Key takeaways
- SMS codes reach almost everyone and need no app, but they are weaker against SIM swap and real-time phishing.
- Authenticator apps do not depend on the phone network, but need setup and can still be phished.
- Passkeys resist phishing and are quick to use, but not every user or device is ready.
- Offer more than one method and match the strength to the risk of the action.
The three options side by side
| SMS code | Authenticator app | Passkey | |
|---|---|---|---|
| Reach | Almost every mobile phone | Smartphone users who install an app | Modern devices and browsers |
| Setup effort for the user | Very low | Medium | Low to medium |
| Depends on the phone network | Yes | No | No |
| Main weaknesses | SIM swap, interception, real-time phishing, delays | Real-time phishing, lost device | Device loss and recovery, uneven support |
| Cost per sign-in | A message each time | None | None |
Where SMS is the right answer
SMS is hard to beat for reach and low friction. It works for people who will never install an authenticator, for first-time verification of a phone number, and as a recovery or fallback method.
Standards bodies take a careful view of it. For example, NIST guidance treats codes sent over the telephone network as a restricted method, to be used with an understanding of the risk. For many services that is acceptable, for high-value ones it is not enough alone.
Where to prefer something else
- High-value actions such as large payments or changes to security settings
- Privileged or administrator accounts
- Users who travel and often have no reliable mobile coverage
- Services that are frequent targets of SIM-swap fraud
A practical mix
- Offer passkeys or an authenticator app first, with SMS as the universal option
- Use SMS for phone number verification and for recovery
- Raise the requirement for risky actions instead of for every sign-in
- Tell users when their number or security settings change, using a separate channel
- Watch the cost and abuse side of SMS codes, covered in our article on SMS pumping
How ZafeConnect fits
ZafeConnect delivers SMS one-time codes and other A2P messages to 190+ countries, with intelligent routing and fallback and delivery reports from the operators. How you combine SMS with other factors is a decision for your security team.