SMS 2FA texts a one-time code to the user's mobile. It's universally supported (no app install required), but it's the weakest 2FA method due to SIM-swap attacks. Use it as a fallback rather than a default.
Settings to Configure
- Code length: 6 digits is standard.
- Code lifetime: 5–10 minutes recommended. Shorter is safer, longer is more user-friendly.
- Maximum attempts per code: 3 wrong tries before the code is invalidated.
- Resend cooldown: Prevent attackers triggering hundreds of SMS to drive up the user's bill.
- Block VoIP numbers: Reject codes sent to known VoIP ranges (Twilio, Google Voice) — these are easier to spoof.
Worked Configurations
- Consumer app: 6 digits, 10-min lifetime, 3 attempts, 60s resend cooldown, VoIP allowed.
- Financial app: 6 digits, 5-min lifetime, 3 attempts, 120s cooldown, VoIP blocked.
- Internal staff: SMS available as backup only — TOTP is the primary; SMS unavailable on first 2FA prompt to avoid drift to the weaker option.
SIM-Swap Mitigations
SMS 2FA can be defeated by an attacker who convinces the user's carrier to port their number. Mitigations:
- Make SMS the second-preference method, not the only one.
- Require re-enrolment if the carrier reports a recent SIM change (some gateways expose this).
- Alert the user by email when the registered SMS number changes.
Tip: SMS 2FA is great for a customer signup flow because it's familiar. Steer users toward TOTP or passkeys once they're set up.