal to shrink that number. Even a modest push, such as an enrollment prompt after a successful login, tends to move a meaningful share of users to a better method.
Quick check
Is SMS banned by NIST?
No. It is restricted, which means extra conditions apply and alternatives must be offered.
Is email a safe code channel?
NIST says email shall not be used for out-of-band authentication.
Sources
Last reviewed: 19 October 2026.
