America’s cybersecurity agency advises against a login step many people rely on every day - Make Tech Easier

For millions of people, the extra layer of security on their bank, email, and shopping accounts is a text message containing a six-digit code. However, the Cybersecurity and Infrastructure Security Agency, the federal agency that leads US civilian cyber defense, has told some Americans to stop using it.

The agency issued guidance in December 2024 stating that "SMS MFA is not phishing-resistant; therefore it is not strong authentication for accounts of highly targeted individuals." This warning specifically targets people in senior government or political positions.

Why CISA said it

The guidance came after a hacking campaign known as Salt Typhoon, which is an operation by hackers aligned with the Chinese government that gained access to US telecom networks. Reports of the breach surfaced in the fall of 2024, and access to that infrastructure gave attackers the ability to intercept unencrypted communication.

If someone can read your texts, they can read your login codes too. CISA’s Mobile Communications Best Practice Guidance was written specifically for "highly targeted" people, who the agency defines as those "in senior government or senior political positions and likely to possess information of interest to these threat actors." Alongside the SMS warning, it urged them to use end-to-end encrypted messaging apps, such as Signal, for their communications.

The weaknesses go beyond one hack

CISA’s concerns about text message codes are older than Salt Typhoon. In an October 2022 fact sheet on phishing-resistant MFA, the agency ranked the common forms of multi-factor authentication from strongest to weakest. SMS and voice codes were at the bottom, described as "vulnerable to phishing, SS7, and SIM swap attacks."

In plain terms, those are three different ways to steal a code: phishing is the simplest, where a fake login page asks for your password and then asks for the code you just received; SIM swapping means persuading your mobile carrier to move your phone number to a SIM card the attacker controls; and SS7 refers to weaknesses in the decades-old system phone networks use to route calls and texts between carriers, which can, in some cases, let attackers intercept messages without touching your phone at all.

The 2022 fact sheet said SMS codes "should only be used as a last resort MFA option," though it can "serve as a temporary solution" while moving to something stronger.

What CISA recommends instead

The agency’s strongest option is what it calls phishing-resistant authentication. In the 2022 fact sheet, CISA states that "the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication." For most people, that means passkeys, which are now supported by Apple, Google and Microsoft, or a physical security key that plugs into a laptop or taps against a phone.

Both work by checking that you’re on the genuine website, so a fake login page can’t capture anything useful. Authenticator apps, which generate codes on your phone rather than receiving them by text, sit in the middle. They avoid SIM swaps and phone network interception, though a convincing phishing page can still trick you into typing in a code.

A password plus a text message code is still harder to break into than a password alone, so CISA’s own fact sheet treats SMS as weak, not worthless. The better move is to upgrade where you can, starting with the accounts that would hurt most to lose: your main email account, since it could probably reset everything else, then banking and your phone carrier account. Check each one’s security settings for passkeys, a security key or an authenticator app. Once a stronger method is set up, some services let you remove your phone number as a backup.