Crypto▼ Bearish
SMS 2FA: The Weakest Two-Factor Authentication for Crypto
SMS codes are the most common 2FA method but also the weakest. SIM swapping is in decline; the real threat is real-time phishing. Passkeys offer proper protection.
Continue with
Most crypto exchange accounts use SMS-based two-factor authentication. A July 2025 update to the US National Institute of Standards and Technology guideline SP 800-63B-4 keeps the method in a single category labelled "restricted". No other login method carries that classification, the NIST document shows.
The common explanation for why SMS is weak cites SIM swapping – an attacker persuades a mobile carrier to port a phone number to a new SIM. The attack is real but declining. The FBI's IC3 logged 2,026 SIM-swap complaints with $72.7 million in losses in 2022. By 2025 the count fell to 971 complaints and $17.4 million in losses, according to the bureau's annual reports.
The bigger problem is real-time phishing. An attacker places a fake login page that looks exactly like the exchange. The victim types in a password and the six-digit code from SMS or an authenticator app. The fake page passes both straight to the real exchange in the same second. The code was valid, just not at the intended address.
Germany's Federal Office for Information Security, the BSI, puts it plainly in its assessment of 2FA methods: email and SMS TAN procedures as well as TOTP offer no protection against a real-time proxy. The attacker relays the second factor without ever needing to decrypt or intercept it.
A TOTP app such as Aegis or Ente Auth generates the code on the device itself from a shared secret and the current time. The code never enters a third-party channel. That stops SIM swapping cold. But the BSI notes that TOTP still falls to the same relay attack.