Why SMS codes are the weakest kind of two-factor
Two-factor authentication (2FA) stops most account takeovers. The type you choose still matters.
In a SIM swap, a criminal convinces your mobile provider to move your number to their SIM. Every code sent by SMS then goes to them, including your bank and email resets.
What to use instead
- An authenticator app (codes generated on your phone).
- A passkey or hardware security key where the service supports it.
- Keep SMS only as a last resort for accounts that offer nothing else.
Trap: if your phone suddenly loses signal for no reason, contact your provider immediately and check your email and bank accounts.