A few months ago, I was reading a headline about Google replacing SMS codes with QR-based authentication for Gmail. No more six-digit texts—just tap, scan, and you’re in. At first, it felt like a UX upgrade. But the more I dug in, the clearer it got: this is a security shift. One that’s long overdue.
That same week, I helped a client untangle a breach. They had MFA turned on. But it was text-based. And that attacker? They didn’t guess a password. They just intercepted the code.
So if you’re still relying on SMS to protect sensitive accounts—especially anything tied to finance, operations, or communications—this is your signal. Because in 2025, SMS MFA security risks aren’t theoretical anymore. They’re routine.
What’s the Problem with SMS?
Let’s start here: SMS messages aren’t encrypted. Anyone who gains control of your phone number—through SIM swapping, malware, or telecom fraud—can read them. That’s not speculation anymore. It’s policy.
The FBI and CISA now explicitly advise against using SMS for MFA, citing its vulnerability to interception and lack of phishing resistance.
And it’s not just policy folks making noise. In early 2025, Google announced it’s ditching SMS codes for Gmail, replacing them with QR-based login methods to curb fraud and traffic pumping scams. Microsoft followed suit, tightening its own guidance and mandating phishing-resistant MFA for admin accounts.
The message is clear: SMS was a stopgap. It’s not security.
So What Should You Use Instead?
1. Use phishing-resistant MFA.
1. Use phishing-resistant MFA.
3. Know the limits of your tools.
4. Train the humans.
Passkeys vs SMS: Not Even a Fair Fight
Passkeys—biometric logins that don’t rely on passwords or codes—are now supported by Apple, Google, and Microsoft. They’re simple to use, nearly impossible to phish, and already built into most devices.
They don’t require texts. They don’t break when you travel. They just work.
And when the alternative is SMS, there’s no contest.
Where We Go From Here
You don’t need to rip out your whole system. But if you’re still using SMS-based MFA—especially for accounts tied to wire transfers, cloud storage, or private communications—it’s time to start phasing it out.
At Decypher, we help clients map authentication across their entire ecosystem: remote work, mobile access, executive devices, family offices, and third-party apps. Quietly. Thoroughly. Without drama.
If you’re not sure what’s still exposed—or whether your MFA actually works—we’ll take a look. One login at a time.
Reach out here to schedule a private consultation.
