SMS verification: what it is and if it's secure
SMS verification sends you a one-time code to your phone, as a text message. It's the most widespread second factor because any phone can receive it, and the most fragile because it depends entirely on your SIM.
- What it is
- A code by text message
- Since
- Restricted by NIST in 2017
- Verdict
- Yes, but…
What it is
SMS verification is a type of two-step verification that uses your phone number as the second factor: after your password, the service sends you a short code by text message that you have to type in to log in.
It doesn't require installing anything: it works on any phone with a line, even a very basic one. That simplicity is its strength, and also the root of its problem: the code doesn't reach you, it reaches your number.
Since when
There's no official birth date for SMS as a second factor: banks and online services adopted it gradually as mobile phones became widespread. What does have a date is its fall from grace: NIST, the US agency that sets digital identity standards, classified SMS as a "restricted authenticator" in its 2017 guidelines (SP 800-63-3), because of the risk of interception and SIM swapping. Its 2025 revision (SP 800-63B-4) kept and formalized that same restriction.
Why it's used
It's used because it's universal: no app needed, no compatible device, no installation know-how required. Any carrier delivers it.
The flip side is that very dependency: the code goes to your number, not to you. If someone manages to duplicate your SIM, they receive your codes instead. And if you simply change numbers or lose your phone without the SIM on hand, you're left without the route that was supposed to let you in.
Do we use it?
Yes, but only if there's no other option, and never as the only route for your email. For accounts that genuinely matter, SMS should be the last resort, not the only one.
Check this
- Does your email or your bank depend only on SMS as a second factor?
- Would you know how to request a SIM duplicate if you lost it?
- Do you have any important account where SMS is the only option available?
Official source: NIST SP 800-63B-4, Digital Identity Guidelines