Lesson 3 of 9 · about 15 minutes
Two-Factor Authentication and SIM-Swap Protection
You'll be able to
- Rank SMS codes, authenticator apps, push prompts, passkeys and hardware keys by how well they resist attack
- Explain how a SIM swap works and why it defeats text-message codes
- Turn on carrier protections such as Verizon Number Lock or AT&T Wireless Account Lock
- Save backup codes and register a spare key so two-factor does not lock you out
A password alone is one lock. Two-factor authentication adds a second one, so a stolen password is not enough. But second locks vary a lot. Some stop nearly everything. One of them, the text-message code, can be taken by anyone who sweet-talks a clerk at your phone company.
The ranking
The federal Cybersecurity and Infrastructure Security Agency ranks the methods in its fact sheet on phishing-resistant MFA. It calls phishing-resistant MFA, which in practice means FIDO-based methods for most people, the "gold standard" and says SMS or voice MFA "should only be used as a last resort." Here is that ranking, adapted for a writer's accounts.
| Rank | Method | Phishing | SIM swap | Main weakness | Use it for |
|---|---|---|---|---|---|
| 1 (best) | Hardware security key (FIDO2) or device-bound passkey | Resists | Immune | Losing the key without a spare | Email, password manager, registrar, Apple or Google account |
| 2 | Synced passkey | Resists | Immune | Depends on the security of the account it syncs through | Most accounts that offer it |
| 3 | Authenticator app (six-digit code) | Can be relayed by a live fake page | Immune | You can be tricked into typing the code | Accounts with no key or passkey option |
| 4 | Push prompt with number matching | Partial | Immune | Approving a prompt you did not start | Fine when that is what the service offers |
| 5 | Push prompt without number matching | Weak | Immune | Push bombing | Better than nothing |
| 6 (worst) | SMS text or voice call code | Weak | Vulnerable | SIM swap, phishing, phone network flaws | Only when nothing else exists |
NIST agrees. Its 2025 guidance labels phone-network codes "restricted" and requires services that use them to offer an alternative (SP 800-63B-4). Even so, an SMS code beats no second factor at all. If text codes are the only thing a site offers, turn them on, then protect the phone number itself.
How a SIM swap works
Your phone number lives with your carrier, not in your phone. A SIM swap criminal calls the carrier or walks into a store pretending to be you, with your name, address and maybe the last four of your Social Security number pulled from a data breach. They say they lost their phone and need the number on a new SIM. If the rep goes along, your phone goes dead and theirs starts getting your texts. Then they click "forgot password" on your email, receive the reset code, and they are in.
Some swaps involve bribed store employees, which is why carrier locks that apply to everyone, staff included, are worth having.
Example: what a SIM swap looks like from your side
Marcus, a freelancer in the invented city of Orrin Bay, is writing about a road bond. At 9:40 on a Saturday night his phone shows "SOS only." He restarts it. Still nothing. He assumes a tower is down and goes to bed.
By morning his email password has been changed, his recovery email swapped, and a message sent to his newsletter list asking readers to "support independent journalism" through a crypto wallet. The whole chain ran through text-message resets.
The warning sign was the sudden loss of service with no outage. If your phone drops to no service and stays there while others nearby have signal, call your carrier from another phone right away and ask whether a SIM change or port-out happened.
Lock your number at the carrier
The big three carriers now offer free locks you can turn on in their apps or websites, as of October 2026:
| Carrier | Feature | What it blocks |
|---|---|---|
| Verizon | Number Lock and SIM Protection | Number Lock blocks transfer to another carrier. SIM Protection blocks moving the number to another device. Turn SIM Protection off before upgrading phones, then back on. |
| AT&T | Wireless Account Lock | Moving the number to a new SIM or carrier, plus changes to billing, authorized users and the number. Rolled out to all customers in 2025, and applies to AT&T staff too. |
| T-Mobile | Port validation PIN; NOPORT on request | A 6 to 15 digit PIN is needed to port out. NOPORT, requested by the primary account holder, requires an in-store visit with photo ID to port or get a new SIM. |
Smaller carriers and prepaid brands vary. Call and ask: Is there a port-out PIN? Is there a SIM lock? Can you add a note that changes require an in-person visit with ID? Also set an account PIN that is not your birthday or the last four of anything.
Federal rules are moving too. In November 2023 the FCC adopted rules requiring wireless carriers to use secure methods to verify customers before SIM changes and port-outs and to notify customers when those happen (Federal Register). The compliance date was pushed back in July 2024 pending a Paperwork Reduction Act review. This course could not confirm from an FCC page whether that review has finished as of October 2026, so do not count on the rules. Turn on the locks yourself.
Common mix-ups
- Claim: "Two-factor is two-factor; any kind is fine." What the evidence shows: CISA ranks methods because they fail differently. SMS falls to SIM swaps. App codes fall to live phishing pages. Only FIDO methods resist both.
