Turning on two-factor authentication with a text message is better than not turning it on. That sentence is worth starting with, because the rest of this post argues that SMS codes are the weakest second factor in common use, and the wrong conclusion to draw from that is "so do not bother".
The right conclusion is narrower: where a service offers an authenticator app, use it instead of SMS, and do the important accounts first. Here is why, what an app does and does not fix, and how to make the switch without locking yourself out.
Why a text message is a weaker second factor
A code sent by SMS proves that someone could receive messages for your phone number at that moment. That is not the same as proving they hold your phone. The number lives in your mobile carrier's systems, and there are several ways to get messages for it without ever touching the handset.
SIM swapping. An attacker convinces your carrier to move your number onto a SIM card they control, usually by impersonating you, sometimes by paying off an insider. From then on your calls and texts, including every login code, go to them. Your phone just loses signal. The FBI's Internet Crime Complaint Center described exactly this in a February 2022 public service announcement: it received 1,611 SIM swapping complaints in 2021 with adjusted losses of more than $68 million, against 320 complaints and about $12 million across the three years from 2018 to 2020. Those are complaints filed with one agency in one country, so read them as a floor, not a total. Moving your login codes to an app closes this half: it does not close the recovery slot, where a phone number left behind still accepts a code that resets the account. That is route four in can 2FA be bypassed?.
Port-out fraud. The same idea through a different door: the attacker, posing as you, transfers your number to another carrier entirely. In the US, the FCC adopted rules in November 2023 requiring wireless carriers to use secure methods of authenticating a customer before a SIM change or a number port, and to notify customers when one is requested (Federal Register notice). That helps. It also tells you a regulator considered the problem real enough to write rules about.
SS7 interception. SS7 is the decades-old signalling system phone networks use to route calls and messages between each other. CISA's fact sheet on implementing phishing-resistant MFA lists the exploitation of SS7 vulnerabilities to obtain codes sent by SMS or voice as one of the known attacks on MFA. It needs access most criminals do not have, but it needs nothing at all from you.
None of these require your phone, your passcode or your cooperation. That is the core weakness: the second factor lives in somebody else's infrastructure.
What the standards bodies say
NIST's digital identity guidelines are the reference most security policies borrow from. The current revision, SP 800-63B-4, finalised in 2025, classifies out-of-band verification over the phone network, which covers SMS and voice codes, as restricted. A service that still accepts it must offer at least one alternative that is not restricted, give users meaningful notice of the risks, and plan for the day it stops being acceptable. NIST also says verifiers should weigh risk signals such as a SIM change, a device swap or number porting before relying on the phone network at all.
CISA's fact sheet ranks MFA methods from strongest to weakest and puts SMS and voice at the bottom: vulnerable to phishing, SS7 and SIM swap attacks, and to be used only as "a last resort". The same document says plainly that any form of MFA is better than no MFA. Both things are true at once.
Where an authenticator app is better
An authenticator app computes codes on your device from a secret shared once, when you scanned the QR code. Nothing is sent to you at login time, so there is nothing for a carrier to redirect and nothing for a network to intercept. TOTP vs HOTP walks through the mechanism. The short version: a code needs the secret and the current time, and both stay on the device.
In CISA's table, app-based one-time passwords sit above SMS for exactly this reason. For app codes, SS7 and SIM swap attacks "are not applicable". A thief who talks your carrier into a new SIM gets your texts and nothing else.
Where it is not better: phishing
Here is the part that tends to get left out. Both SMS codes and authenticator codes are typed in by a person, and a person can type them into the wrong website.
A phishing page that looks like your bank asks for your password, then asks for the six-digit code, and relays both to the real site within the half-minute the code is valid. It does not matter whether that code arrived by text or came from an app. CISA's fact sheet uses this exact scenario, with an authenticator app as the example. NIST is blunt about it: authenticators that involve manually entering an output, one-time password apps included, "SHALL NOT be considered phishing-resistant".
So moving from SMS to an app closes the phone-network attacks. It does not close phishing. What closes phishing is a credential bound to the real site's domain, which in practice means security keys and passkeys. There are separate posts on passkeys versus authenticator apps and on whether a hardware security key is worth buying, and where each one fits. In the meantime, the habit that protects you is unglamorous: reach login pages from a bookmark or by typing the address, not from a link in a message.
When SMS is still the right answer
- When it is the only option. Plenty of banks and telecoms offer nothing else. Take it. A password plus SMS still stops the large volume of attacks that only have a password from someone else's breach.
- As a fallback you understand. Some people keep SMS on low-stakes accounts because they will genuinely never set up anything else. That is a reasonable trade, made knowingly.
- For people who will not manage an app. A relative who will lose an authenticator but never a phone number may be better protected by SMS than by an app they disable after a month.
The judgement is about what is likely to happen to you, not about which method wins on paper.
How to move an account from SMS to an authenticator app
Go one account at a time. Start with your primary email, because it is the recovery route for most of the others, then your password manager, then anything financial.
- Sign in on a device you trust and open the account's security or two-factor settings.
- Choose to add an authenticator app. The service shows a QR code and usually a "can't scan it?" text key.
- Scan the QR with your authenticator, or paste the key. Enter the code it shows to confirm.
- Save the recovery codes the service gives you, somewhere that is not the phone.
- Only then remove SMS as a two-factor method, if the service lets you.
- Check the account's recovery settings separately. Many services keep a phone number for password resets even after SMS codes are switched off, and a recovery path through SMS is still a path through SMS. Remove it where you can, and ask your carrier about a PIN or port-out lock on your mobile account.
Sign out and back in once with the new code before you delete anything. And treat the QR like a password: anyone who scans it can generate your codes indefinitely, so delete any screenshot of it afterwards.
The new risk you just took on
An SMS code survives a lost phone: you get a replacement SIM with the same number and carry on. An authenticator code does not, unless the secret exists somewhere other than the phone you lost. Moving off SMS trades a carrier you do not control for a backup you do.
That trade is worth making, but make it on purpose. Keep the recovery codes, and either turn on encrypted sync or keep an encrypted backup file. Lost your phone? covers both cases, with and without a backup.
Takeaway
- SMS 2FA is better than no 2FA, and worse than an authenticator app, because the code travels through a phone network an attacker can redirect.
- An authenticator app takes SIM swapping, port-out fraud and SS7 off the table. It does not stop phishing; passkeys and security keys do that.
- Move your email, password manager and financial accounts first, keep recovery codes off the phone, and take the phone number out of account recovery where you can.
Where KeyNesta fits
KeyNesta is an authenticator app, so it solves the part of this an app can solve: codes are generated on your device, it never asks for your phone number, and it works with the network off. It also covers the step people skip after leaving SMS. An encrypted backup file needs no account at all, and optional sync is end-to-end encrypted, so we cannot read your codes. Web app today; iPhone and Android at launch. The web app at app.keynesta.com needs no sign-up, and the features page lists what is built and what is not.