SMS Codes
SMS sends a numeric code to a mobile number. It is the weakest second factor here and still far better than none.
Where to find it
Architect Panel → Configuration:
- Site Settings — SMS Time Limit, SMS Code Length and SMS Sender Name
Architect Panel → Activity:
- SMS Log — codes sent, with provider identifiers
Architect Panel → Communication:
- Message Log — the account codes are sent through
The three settings
- SMS Time Limit — how many minutes a code stays valid. Ships at 20.
- SMS Code Length — digits in the code. Ships at 6.
- SMS Sender Name — what the message appears to come from.
Consider shortening the validity window
Twenty minutes is generous. It is forgiving of slow message delivery, which is a real problem — but it also means a code intercepted, glimpsed on a lock screen, or left in a message list stays usable for a long time.
Five to ten minutes is enough for a person who is sitting at the sign-in page, which is the situation the code exists for. Shorten it unless you have evidence that delivery in your user population is genuinely slow.
Six digits is right
With a short validity window, six digits is ample — an attacker gets very few guesses before the code expires. Longer codes are harder to retype from a lock screen and buy little.
Set a recognisable sender name
Users should be able to tell your code from the several others they receive. A recognisable sender also makes fraudulent messages claiming to be you more obviously wrong.
Know the weaknesses
- SIM swap — an attacker persuades the network to move the number. This is the reason not to use SMS for administrators.
- Lock screen previews — codes are readable without unlocking the phone.
- Delivery — not guaranteed, and not instant.
- Cost — every sign-in is a chargeable message.
Where SMS is the right choice
For users who cannot or will not install an app, and for populations where a mobile number is already held and verified. For a public-facing service, SMS enrolment often succeeds where app enrolment does not — and a second factor people actually use beats a better one they abandon.
What it should not be is the second factor on an administrative account.
Watch the log and the volume
The SMS log holds the provider identifiers needed to trace a message somebody says never arrived. It is also where an unexpected bill is explained — 2FA volume scales with sign-ins, which rises quietly.
Worked example
A public service offers app-based 2FA with SMS as an alternative, and about a third of users choose SMS. The validity window is shortened from twenty minutes to eight after checking the log and finding delivery consistently within seconds. Administrators are required to use an app, so no privileged account depends on a phone number.
Recommendations
- Shorten the window to five to ten minutes.
- Never use SMS for administrators.
- Set a recognisable sender name.
- Review SMS volume alongside the log.