Text Message Codes: Better Than Nothing, but Weaker
Text message codes are the most common form of two-step verification. Why they are better than nothing, how SIM swaps and phishing defeat them, and when to switch to something stronger.
A six-digit code by text message is how most people first meet two-step verification. It is simple and it works on any phone. It also stops a large share of attacks that rely only on a stolen password. But text codes have known weaknesses, and for your most important accounts, there are stronger options.
Why text codes are better than nothing
If a criminal only has your password, perhaps from a data breach, a text code sent to your phone stops them. That blocks most automated account takeover attempts, which is why the US Cybersecurity and Infrastructure Security Agency (CISA) says any form of multi-factor authentication is better than none.
Their weaknesses
| Weakness | How it works |
|---|---|
| Phishing | A fake site or caller asks you for the code, and passes it straight to the real site. See how to verify a caller. |
| SIM swap | A criminal moves your number to their SIM and receives your codes. See SIM swap fraud. |
| Number porting | Your number is moved to another network without permission. See number porting fraud. |
| Phone malware | Malicious apps with permission to read texts can forward codes. |
| Lock screen previews | Codes shown on a locked phone can be read by anyone holding it. |
Stronger alternatives
- Authenticator apps: codes made on your phone, not sent by text. See authenticator app setup.
- In-app approvals from your bank or email provider, if you only approve what you started.
- Passkeys and security keys: resistant to phishing. See what is a passkey.
If you must use text codes
- Never share a code with anyone, for any reason.
- Set a SIM PIN and ask your network about extra account protection. See protecting your phone number.
- Hide message previews on your lock screen.
- Install apps only from the official store and review which apps can read SMS.
- Act fast if your phone suddenly loses signal: it may be a SIM swap.
If you receive a code you did not request, someone may be trying to sign in with your password. Do not share it; change the password for that account.
Got a message asking you to forward a code? Paste it into CyberWatch AI Scan for a free check.
For all the options, see what is two-step verification and our guide on how to protect your accounts.
Frequently asked questions
Should I turn off text message codes?
Only once you have set up something stronger, such as an authenticator app or passkey, and saved backup codes. Text codes are still much better than no second step.
How do criminals get my text codes?
Mainly by tricking you into sharing them, by SIM swap fraud that moves your number to their SIM, or by malware on your phone that reads messages.
Why do banks still use text codes?
They are easy for everyone to use and work on any phone. Many banks also use app-based approvals, which are generally stronger.
Sources
- Multifactor Authentication, US Cybersecurity and Infrastructure Security Agency
- Implementing phishing-resistant MFA (fact sheet), US Cybersecurity and Infrastructure Security Agency
- How To Protect Your Phone From Hackers, US Federal Trade Commission
