thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Foundational

SMS-Based Authentication

Sending one-time codes by text message as a second factor; convenient but weak.

Definition

SMS codes are vulnerable to SIM swapping, SS7 interception, malware on phones, and real-time phishing. NIST SP 800-63B treats SMS (PSTN) authenticators as restricted, requiring agencies to offer alternatives and assess risk. It is still better than password-only authentication.

Example

An attacker who convinces a carrier to port the victim's number receives their SMS login codes.

Exam tip

SMS is the weakest common MFA method; SIM swapping is the classic attack.

Related terms