SMS verification: how secure is it still?
SMS codes are the default for verifying phone numbers and for two-factor sign-in, yet the US standards institute NIST only rates them as a restricted option. This guide shows the ways SMS codes get lost, what SMS is still good enough for and when you need something stronger.
- Five ways an SMS code gets lost
- What SMS is still good enough for
- Where reverse OTP helps, and where not
Christian Schätzlein, Founder and developer of Sendity
4 min read
Where an SMS code gets lost
Attacks on SMS codes at a glance
-
Phishing Code typed into a fake page User
Common Affects every code method, not just SMS.
-
SIM-Swap New SIM for your number Carrier
Targeted Talked through the carrier’s support; afterwards every SMS goes to the attacker.
-
Malware An app reads incoming SMS Device
Targeted Mostly Android apps with SMS permission.
-
SS7 Redirected inside the network Network
Rare Needs access to the carriers’ signalling network. Used against German bank accounts in 2017.
-
Pumping Bots trigger expensive SMS Costs
Common No data at risk, but your budget.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Whether SMS is secure enough depends less on the SMS than on what the code protects.
Two different jobs
Verifying a contact shows that a number exists and is in the user’s hands right now. Signing in or recovering an account with a code grants access. A stolen code is annoying in the first case and an account takeover in the second.
The attacks
Phishing is by far the most common: the user types the code into a fake page. SIM swaps and malware are targeted. Interception in the signalling network (SS7) is rare but documented.
What SMS is good enough for
Checking a contact at sign-up, for a newsletter, a giveaway or a callback: an attacker gains little. For account recovery and payments, SMS should not be the only factor.
Where reverse OTP helps
With reverse OTP, the user sends the code shown on your page. No code travels to the user, so nothing can be intercepted on the way, and bots cannot pump messages. The number comes from the sender.
Where it does not
A fake page can show a real code and get the user to send it. A SIM swap can move a WhatsApp account unless two-step verification is on. And the SMS fallback has the weaknesses of SMS, plus senders that can be spoofed on some routes.
Choosing the method by the stakes.
Three questions instead of one rule for everything.
What does the code unlock?
A list entry, an account or money. The more it unlocks, the less SMS alone is enough.
Verifying a contact
SMS, WhatsApp or reverse OTP all work. Reverse OTP adds no costs from bots.
Protecting an account
Offer passkeys, and do not let SMS alone reset a password.
Outgoing SMS code or reverse OTP?
Which attacks each method is exposed to, with WhatsApp as the channel.
| Aspect | Outgoing SMS code | With Sendity |
|---|---|---|
| Interception on the way | Possible via SS7 or malware | No code travels to the user |
| SIM swap | Attacker receives every code | Only without WhatsApp two-step verification |
| Phishing | Code typed into a fake page | A fake page can show a real code |
| Pumping | Every request costs an SMS | Nothing to pump: you send nothing |
What helps with any method.
Three settings that make codes harder to misuse, whichever way they travel.
Short validity
A few minutes and tied to one request, so a stolen code expires quickly.
Limits per number and IP
Few attempts per number and IP address slow down guessing and mass requests.
Recovery with more than SMS
A password reset by SMS code alone turns a SIM swap into an account takeover.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
SMS security: common questions.
Is WhatsApp more secure than SMS?
On the way, yes: messages are encrypted and cannot be read in the mobile network. The account still hangs on the phone number, so two-step verification matters.
Should I drop SMS two-factor sign-in?
SMS as a second factor is better than none. Offer passkeys alongside it and move users over step by step.
What does NIST mean by restricted?
In guideline SP 800-63B, codes via the phone network count as a restricted authenticator: allowed, but services should explain the risk and offer an alternative.
Is the SMS fallback in Sendity insecure?
It is as weak as SMS, and on some routes the sender can be spoofed. That is why you switch it on per campaign, and leave it off where a verification unlocks something valuable.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Verify phone numbers without sending a code.
Try the live demo on your phone. It takes ten seconds.