Why is 2FA (2 factor authentication) SMS (phone message) Not Secure (2025)

By Xah Lee. Date: .

SMS Fraud

  • Here's a step-by-step explanation of the SMS fraud method used in the Sergio Moro Telegram hack (based on reports from 2019):
  • 1. Hackers install Telegram on their device but enter the target's phone number during setup.
  • 2. They request the 2FA code via call (voice message) instead of SMS.
  • 3. Using VoIP, they spoof the target's number to call the target, making the line busy so the call goes to voicemail.
  • 4. They access the target's voicemail (often with default passwords like 0000 or 1234).
  • 5. The voicemail system reads out the 2FA code aloud.
  • 6. Hackers use the code to log into and take over the Telegram account.
  • This exploits weak voicemail security in some regions.
2FA SMS hack 2025-11-22 235b0
2FA SMS hack 2025-11-22 235b0

Why is 2FA SMS Not Secure

Why is 2FA SMS Not Secure 2026-07-12 25ac1 ll
Why is 2FA SMS Not Secure 2026-07-12 25ac1 ll

Why is 2FA SMS Not Secure

why is this. “If you use SMS for 2FA, we strongly recommend against SMS as it is prone to fraud and delivery may be unreliable depending on your region.”

SMS-based 2FA (where you get a 6-digit code via text message) is widely discouraged by security experts in 2025 for these main reasons:

  • 1. SIM swapping attacks (the most common and serious threat)
  • Attackers socially-engineer your mobile carrier (or bribe an employee) to port your phone number to a SIM card they control. Once they have your number, every SMS you were supposed to receive now goes to them. They can then reset your Google, Apple, bank, crypto, X/Twitter, etc. accounts even if you have 2FA turned on.
  • High-profile cases:
  • Many Twitter/X account takeovers (including celebrities and crypto influencers) happened via SIM swaps.
  • In 2023–2025 the FTC and FBI repeatedly warned that SIM-swap fraud exploded, with losses in the hundreds of millions of dollars.
  • 2. SS7 network vulnerabilities
  • The global signaling system (SS7) that mobile networks use to route calls and texts is decades old and has known flaws. With access to SS7 (which isn't that hard for sophisticated attackers or state actors), someone can intercept your SMS without ever touching your phone or carrier.
  • 3. SIM cloning/eSIM instant issuance exploits
  • Some carriers make it very easy to issue a new eSIM online. If an attacker has enough of your personal info (which is often leaked in data breaches), they can sometimes convince the carrier to issue an eSIM to them.
  • 4. Delivery problems
  • When you travel internationally, texts can be delayed or blocked.
  • Some carriers throttle or silently drop SMS from short codes (the 5- or 6-digit numbers many services use).
  • You lose access if your phone is offline, stolen, or out of battery — whereas authenticator apps or hardware keys still work.
  • What you should use instead (in order of preference):
  • Hardware security keys (Yubikey, Google Titan, etc.) – practically unphishable
  • Authenticator apps (Google Authenticator, Authy, Microsoft Authenticator, etc.) that use TOTP
  • Passkeys (if the service supports them) – the new passwordless standard
  • As a distant last resort: SMS (only if nothing else is available)

Almost every major tech company (Google, Microsoft, Apple, X/Twitter, etc.) and security organization (NIST, ENISA, CISA) now explicitly says “SMS is not secure 2FA” and recommends against it. That's why you're seeing that warning everywhere in 2025.

password related