Short answer: An authenticator app is safer than SMS 2FA. Text codes travel through the phone network, which means an attacker can steal them by hijacking your phone number — no access to your device required. Authenticator apps generate codes offline on hardware you physically hold. That said, SMS 2FA still blocks the overwhelming majority of automated attacks, so if SMS is your only option, keep it on.
How each method actually works
SMS 2FA asks a service to send a code to your phone number. The code is generated on the company’s servers, handed to a telecom carrier, routed through the mobile network, and delivered to whatever device currently answers to that number.
An authenticator app stores a secret key on your device at setup time. Every 30 seconds it combines that key with the current clock to produce a six-digit code. Nothing is transmitted. Nothing leaves your phone. The code is computed locally and verified locally by the server, which holds the same key.
That architectural difference — transmitted versus computed — is the entire security story. If you want the mechanics in more depth, see our explainer on what two-factor authentication is and how it works.
The three ways SMS 2FA gets broken
1. SIM swapping
An attacker contacts your mobile carrier, impersonates you using information scraped from data breaches and social media, and convinces a support agent to port your number to a SIM card they control. Your phone loses signal. Their phone starts receiving your texts — including every 2FA code.
This is not theoretical. It is the standard playbook for high-value crypto and email account takeovers, and the FCC has issued consumer rules requiring carriers to verify identity before porting numbers, precisely because it happens so often.
2. Real-time phishing proxies
A fake login page relays your credentials to the real site as you type. The real site sends a genuine SMS code to your genuine phone. You type it into the fake page. The attacker forwards it and is now logged in. The code was valid — it was just typed into the wrong window.
Worth noting: this attack also defeats authenticator apps. TOTP codes are phishable in exactly the same way. Only passkeys and hardware security keys are structurally immune, because they cryptographically bind the login to the correct domain.
3. Network and carrier-level interception
The signalling protocols that route text messages between carriers were designed decades ago with little authentication. Interception at this level is rare and requires resources most attackers do not have — but it is a real category of risk that simply does not exist for offline code generation.
Where authenticator apps are weaker
They are not strictly better on every axis, and it is worth being honest about the trade-offs:
- Losing your phone is worse. With SMS, you get a new SIM and your codes follow you. With an authenticator app, your secrets are gone unless you backed them up. This is the single most common reason people get locked out.
- Setup takes longer. You have to install an app and scan a QR code for each account.
- Clock drift can break codes. If your phone’s time is significantly off, codes will be rejected until you re-sync it.
- They are still phishable. An app protects the channel, not your judgement.
The lockout risk is solvable. Save the backup codes each service offers at setup, and store them offline. Our guide on recovering accounts after losing a phone walks through what to do if you skipped that step.
The security ranking, worst to best
- Password only — one leaked breach away from compromise
- SMS 2FA — stops credential stuffing and password reuse attacks; vulnerable to SIM swaps
- Email 2FA — roughly comparable to SMS, and worse if your email password is reused
- Authenticator app (TOTP) — offline, no phone number involved, resistant to SIM swaps
- Push notification with number matching — TOTP-level security with better usability
- Passkey or hardware security key — phishing-resistant by design; the current gold standard
Every step up this list is a real improvement. The jump from nothing to SMS is the biggest one you will ever make — do not let “SMS isn’t perfect” talk you out of enabling it somewhere that offers nothing else.
What to actually do
Switch these to an authenticator app today: your primary email, your password manager, cryptocurrency exchanges, your domain registrar, and any account that can reset the password on other accounts. These are the accounts an attacker wants most.
Leave SMS enabled where it is the only option: most banks, government portals, and older services still offer nothing else. SMS there is better than nothing there.
Remove SMS as a fallback where you can. This is the step people miss. If you add an authenticator app but leave SMS active as a recovery method, an attacker can still SIM swap you and use the weaker path. Your security is set by your weakest enabled method, not your strongest.
Call your carrier and add a port-out PIN. Every major carrier offers one. It is a five-minute phone call and it is the single most effective defence against SIM swapping.
Ready to move? Our comparison of authenticator apps covers the options, and we have a step-by-step walkthrough for setting up 2FA on Binance if crypto is your priority.
Frequently asked questions
Is SMS 2FA better than nothing?
Yes, substantially. SMS 2FA defeats credential stuffing, password reuse, and every automated bulk attack — which together account for the large majority of account takeovers. It fails only against a targeted attacker willing to hijack your phone number.
Can someone intercept my SMS 2FA code without my phone?
Yes. Through SIM swapping, an attacker transfers your phone number to their own SIM card and receives your texts directly. Your physical phone stays in your pocket and simply stops receiving service.
Do authenticator apps work without internet?
Yes. TOTP codes are calculated from a locally stored secret and your device’s clock, so they work in airplane mode or with no signal. SMS codes require cellular service to arrive.
Should I remove SMS 2FA after adding an authenticator app?
Where the service allows it, yes — but only after you have confirmed your authenticator works and have saved your backup codes offline. Leaving SMS active as a recovery option preserves the SIM-swap attack path.
Are passkeys better than authenticator apps?
For phishing resistance, yes. Passkeys are cryptographically bound to a specific website, so a fake login page cannot use them. Authenticator apps still rely on you not typing a code into the wrong site.
The bottom line
SMS 2FA is a lock that can be picked by anyone who convinces your carrier they are you. An authenticator app is a lock whose key never leaves your pocket. For any account that matters, make the switch — and then close the back door by removing SMS as a fallback.
One Response