While NIST designates SMS as a restricted authentication channel due to SIM swapping, SMS remains critical for consumer onboarding reach.
Security researchers frequently debate the merits of SMS 2FA versus Authenticator apps (Google Authenticator, 1Password) and FIDO2 Passkeys. While TOTP and Passkeys offer superior protection against phishing and SIM swaps, SMS remains essential for zero-friction consumer authentication.
1 The NIST SP 800-63B Authentication Standard
NIST classifies Out-of-Band (OOB) SMS authentication as 'Restricted' due to three specific attack vectors:
1. SIM Swapping: Social engineering cellular retail staff to port a victim's phone number to an attacker's SIM.
2. SS7 Interception: Exploiting legacy signaling vulnerabilities in international telephony routing switches.
3. Android Malware / Notification Mirroring: Malicious mobile applications requesting SMS read permissions.
2 Conversion vs Security Strategy
Recommendation for modern software engineering teams:
- Low-Risk Consumer Onboarding: Use SMS OTP for instant account creation and password recovery.
- Sensitive Actions & High-Value Accounts: Require TOTP, WebAuthn, or biometric Passkeys for financial transactions, API key generation, and administrative password resets.
Frequently Asked Questions • OTP & 2FA Engineering
Absolutely. SMS 2FA successfully blocks over 96% of bulk phishing attacks and 100% of automated credential stuffing attacks according to Google security research.