2FA and passkeys: why SMS codes are being replaced for good
For years the standard second factor was a 6-digit code via SMS. That approach is now actively discouraged by every security authority. Here is what replaced it and why you should migrate.
Two-factor authentication was supposed to make account takeovers impossible. For a decade the de-facto standard was SMS: enter your password, get a 6-digit code on your phone, type it back. That system is now actively discouraged by the US NIST, the UK NCSC, and every serious security team.
Why SMS 2FA fails
Three attack vectors. SIM-swap: the attacker convinces your mobile carrier to port your number to a SIM they control, then triggers your bank's SMS code and intercepts it. SS7 interception: the global phone-routing protocol has known holes that let a sufficiently motivated attacker read SMS without your carrier's cooperation. Phishing: the attacker proxies the real login page, asks for your 2FA code, and submits it to the bank within seconds — your SMS 2FA just authenticated the attacker.
What replaced it
Authenticator apps (Google Authenticator, Microsoft Authenticator, 1Password): a 6-digit code generated on your device, no SMS network involved. Resists SIM-swap and SS7 interception but still vulnerable to real-time phishing.
Hardware security keys (YubiKey, Google Titan): a physical USB or NFC device that cryptographically signs a login challenge. The signature is bound to the exact domain, so a phished login page cannot replay it. Essentially unphishable.
Passkeys (WebAuthn + biometrics): your phone or laptop generates a cryptographic key pair, stores the private key in secure hardware, and signs logins with your biometric unlock. Same unphishable property as hardware keys, far better UX. Rolling out across every major platform through 2024 and 2025.
What to do now
If your bank still only offers SMS 2FA, migrate to authenticator app at minimum. If passkeys are available, use them. Keep SMS as a backup only, not as your primary second factor. On every account that holds money or crypto, assume SMS will eventually be bypassed and plan accordingly.