2FA Authenticator vs SMS vs Security Key: How Each One Fails
SMS codes can be redirected, app codes phished, and security keys check the site. How each kind of 2FA fails, what CISA and NIST say, and a 5-step check.
Video coming soon.
Key takeaways
- Text message codes can be redirected by a SIM swap. CISA says SMS and voice MFA should only be used as a last resort.
- Authenticator app codes avoid SIM swaps, but NIST says one-time codes are not phishing-resistant.
- Security keys and passkeys use FIDO standards and only work on the site they were registered with, which makes them phishing-resistant.
- Your real lock is the weakest method you leave switched on, including text-code backups and the 2FA on your email.
- Keep a backup: a second security key or printed backup codes, stored offline.
Two-factor authentication (2FA) by text message fails when someone moves your phone number to their SIM card; authenticator app codes fail when a fake website tricks you into typing the code; and security keys or passkeys resist both because they only work on the real site, though they fail you if you lose them without a backup. That makes the order, from weakest to strongest, SMS, then app, then key or passkey.
The stakes are real. In a public service announcement dated February 8, 2022, the FBI’s Internet Crime Complaint Center (IC3) said it received 1,611 SIM swapping complaints in 2021, with adjusted losses of more than $68 million. From January 2018 to December 2020, it had counted 320 complaints and about $12 million. If your crypto sits on an exchange, your login is the front door to it.
How does SMS two-factor authentication fail?
SMS two-factor authentication fails when an attacker takes over your phone number. The FBI describes SIM swapping as a technique where criminals “target mobile carriers to gain access to victims’ bank accounts, virtual currency accounts, and other sensitive information.” Once your number is on their SIM, the site sends your one-time code to them.
The US Cybersecurity and Infrastructure Security Agency (CISA) rates SMS and voice codes as “vulnerable to phishing, SS7, and SIM swap attacks.” SS7 is the old signalling system phone networks use to pass calls and texts between carriers. CISA says this form of MFA “should only be used as a last resort.”
The US National Institute of Standards and Technology (NIST) says in its digital identity guidelines that using the phone network for these codes “is restricted.” It tells services to weigh warning signs such as a SIM change or number porting. The FBI lists a warning sign for users too: “Be aware of any changes in SMS-based connectivity,” such as your phone suddenly losing service.
Coinbase’s help center lists text messages among its 2-step options and recommends stronger methods.
How do authenticator app codes fail?
Authenticator app codes fail when you are tricked into typing one on a fake site. An app such as Google Authenticator generates time-based codes on your phone, so a SIM swap doesn’t hand them over. That is a real step up from text messages.
But CISA marks app-based one-time codes as “vulnerable to phishing attacks.” A fake login page asks for your six-digit code, and the attacker passes it to the real site within seconds. NIST says the same thing in one line: “OTP authentication is not phishing-resistant.” OTP means one-time passcode.
Tap-to-approve push notifications have their own trick. CISA warns that attackers can “bombard a user with push notifications until they press the ‘Accept’ button.” And if the phone holding your codes is lost and the app wasn’t backed up, you can lock yourself out.
How do security keys and passkeys work?
Security keys and passkeys work by proving who you are with a private key that never leaves your device and only answers the real site. CISA says “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication,” and calls phishing-resistant MFA “the gold standard.”
The FIDO Alliance describes a passkey as “an authentication credential based on FIDO standards” that “uses public-private key cryptography.” The website keeps a public key. Your phone, computer or a small USB or NFC security key keeps the private key. You unlock it with a fingerprint, face scan, PIN or a tap.
The phishing protection comes from site binding. According to the FIDO Alliance, “a passkey is only presented to the site it was registered with,” and “there is no way for the user to inadvertently type it on an attacker’s site.” A look-alike page gets nothing.
