For the longest time, verifying our identity logging into an account involved getting texted an MFA (multi-factor authentication) code. Well, not so much anymore. In fact, cybersecurity pros agree, although better than nothing, this option has almost as many security holes as a piece of Swiss cheese. Today there are more secure identity verification options to consider and should be used when you have the option to do so.
Why Texting MFA Codes Is Risky
First, let’s explain why. Research finds tech giants Google, Amazon, and many others rely on third-party vendors texting these codes—an added risk. Another important security hitch—SMS messages are not encrypted, and they can be intercepted and they do get intercepted.
Even though some websites still cling to texting MFA codes, if you find yourself stuck with no other option it’s still better than using nothing at all.
Alternative Options
Authenticator Apps: These apps are stored on your devices and that takes MFA code texting off the table. Authenticator apps create and store unique codes for every one of your online accounts, and the codes are changed every 30 seconds; sometimes more often. Google, Apple, Microsoft, and many more have authenticator apps available and a plethora of websites offer this method for MFA.
Passkeys: Considered one of, if not the safest verification tool at the moment, passkeys are a no-password, no-code option. You and the website each get a matching digital key, and both passkeys need to match to get into your account. If that happens there’s another option and that is using your biometrics. A fingerprint scan or a scan of your face confirms you’re the legit account holder, and in you go.
Hardware Keys or FOBs: These are small pieces of hardware. The key plugs into the device and FOBs have one-time codes that change frequently like an authenticator app. They don’t take up much space, but if you don’t have it, you cannot log in and that’s why they are more secure. If the hacker doesn’t have your key, they can’t get into your account either.
The good news is that most of the time, you can use one of these better options when they’re offered and you’ll keep your data more secure. The bad news is that sometimes these options aren’t available to you. For instance, you’re traveling and you don’t have your FOB. So be sure you set your accounts up to authenticate in another way just in case you have a “one-off” situation and still need to access them.
It’s no secret that hackers have an enormous appetite for hijacking identities. Since we know MFA texting is often an unnecessary identity risk, consider the other options and choose what works best for you.
SUBSCRIBE TO WEEKLY NEWSLETTER
