The MFA Level-Up: Why SMS Codes Are No Longer Enough (and What to Use Instead)

Multi-Factor Authentication is still non-negotiable.
But how you do MFA now matters just as much as whether you do it at all.

For years, four- or six-digit codes sent by text message were the default. They are familiar, easy to roll out, and better than passwords alone. The problem is that attackers have adapted. SMS-based MFA is now one of the most commonly bypassed controls we see in real incidents.

If your organisation handles sensitive data such as customer records, financial information, health data, or privileged admin access, SMS is no longer enough.

Why SMS MFA falls short

Text messages were never designed to protect logins. They rely on ageing telecoms infrastructure and assumptions that no longer hold up.

Attackers do not need malware on your phone. They do not need to break into your device. They go after the systems around it.

Common attack methods include:

• Intercepting messages inside mobile carrier networks

• Redirecting or injecting texts during transmission

• Phishing users in real time and capturing passwords and one-time codes together

Once a code is typed into a fake login page, access is usually immediate.

Understanding SIM swap attacks

One of the most damaging threats to SMS-based MFA is the SIM swap.

An attacker contacts your mobile provider, pretends to be you, and reports a lost phone. If support staff are convinced to move your number to a new SIM, your phone goes offline and the attacker’s comes online.

From that point on, they receive:

• MFA codes

• Password reset messages

• Calls meant for you

This does not require advanced technical skill. It relies on social engineering, pressure and gaps in verification processes. The impact can be full account takeover within minutes.

Why phishing-resistant MFA is now the baseline

Most modern attacks focus on tricking people rather than breaking technology. The strongest defence is to remove that weakness from the login process.

Phishing-resistant MFA uses cryptography that ties authentication to:

• A specific device

• A specific service or website

Even if someone clicks a malicious link, the login attempt fails because the request does not match the legitimate service.

This is why phishing-resistant MFA is increasingly expected by insurers, auditors, and regulators.

Hardware security keys: The strongest option

Hardware security keys are one of the most effective ways to achieve phishing-resistant MFA.

They are small physical devices, usually USB or NFC, that perform a cryptographic check during login. There are no codes to type and nothing to approve.

To authenticate, the key must be:

• Physically present

• Inserted or tapped

• Used on the correct site

An attacker cannot steal it remotely or trick a user into handing it over. Without the key, access is blocked.

For admin accounts, senior leadership, and high-risk systems, this is the strongest option available.

Authenticator apps: A practical step up

Where hardware keys are not suitable for everyone, modern authenticator apps are a clear improvement on SMS.

These apps generate codes directly on the device. Nothing is sent over the mobile network, removing the risk of SIM swapping or message interception.

Basic push notifications do carry risk. Attackers may send repeated login requests until someone approves one out of frustration or confusion.

Better setups now use number matching, where the user confirms a number shown on their screen. This helps ensure the person approving the login is actually trying to sign in.

Passkeys: Where authentication Is heading

Passkeys are becoming more common for a reason.

They replace passwords with cryptographic credentials stored on a device and protected by biometrics or a local PIN. They cannot be phished and are tied to the legitimate service.

For users, sign-in is simpler.
For IT teams, there are fewer resets, fewer lockouts, and less time spent dealing with compromised credentials.

They are not suitable for every system yet, but the direction of travel is clear.

Security only works if people use it

Moving away from SMS MFA is not just a technical change. It is a behavioural one.

People trust text messages because they have used them for years. Adoption improves when the reason for change is explained clearly, using real examples rather than scare tactics.

A phased rollout helps for most users. For admin and executive accounts, phishing-resistant MFA should be mandatory.

Ease of use matters. Protecting access to critical systems matters more.

The cost of standing still

Legacy MFA can meet a basic requirement while still leaving accounts exposed.

When access is compromised, the impact is rarely limited to IT. There is downtime, reputational damage, insurance scrutiny, and difficult conversations with customers and regulators.

Compared to that, the cost of modern authentication, including hardware keys where they matter most, is small.

If you are ready to move beyond passwords and text codes, we help organisations deploy authentication that stands up to real attacks without making life harder for staff.

No gimmicks. No unnecessary friction. Just controls that do what they are meant to do