How do the three 2FA methods compare?
| Method | Stops SIM swap? | Stops fake-site phishing? | Main way it fails | What CISA says |
|---|---|---|---|---|
| SMS or voice code | No | No | Number moved to attacker’s SIM; code typed on fake site | Last resort |
| Authenticator app code | Yes | No | Code typed on a fake site; lost phone without backup | Vulnerable to phishing |
| Push approval (no number matching) | Yes | No | Repeated prompts until you tap Accept | Vulnerable to push bombing |
| Security key or passkey (FIDO) | Yes | Yes | Lost device with no backup; weak cloud account for synced passkeys | Phishing-resistant, “gold standard” |
What does your 2FA choice mean for your crypto?
Your account is only as strong as the weakest sign-in method you leave switched on. If you add a security key but keep text codes as a fallback, the text code can still be the way in.
Your email matters just as much, because exchange password resets land there. If your email still relies on a text code, an attacker can step around your exchange’s stronger lock through the inbox. Our XRP security checklist for larger holders covers the other layers, from custody to seed phrase storage.
What about 2FA backups and synced passkeys?
Every strong 2FA setup needs a backup, because keys get lost and phones break. The simplest backup is a second registered security key. Sites that offer backup codes give you a short list of one-time codes for when your main method is gone.
Store backup codes offline, on paper, somewhere safe. NIST notes that these “look-up secrets are not phishing-resistant,” so treat any request to read one out as a red flag. Our guide to storing a seed phrase uses the same offline principles.
Passkeys come in two kinds. The FIDO Alliance says synced passkeys are copied across your devices through a cloud credential manager, while device-bound passkeys, including those on security keys, never leave one device. A synced passkey is only as safe as the cloud account it syncs through, so lock that account down too.
Is text-message 2FA ever the right choice?
Text-message 2FA is better than no second factor at all. CISA says “any form of MFA is better than no MFA.” Some sites don’t support security keys or passkeys yet, and on those an authenticator app may be the strongest option available. Treat text codes as a floor, not a finish line.
Your five-step 2FA check
- List the accounts that guard your crypto: each exchange, your email, your password manager and your mobile carrier account.
- Note which 2FA method each one uses, including backup or recovery options where a text code can hide.
- Move up where the site allows it: a security key or passkey first, an authenticator app next. Buy any security key new from the maker or a store you trust.
- Switch text codes off once a stronger method is working, if the site lets you.
- Set up a backup: a second key or printed backup codes, kept offline.
Start with your email and the exchange that holds the largest share of your crypto. Menus differ by site and change over time, so look for the security or 2-step verification section in each account’s settings.
What to check next
Check every few months whether each exchange you use supports passkeys or security keys yet. And if your phone ever loses service without explanation, contact your carrier promptly, because that is the warning sign the FBI lists for a SIM swap. If an account has already been taken over, our guide on what to do when crypto is stolen covers the first hour.
Sources
Frequently asked questions
Is SMS two-factor authentication safe for a crypto exchange?
It is better than no second factor, but it is the weakest common option. CISA says SMS and voice codes are vulnerable to phishing, SS7 and SIM swap attacks and should only be used as a last resort.
Is an authenticator app better than SMS?
Yes, against SIM swaps, because the code is made on your phone rather than sent to your number. But NIST says one-time-code authentication is not phishing-resistant, so a fake site can still trick you into typing it.
Why are security keys and passkeys safer than codes?
They use FIDO public-key cryptography, and the FIDO Alliance says a passkey is only presented to the site it was registered with. A look-alike site gets nothing to steal.
What happens if I lose my security key?
You need a backup in place before that happens, such as a second registered key or the site's printed backup codes. Store the backup offline, away from your main key.
Where should I keep 2FA backup codes?
On paper or another offline medium, somewhere safe. Avoid email, cloud notes and phone screenshots, and never read a backup code to someone who contacts you.
Education and commentary only, not financial advice. Crypto is volatile and you can lose money. Do your own research and speak to a qualified advisor before making investment decisions. Figures are as of October 14, 2026 and may have changed since.