- Claim: "Security keys are for big companies." What the evidence shows: A basic FIDO key costs $29 at Yubico as of October 2026, and Google's Advanced Protection Program, built for people at higher risk of targeted attacks, requires a passkey or security key.
- Claim: "If I lose my second factor, the company will just let me back in." What the evidence shows: Strong accounts are built to say no to people who cannot prove who they are. That includes you. Backup codes and a spare key are your proof.
Setting it up without locking yourself out
Example: the cost of doing it right
Dana from lesson 1 picks six accounts for her strongest protection: email, password manager, Apple account, domain registrar, web host and bank. She buys two Yubico Security Key NFC keys at $29 each: 2 x $29 = $58. Each key can be registered on all six accounts, so the cost per account is $58 / 6, under $10. Where an account does not accept keys, she uses a free authenticator app. She keeps one key on her key ring and the other in a drawer at her sister's house.
For every account she also downloads the backup codes. Most sites give 8 to 10 single-use codes. She prints them, writes the account name on each sheet, and keeps them with the spare key.
- Start with your email account. Add a security key or passkey first, then an authenticator app as a second method.
- Register the spare key on the same day. People who plan to do it later end up locked out.
- Save backup codes on paper, not in the account they protect.
- Remove SMS as a sign-in or recovery method once two stronger methods are working, where the site allows.
- Repeat for the password manager, carrier, Apple or Google account, registrar and bank.
Authenticator app codes come from a shared secret stored on your phone. If you switch phones, move the codes before wiping the old one. Most apps have an export or transfer option. Check yours today, while both phones still work.
Checklist
- Email, password manager and Apple or Google account use a key or passkey
- A spare key is registered and stored away from the first
- Backup codes printed for each key account
- SMS removed as a fallback where possible
- Carrier port-out PIN and SIM lock turned on
- You know what "no service with no outage" might mean
Try it
Log in to your carrier's app or website and find its number lock or port-out PIN setting. Turn it on and write down how you did it. Then open your email account's security page and list every sign-in and recovery method it currently has. Rank them using the table above. Add one method from rank 1 to 3 and, if you now have two strong methods, remove text-message recovery. Note which of your other accounts still rely on SMS and put them on next week's list.
Check yourself
1. According to CISA's fact sheet, which two-factor method should be used only as a last resort?
CISA says SMS and voice MFA should only be used as a last resort because of phishing, SS7 weaknesses and SIM swaps.
2. What does a SIM swap attacker actually take over?
The thief talks or bribes the carrier into moving your number. Your texts and calls, including login codes, then go to their phone.
3. What does Verizon's SIM Protection setting do while it is on?
Verizon says SIM Protection blocks moving your number to another device, and Number Lock blocks transfers to another carrier.
4. Why can an authenticator app code still be phished, while a security key cannot?
A real-time phishing page can relay a typed code within its 30-second window. FIDO keys sign a challenge tied to the genuine domain, so a look-alike site gets nothing usable.
5. Why should you register two security keys instead of one?
A spare key, kept somewhere safe, is your way back in if the everyday key is lost or broken.
6. In the worked example, what did protecting six accounts with two keys cost, and what did adding the authenticator app cost?
Two Yubico Security Key NFC keys at $29 each come to $58, and one key pair covers every account. Authenticator apps are free.
Terms in this lesson
- Two-factor authentication (2FA)
- Signing in with something you know (a password) plus something you have or are, like a phone or key.
- SIM swap
- A fraud where a criminal gets your carrier to move your phone number to a SIM card they control.
- Authenticator app
- An app that shows a new six-digit code every 30 seconds, generated on your phone without a text message.
- Security key
- A small USB or NFC device that proves who you are using FIDO standards, and refuses to work on fake sites.
- Backup codes
- One-time codes a site gives you to get in if you lose your second factor.
- Push bombing
- Flooding someone with sign-in approval prompts until they tap Approve by mistake or to make it stop.
Sources
- CISA, Implementing Phishing-Resistant MFA (fact sheet, October 2022) checked 2026-10
- NIST SP 800-63B-4, section on restricted PSTN out-of-band authenticators checked 2026-10
- Verizon, How does Verizon protect my account? checked 2026-10
- BleepingComputer, AT&T rolls out Wireless Lock feature to block SIM swap attacks (July 2025) checked 2026-10
- BlackCloak, Wireless Carrier Security (T-Mobile port validation and NOPORT) checked 2026-10
- Federal Register, Protecting Consumers From SIM-Swap and Port-Out Fraud (December 8, 2023) checked 2026-10
- Telecom Law Firm, FCC Amends SIM Swapping/Port-Out Fraud Compliance Date (July 2024) checked 2026-10
- Yubico store prices checked 2026-10
- Google Advanced Protection Program checked 2026-10