An SMS verification code is a short-lived, usually single-use number or string sent to a phone by text message to confirm a login or other account action. It acts as an additional authentication factor, but its security depends on the code reaching the intended subscriber and remaining private.
Attackers may try to obtain a code through phishing, SIM swaps, or abuse of mobile-network signaling that redirects or intercepts SMS delivery. Capturing a code can help bypass account protections, even when the attacker has not compromised the target’s device. Organizations should treat SMS as a weaker factor than passkeys or authenticator-based methods, limit code validity and reuse, and monitor for suspicious sign-ins. Mobile operators can reduce network-level risks with signaling screening and monitoring.