Cybersecurity
The MFA Level-Up: Why SMS Codes Are No Longer Enough (and What to Use Instead)
For years, enabling multi-factor authentication (MFA) has been a cornerstone of account security. MFA remains essential, but the threat landscape has changed: SMS codes can be intercepted, SIM-swapped, or phished. It is time to adopt phishing-resistant MFA, starting with your most privileged accounts.
For years, enabling Multi-Factor Authentication (MFA) has been a cornerstone of account and device security. While MFA remains essential, the threat landscape has evolved, making some older methods less effective.
The most common form of MFA, four- or six-digit codes sent via SMS, is convenient and familiar, and it's certainly better than relying on passwords alone. However, SMS is an outdated technology, and cybercriminals have developed reliable ways to bypass it. For organizations handling sensitive data, SMS-based MFA is no longer sufficient.
SMS was never intended to serve as a secure authentication channel. Its reliance on cellular networks exposes it to security flaws, particularly in telecommunication protocols such as Signaling System No. 7 (SS7). Attackers can exploit SS7 vulnerabilities to intercept text messages without touching your phone. Techniques such as eavesdropping, message redirection, and message injection can be carried out within the carrier network or during over-the-air transmission.
SMS codes are also vulnerable to phishing. If a user enters their username, password, and SMS code on a fake login page, attackers can capture all three in real time and immediately gain access to the legitimate account.
Understanding SIM Swapping Attacks
One of the most dangerous threats to SMS-based security is the SIM swap. In SIM swapping attacks, a criminal contacts your mobile carrier pretending to be you and claims to have lost their phone, then requests the number be ported to a new blank SIM card in their possession. If they succeed, your phone goes offline, allowing them to receive all calls and SMS messages, including MFA codes for banking and email. Without knowing your password, they can quickly reset credentials and gain full access to your accounts.
This attack doesn't depend on advanced hacking skills. It exploits social engineering tactics against mobile carrier support staff, making it a low-tech method with high-impact consequences.
Why Phishing-Resistant MFA Is the New Gold Standard
To prevent these attacks, the best approach is to stop depending on a user's ability to spot a fake page, by using phishing-resistant MFA. This approach relies on cryptographic protocols that tie each login to the real website's domain.
The FIDO2 open standard uses passkeys created using public key cryptography linking a specific device to a domain. Even if a user is tricked into clicking a phishing link, the browser and authenticator will not use the passkey on the fake site, because its domain does not match the one the passkey was created for. The technology is also passwordless, removing the threat of phishing attacks that capture credentials and one-time passwords.
Implementing Hardware Security Keys
Hardware security keys are physical devices resembling a USB drive that can be plugged into a computer or tapped against a mobile device. To log in, you simply insert the key and the key performs a cryptographic handshake with the service. There are no codes to type, and attackers can't steal your key over the internet.
Mobile Authentication Apps and Push Notifications
If physical keys are not feasible, mobile authenticator apps such as Microsoft or Google Authenticator are a step up from SMS MFA. These apps generate codes or approve sign-ins on the device itself, which removes the risk of SIM swapping and SMS interception. Modern authenticator apps also address "MFA fatigue" with "number matching," which requires the user to type a number shown on the sign-in screen into the app. That stops an attacker from simply spamming approval requests until someone taps Approve, because the person approving has to be looking at the sign-in screen. It does not make these methods phishing-resistant, though. A one-time code from an app, or a number-matched push approval, can still be relayed in real time by an adversary-in-the-middle phishing page, because the user is looking at the attacker's copy of the sign-in screen. App-based MFA is a solid baseline, not the top tier.
Passkeys: The Future of Authentication
Modern systems are embracing passkeys: digital credentials stored on a device and protected by biometrics such as fingerprint or Face ID. Passkeys are phishing-resistant and can be synchronized across your ecosystem, such as iCloud Keychain or Google Password Manager. They offer phishing resistance similar to a hardware key with the convenience of a device you already carry, with no passwords to store, reset, or manage. Synced passkeys are only as secure as the cloud account that stores them, so protect that account well, and use device-bound passkeys or hardware keys where a higher level of assurance is required.
Balancing Security With User Experience
Moving away from SMS-based MFA requires a cultural shift. Explain the reasoning behind the change, highlighting the realities of SIM-swapping attacks and the value of the protected information. While a phased rollout can help ease the transition for the general user base, phishing-resistant MFA should be mandatory for privileged accounts. Administrators and executives must not rely on SMS-based MFA.
Upgrading your authentication methods offers one of the highest returns on investment in cybersecurity. The cost of hardware keys or management software is minimal compared to the expense of incident response and data recovery. Cyber One Solutions helps businesses deploy modern authentication that keeps data safe without frustrating the team. Reach out, and we'll help you implement a secure and user-friendly authentication strategy.