SMS codes can be intercepted in real time.
Short answer
SMS two-factor authentication is better than nothing, but it is not secure against a determined attacker. SS7 vulnerabilities allow real-time interception of SMS messages without ever touching your device, and SIM swapping reaches the same outcome through carrier-side social engineering. For accounts where access would cause serious harm, SMS codes are not an acceptable second factor.
How SS7 interception works
SS7 is the protocol that mobile networks use to coordinate between carriers globally, handling call routing, SMS delivery, and roaming. It was designed in 1975 with no authentication between network nodes. Any node that can connect to the SS7 network can send routing commands, and those commands are trusted by default.
An attacker with SS7 access can send a routing update that redirects SMS messages destined for your number to a number they control. Your phone shows no signal disruption while the redirected messages arrive at the attacker’s device, and the attack remains passive enough to leave no trace on your handset or in your carrier’s standard logs.
SS7 access is not available to random individuals. It is available to telecom operators, to state intelligence agencies that have legal or extralegal access to telecom infrastructure, and to criminal groups that have either purchased access from corrupt insiders or set up fraudulent carrier operations. The barrier is lower than most people assume. Documented cases have involved journalists, politicians, and activists in multiple countries.
SIM swapping: the lower-tech version
SIM swapping requires no technical infrastructure. An attacker calls your carrier, impersonates you, and asks to transfer your number to a SIM card they control. When the transfer completes, all calls and SMS messages to your number go to the attacker. Your phone shows no signal because your number is no longer on your SIM.
The information needed to impersonate you at a carrier is typically your name, address, and the last four digits of your Social Security number or account PIN. This information is available from data brokers, from previous breaches, or from social engineering. The personal information data brokers hold on you is often sufficient to pass a carrier’s identity verification.
Documented SIM swap attacks have targeted cryptocurrency holders, journalists, and executives. Because the operation requires only a phone call to a customer service line, it scales without much additional effort per target. Carriers have improved their verification processes in response to publicised cases, but the fundamental vulnerability remains: customer service representatives are a social engineering target.
What to use instead
Hardware security keys are the strongest second factor available for consumer use. A YubiKey or similar FIDO2 key requires physical possession of the device to authenticate. There is no intercept path. The authentication happens locally. An attacker who does not have the physical key cannot authenticate regardless of what else they have compromised.
Authenticator apps generate time-based codes that are computed locally on your device without any network transmission. Google Authenticator, Aegis on Android, and Raivo on iOS all work without a data connection. The codes are not transmitted until you enter them, at which point they expire in 30 seconds. An SS7 attack cannot intercept a code that was never sent over the SMS network. A SIM swap attack cannot redirect an app-generated code because it never goes through your phone number.
The practical migration: identify every account that currently uses SMS 2FA and where a breach would cause serious harm. Email accounts, password manager accounts, financial accounts. Switch these to an authenticator app or hardware key. The process takes an afternoon. The improvement in resilience is significant. A threat model that identifies your highest-value accounts tells you where to prioritise the migration.
When SMS 2FA is still acceptable
For accounts with low sensitivity and no connection to your primary identity or finances, SMS 2FA is fine. The attack is not trivial enough to be applied indiscriminately. It requires motivation specific to you or to your accounts. For a loyalty program login, the risk does not justify the operational overhead of avoiding SMS.
The threshold question is: what is the consequence of losing access to or control of this account? When the consequence is significant, use a stronger second factor; when it is closer to minor inconvenience, SMS 2FA remains a reasonable tradeoff.
Frequently asked questions
Can I protect myself against SS7 attacks?
Not directly, because the vulnerability is in the network infrastructure rather than your device. The protection is to move away from SMS as an authentication channel for sensitive accounts. SS7 itself is not something a user can fix; the practical move is to stop depending on it for authentication that matters.
Does my carrier offer protection against SIM swapping?
Most major carriers offer optional SIM swap protection, typically a PIN or passcode required before any SIM transfer. Enable this on your account. It does not eliminate the risk, because social engineering can sometimes bypass it, but it substantially raises the barrier. For T-Mobile this is called “Account Takeover Protection.” AT&T and Verizon have equivalent features.
If I switch to an authenticator app, what happens if I lose my phone?
Authenticator apps generate codes locally on the device, so a lost phone means losing access to those codes unless you have already exported the seeds or set up a backup. The standard practice is to store the recovery codes that every service provides at setup in an offline location, separate from the device itself, and to enable the authenticator app’s encrypted backup feature where one exists. Authy, Aegis, and 1Password’s TOTP support all offer some form of cross-device sync. The trade-off between sync convenience and offline-only security depends on what you are protecting and from whom.
Are passkeys safer than SMS codes for everyday accounts?
Yes, materially. Passkeys are bound to a device and a domain, which means they cannot be intercepted over SS7, redirected via SIM swap, or phished onto a fake login page. The cryptographic exchange happens between your device and the legitimate service, with no shared secret traversing the mobile network. Adoption is now broad enough that most major consumer services support passkeys as an alternative to passwords, and where the option exists it is the strongest available second factor short of a hardware security key.
There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.
