Stop sending SMS codes: SIM swaps, SS7 and what CISA now says

SMS codes were the first two-factor most people ever used, and for many products they are still the default. The evidence against them has stopped being a matter of opinion: the US government’s cyber agency now says not to use them, SIM-swap fraud has exploded, and the phone network itself can be abused to locate and intercept.

What CISA now says

In December 2024, CISA’s mobile communications guidance put it bluntly: “Do not use SMS as a second factor for authentication. SMS messages are not encrypted.” It also warns that leaving SMS enrolled as a backup is a weak, exploitable fallback — an attacker simply chooses the weakest factor you still accept. CISA guidance (PDF)

SIM swaps are up more than tenfold

A SIM swap moves a victim’s phone number to a SIM the attacker holds — usually by talking a mobile carrier’s staff into it. Every SMS code then goes to the attacker. The UK fraud prevention service Cifas recorded a 1,055% rise in unauthorised SIM swaps in 2024, from 289 cases to nearly 3,000. Cifas

The highest-profile case was the US Securities and Exchange Commission’s X account, taken over in January 2024 after a SIM swap on the phone number linked to it; the man responsible pleaded guilty in February 2025. US Department of Justice

The network underneath is not private either

SS7, the decades-old signalling protocol that lets carriers route calls and texts between each other, has long been abused to track phones and intercept messages. In July 2025, researchers at Enea reported a surveillance vendor using a new technique to slip SS7 requests past carrier firewalls to locate phones. TechCrunch

What to use instead

An authenticator app removes the phone number from the picture. A TOTP code is generated on the device from a secret that never travels over the phone network; a push approval goes to one enrolled handset, not to whichever SIM holds your number today. A SIM swap gains the attacker nothing.

• TOTP is the universal baseline: free, offline, supported by every authenticator app. You can add it to your product without any per-check cost — how TOTP works and verifying codes in your backend.
• Push with number matching removes the typing and resists MFA-fatigue attacks — why number matching matters.
• Passkeys or security keys are the only phishing-resistant option and belong on your most valuable accounts.

The catch with authenticator apps: where the secrets live

Moving off SMS creates a new question — what happens when the phone is lost? Some apps answer it by syncing every secret to a cloud account. That turns the cloud account into a master key: in 2023, Retool attributed part of its breach to Google Authenticator’s cloud sync, which meant one phished Google account exposed the 2FA codes too. BleepingComputer And in July 2024, Twilio confirmed that an unauthenticated endpoint let attackers check which phone numbers had Authy accounts; a group claimed 33 million numbers. SecurityWeek

U2 Secured Authenticator’s backup is zero-knowledge: secrets are encrypted with a key derived on the device before they leave it, so our servers hold ciphertext we cannot read. An account lives on one phone at a time; restoring onto a new one wipes the old handset and tells its owner.

Moving your users off SMS

1. Offer an authenticator app (TOTP) and push to every user, and make them the default for new sign-ups.
2. Prompt existing SMS users to enrol in an app at their next sign-in.
3. Remove SMS as a recovery method for admin and finance accounts first, then for everyone.
4. Replace SMS recovery with one-time backup codes, shown once at enrolment.