Most services offer both SMS and authenticator app 2FA. They're not equally secure. Here's a clear breakdown of the differences so you can make the right choice.
In This Guide
How Each Method Works
SMS 2FA
The service sends a one-time code to your phone number via text message. You enter the code to complete login. The code lives on the phone network and travels through SMS infrastructure.
Authenticator App (TOTP)
An app on your phone generates a 6-digit code every 30 seconds using a shared secret key and the current time. The code never leaves your device. You enter it to complete login.
Why SMS 2FA Is Vulnerable
SIM Swapping
An attacker calls your mobile carrier, impersonates you, and convinces them to transfer your phone number to a new SIM. Once they control your number, they receive all your SMS 2FA codes. This attack has been used to steal millions from crypto accounts.
SS7 Protocol Attacks
The SS7 protocol — the backbone of the global phone network — has known vulnerabilities that allow sophisticated attackers to intercept SMS messages in transit. This is a known attack vector used by intelligence agencies and advanced threat actors.
Phishing
Fake login pages can prompt you to enter your SMS code in real-time, forwarding it to the attacker who simultaneously logs in with your credentials.
Why Authenticator Apps Are More Secure
- Offline generation: Codes are generated on your device — no network required, nothing to intercept
- Not tied to your phone number: SIM swapping doesn't affect TOTP codes
- Short expiry: Codes expire in 30 seconds, making replay attacks impractical
- No SS7 vulnerability: The phone network is not involved at all
Verdict
Use an authenticator app whenever the option is available. SMS 2FA is significantly better than no 2FA at all, but it has real vulnerabilities that authenticator apps completely avoid.
The only scenario where SMS might be preferable is if you frequently lose access to your phone and need carrier-based recovery — but in that case, make sure your phone number is on a carrier with strong identity verification for SIM changes.
Why Services Still Offer SMS 2FA
SMS remains the default second factor for good business reasons: it works on any phone, requires no app installation, and keeps support costs down when users lose their devices. For a service onboarding billions of non-technical users, SMS is the lowest-friction option that still blocks automated attacks. Google and Apple have shifted their defaults toward app-based and passkey methods, but SMS survives as a fallback for account recovery, which is why it is often the only option for resetting a locked account.
This shapes your threat model: if a service defaults to SMS, switching to an authenticator app usually takes about a minute inside the security settings and is worth doing — you keep the convenience of SMS recovery without relying on it as the primary factor. Where a service allows multiple methods, the strongest arrangement is an authenticator app as the main factor with SMS kept only as a backup.
When Authenticator Apps Are Not Enough
TOTP apps defeat SIM swapping and mass interception, but a real-time phishing page can still capture a code and replay it within the 30-second window. For the accounts that matter most — email with far-reaching permissions, administrative access, cryptocurrency — hardware security keys add domain-bound verification that no code-based method provides, because the key refuses to authenticate with anything other than the real site. Push-based MFA with number matching (as used by Microsoft and Google) sits between the two in both security and convenience.
Also consider how the app itself can fail: if your phone is lost and your authenticator app has no backup, every account tied to it becomes temporarily unreachable. Pair the app with backup codes and cloud sync, or the theoretical security advantage disappears exactly when you need it. Whichever method you choose, the difference between SMS and an app is far smaller than the difference between any 2FA and none.
Step-by-Step: Switching an Account From SMS to an Authenticator App
Most services make the swap in under two minutes, and you can keep SMS as a fallback while the app becomes your primary factor. The general flow: open the account's security or password settings, find the two-factor authentication section, select "authenticator app" (sometimes labelled "authentication app" or "TOTP"), and scan the QR code shown on screen with your authenticator app. Type the six-digit code the app displays into the confirmation field, and the service activates the app as a sign-in method — at that point, sign out and back in to confirm the new flow works before you change anything else.
Where the service lets you remove SMS entirely, decide based on how you recover a lost phone: if you have backup codes or a recovery email, removing SMS reduces your exposure to SIM-swap attacks; if SMS is the only recovery path the service offers, leave it enabled as a fallback but keep the app as the factor you actually use day to day. Check after the switch that the account no longer shows SMS as the default method, since some services leave both enabled and prefer the most recently added one anyway.
If You Are Stuck With SMS: How to Harden It
Some services — usually smaller ones — still offer only SMS, and some carriers make SIM swapping easier than it should be. You can close most of that gap at the carrier level: enable a port-out PIN or transfer lock on your mobile account (the major US and European carriers offer some form of this), attach a separate PIN to your account, and log in to your carrier's app with its own two-factor authentication so an attacker cannot phone in a change. Confirm with your carrier that customer support cannot move your number without the PIN or in-person ID, and periodically check your account for unrecognised devices.
Then apply the risk ranking: use SMS-only accounts for low-value logins, and avoid them entirely for anything financial, cryptocurrency, or work-related, where an intercepted code can turn into lost money before you notice. If a financial service forces SMS, keep your number on the plan you use most and never share the one-time codes — a support agent who asks for "the code we just texted you" is the classic social-engineering pattern behind account takeovers.
SMS Codes Not Arriving: What to Check
When the expected text simply does not arrive, the usual causes are mundane. First check your phone's spam or blocked folders — both Google Messages and many manufacturer apps filter short codes aggressively, and carriers sometimes label 2FA senders as promotional. Confirm the number on the account is the one in your hand: an old number left on file is the single most common reason codes vanish. If you are roaming, short-code delivery can be delayed or blocked entirely, and some carriers filter codes when the sender number is not in your contacts.
If everything looks correct, check for carrier-level filtering of short codes, request the code again after the service's resend cooldown (usually 30–60 seconds), and try switching from Wi-Fi to mobile data or vice versa, since delivery problems occasionally track the network path. As a last resort, most services let you switch to a call-back option — a voice message reading the code — which uses a different delivery path and often succeeds when SMS fails.