Text message codes vs authenticator apps: which MFA is safer?

Concerns & risks

You use text message codes everywhere and see options for authenticator apps and passkeys.

Causes & evidence

CISA's Secure Our World guidance says to turn on multifactor authentication for every account that offers it, because it makes you significantly less likely to be hacked even if a password is stolen. CISA ranks methods: phishing-resistant MFA such as FIDO security keys and passkeys is the most secure; authenticator apps that generate codes or push notifications are next; and SMS text and voice codes are better than nothing but can be intercepted, for example through SIM swapping. Start with your most important accounts, such as email, banking and financial apps, and social media. Save backup codes when you set up MFA so you can get back in if you lose your phone.

Edge cases: some services only offer SMS; keep it on rather than none. Shared family accounts may need a shared authenticator plan. Travelers should check that codes work without cell service.

Turning off MFA because text codes are 'weak' leaves you with a password alone, which is much worse.

What to do

1. Turn on MFA for email first, since it resets other accounts.
2. Switch email and banking to a passkey or authenticator app where offered.
3. Install a reputable authenticator app and scan each account's setup code.
4. Save backup codes somewhere safe, such as a password manager.
5. Add a carrier PIN to reduce SIM swap risk if you still use SMS.
6. Deny any login prompt you didn't start.

Common mistakes:

• Disabling MFA instead of upgrading it
• Losing backup codes
• Approving surprise push prompts
• Leaving email on SMS only

ReportSpeedMan tip: Set up MFA on a new phone before wiping the old one. Authenticator codes don't always transfer automatically.

What I would actually do

I'd switch email and banking to a passkey or authenticator app, save backup codes, and add a carrier PIN.

The trade-off people miss: stronger MFA means more steps when you change phones; plan the move so you don't lock yourself out.

How to tell it worked

Your email and bank use an app or passkey.

Quick FAQ

Is SMS MFA bad?
It's better than nothing.

What's a passkey?
A phishing-resistant sign-in using your device.

What if I lose my phone?
Use backup codes.

Wrap-up: Use MFA everywhere; prefer passkeys or security keys, then authenticator apps, and keep SMS only where nothing better is offered.

Wiki: Multi-Factor Authentication (MFA) and Credit Scores and Credit Reports.

Text message codes vs authenticator apps: read the originals

• CISA: Turn on MFA
• CISA: More than a password