SMS-based authentication verifies a login or transaction by sending a one-time code to a user’s phone number. It is easy to deploy and can add a layer beyond a password, but it relies on the phone number and text message remaining under the user’s control.
In attacks, criminals may steal codes through phishing, SIM swapping, or malware that reads text messages on an infected device. If the same phone is used for banking and receives verification texts, malicious apps with SMS access can undermine this protection. Organizations can reduce risk by restricting sensitive app permissions and offering stronger options, such as authenticator apps or hardware security keys, where practical.