When a website offers you two-factor authentication, it usually offers two flavors: "we'll text you a code" or "scan this QR code with an authenticator app." They look similar in use - Six digits, type them in, done - Which makes it easy to assume they're equally safe. They are not. The difference comes down to one question: what, exactly, is being authenticated?
An SMS code proves you control a phone number. A TOTP code proves you hold a secret key stored on your device. Phone numbers, it turns out, are surprisingly easy to steal.
How each method actually works
SMS one-time passwords are simple: the server generates a code, hands it to an SMS gateway, and the mobile network delivers it to whatever device currently answers to your number. Security depends entirely on the telephone network and your carrier's diligence.
TOTP - Time-based one-time password, standardized in RFC 6238 - Works offline. During setup, the site shares a secret key (that QR code is just the key plus a label). Your app runs the secret and the current time through HMAC, truncates the result to six digits, and rotates it every 30 seconds. The server, holding the same secret, does the same math and compares. Nothing is transmitted at login time except the code you type. You can watch this computation happen live in our browser-based TOTP code generator - Feed it any Base32 secret and it produces exactly the codes an authenticator app would.
The security consequence: to defeat TOTP remotely, an attacker must steal the secret or phish a live code within its 30-second window. To defeat SMS, they only need to reroute your text messages - And there's a whole criminal industry built on doing exactly that.
SIM swapping: stealing your number with a phone call
A SIM-swap attack needs no malware and no contact with the victim. The attacker calls your carrier (or bribes a retail employee - Documented cases involved insiders paid a few hundred dollars per swap), impersonates you with scraps of leaked personal data, and asks to move your number to a new SIM. The moment the port completes, your phone drops to "No Service" and every one of your SMS 2FA codes lands in the attacker's hands.
This is not theoretical. The FBI's IC3 logged over $68 million in reported SIM-swap losses in 2021 alone, a huge jump from prior years, and cryptocurrency holders remain favorite targets because the theft is irreversible. Even Twitter's then-CEO Jack Dorsey had his own account hijacked via SIM swap in 2019. In 2024, the SEC's X account was compromised the same way, moving markets with a fake Bitcoin-ETF post.
You can reduce the risk by setting a carrier account PIN - Pick a random one with our PIN generator rather than a birthday - But you're still trusting every employee at every store your carrier operates.
SS7: the phone network's forty-year-old trust problem
Beneath SIM swapping lies a deeper flaw. SS7, the signaling protocol interconnecting the world's phone carriers, was designed in an era when every network on it was trusted. An entity with SS7 access - Purchasable through gray-market providers - Can silently redirect calls and texts for a target number from anywhere on earth.
This, too, has been exploited in the wild: in 2017, criminals used SS7 access to intercept mTAN banking codes and drain accounts of O2 customers in Germany, the first publicly confirmed bank theft via SS7. Politicians and researchers have repeatedly demonstrated live interception on national television. Nothing you do on your handset can prevent it, because the interception happens inside the network.
If your second factor travels through the telephone network, its security is capped by the telephone network's - And that network was built on trust, not cryptography.
What NIST says
The U.S. National Institute of Standards and Technology settled this debate years ago. Since the 2017 publication of SP 800-63B, its digital identity guidelines have classified out-of-band verification via the public switched telephone network - SMS and voice calls - As a restricted authenticator. Agencies using it must assess the risk, offer alternatives, and prepare to migrate away. NIST's reasoning cites exactly the risks above: device swap, SIM change, number porting, and network vulnerabilities.
No equivalent restriction applies to TOTP apps, push authenticators, or FIDO2 hardware. When the body that literally writes the standards flags one method and not the other, that's about as clear as guidance gets.
Head to head
| Factor | SMS codes | TOTP app |
|---|---|---|
| Works without cell signal | No | Yes - Fully offline |
| Vulnerable to SIM swapping | Yes | No |
| Vulnerable to SS7 interception | Yes | No |
| Phishable in real time | Yes | Yes |
| NIST SP 800-63B status | Restricted | Permitted |
| Depends on a third party at login | Carrier + SMS gateway | No one |
| Survives changing phone number | No | Yes |
| Cost to attacker | Low (social engineering) | High (device or secret compromise) |
Note the one row where they tie: real-time phishing. A fake login page that instantly relays your code to the real site defeats both, because both are codes a human can be tricked into typing. Only FIDO2 hardware keys and passkeys eliminate that class of attack - Our guide to passkeys and the passwordless future explains how.
When SMS still makes sense
Honesty requires nuance: SMS 2FA still blocks the overwhelming majority of real-world account takeovers, because most attacks are bulk credential stuffing with no per-victim effort - The kind of attack described in our piece on how one reused password sinks every account. Microsoft's telemetry has long shown that any MFA stops well over 99% of automated attacks.
So the practical ranking is:
- Passkey or hardware key, where supported
- TOTP authenticator app
- Push approval
- SMS - But only if nothing better exists
Store your TOTP secrets somewhere with an encrypted backup so a lost phone doesn't lock you out - A tool like our Password Wallet keeps recovery material encrypted client-side, and our full two-factor authentication setup guide walks through backup codes and multi-device enrollment step by step.
Migrating from SMS to TOTP in ten minutes
For each important account - Email first, then finance, then everything else:
- Open security settings and choose "Authenticator app" as a new 2FA method.
- Scan the QR code; confirm with the current six-digit code.
- Save the backup codes offline.
- Delete the phone-number-based method.
- While you're there, check whether the account's password has appeared in a breach - If the service warns you, or you have any doubt, follow our post-breach checklist.
The whole migration for a typical person's critical accounts takes one coffee's worth of time and removes your phone number as a single point of failure.
FAQ
Can someone SIM-swap me if I have a carrier PIN?
A PIN raises the bar substantially but isn't absolute - Insider-assisted swaps have bypassed carrier PINs, and social engineers sometimes talk representatives into "resetting" them. Treat the PIN as a mitigation for a method you're phasing out, not as a reason to keep relying on SMS for your most valuable accounts.
Is TOTP unphishable?
No. A convincing fake login page can ask for your code and relay it to the real site within the 30-second window; phishing kits automate this. TOTP eliminates network-level interception and SIM swapping, which is most of the risk, but only FIDO2/WebAuthn credentials are cryptographically bound to the genuine domain and therefore truly phishing-resistant.
What happens to my TOTP codes if I change phone numbers?
Nothing - And that's the point. TOTP has no relationship with your phone number. The secret lives in your app, so a new number, a new carrier, or airplane mode in a foreign country all leave your codes working. SMS 2FA, by contrast, breaks the day you change numbers and forget to update a site.
Why do banks still use SMS codes?
Inertia, universal device compatibility, and support-cost math: every customer can receive a text, while a fraction would struggle with authenticator apps. Regulators are slowly forcing improvement, and many banks now offer in-app approval as an alternative. Where yours does, switch - Banking is precisely where SIM-swap criminals aim.
Are voice-call codes any better than SMS?
No - They're the same restricted category in NIST's guidance, delivered over the same interceptable network, to the same stealable phone number. Every SS7 and SIM-swap attack that defeats a text also defeats a robocall. Treat voice OTP exactly as you treat SMS: better than nothing, worse than everything else.