← Glossary · Calling, messaging & Wi-Fi
2FA via SMS
Two-factor authentication via SMS — a one-time code texted to your phone — is the most common (and least secure) form of 2FA. Vulnerable to SIM swap fraud. Use authenticator apps or hardware keys for high-value accounts instead.
2FA stands for two-factor authentication: something you know (password) plus something you have (a code from your phone). SMS 2FA is the version where the "something you have" is a one-time code texted to your phone number. It's the most widely-supported form of 2FA — almost every account in the US offers it — and the least secure version available.
Why SMS 2FA matters in cell-plan choices
If your phone number is the lever for accessing your bank, email, brokerage, crypto wallet, work accounts, etc., the security of your phone number itself becomes a critical asset. A SIM swap (where an attacker convinces your carrier to move your number to their device) gives them all your SMS 2FA codes. From there they reset passwords on accounts that allow SMS-based recovery and break in.
Most major US carriers offer SIM-swap protection (Account Takeover Protection at T-Mobile, Number Lock at Verizon, etc.). Enabling these blocks port-outs and SIM transfers without an extra PIN. Set the lock and the PIN. It's the single biggest defense for SMS 2FA users.
Better alternatives
- Authenticator apps: Authy, Google Authenticator, 1Password, Microsoft Authenticator. Codes generated on your device locally; no SMS leg, no SIM-swap risk. Use these for email, bank, brokerage.
- Hardware security keys: YubiKey, Google Titan, OnlyKey. Physical USB or NFC device. Most secure form of 2FA available; required for some high-security accounts (Google's Advanced Protection program).
- Passkeys: the post-password successor. Biometric-tied keys stored on your device, syncing via iCloud Keychain or Google Password Manager. Many major sites now support passkeys; phasing out passwords entirely.
When SMS 2FA is OK
SMS 2FA is fine for accounts where the worst-case loss is small (random newsletter sign-ups, throwaway forum accounts) or for accounts that don't support better options. For everything financially or professionally important, move to an authenticator app or passkey. The carrier-protection lock is a good defense-in-depth even when you're not relying on SMS 2FA.