Why the FBI and CISA Recommend Against SMS-Based Multi-Factor Authentication (MFA)

Recently, you might have seen a headline like this:

A headline like this is easy to scroll past. However, as bad as the headline and article are at actually telling you any real information, this important stuff.

This article is going to break down what you need to know so you can stay safe out there.

You know who the FBI is.

CISA stands for the Cybersecurity and Infrastructure Security Agency, which is a part of the Department of Homeland Security (DHS). So, these are the good guys who are really smart computer folks. The FBI folks are probably pretty smart too, but CISA has “Cybersecurity” right in the name.

MFA (Multi-Factor Authentication) is just a fancy way of saying that you have more than one way of proving you are who you say you are, and they have to work together.

SMS is just a fancy way of saying texting.

The Problem

A few years ago, we were told we needed to prove we are legit when we log into something. The primary way of doing that became multifactor authentication over texting (SMS-Based MFA). 

Obviously, based on the number of people getting scammed or stolen from, online account security is more critical than ever. Because of this, MFA has become required for security, but not all MFA methods are created equal. 

Recently, the FBI and CISA have advised against using SMS-based MFA due to its vulnerabilities. Let’s unpack their concerns in plain language and explore safer alternatives.

Why SMS MFA Isn’t Secure

SMS MFA relies on text messages to deliver one-time codes. While better than no MFA at all, SMS MFA has significant security weaknesses that can expose you to cyberattacks.

Security Risks of SMS MFA

1. Phishing Attacks
   Cybercriminals trick users into revealing their SMS codes by creating fake login pages or sending deceptive emails. Once they have your code, they can bypass MFA and access your account.
2. Malware on Your Phone
   Malware installed on your phone can grab SMS codes directly. Attackers then use these stolen codes to gain unauthorized access.
3. SIM Swaps
   In a SIM swap, an attacker convinces your mobile carrier to transfer your phone number to a new SIM card. They then receive your text messages, including MFA codes, effectively locking you out of your accounts. You’re probably thinking, “Why would my carrier allow someone to do this?” The answer is that the support agents are human, and the bad guys are good at convincing them that they are you.
4. SS7 Attacks (jeez, more acronyms?)
   The SS7 protocol, which is the foundation of much of the global telecommunications system, has vulnerabilities that allow attackers to intercept text messages. These flaws are exploited to grab MFA codes.
5. SIM Cloning
   SIM cloning involves duplicating your SIM card to receive all messages and calls for the original user. Attackers can use this technique to hijack SMS MFA codes.
6. Fake Cell Towers (IMSI Catchers) (Seriously, people do this? This has to be a lot of work.)
   Attackers can use devices like IMSI catchers to mimic legitimate cell towers, intercepting SMS messages and other communications.

Why now?

Chinese Hackers Targeting U.S. Telecom Providers
In 2024, Chinese cybercriminals went after big telecom and internet providers, including Verizon, AT&T, T-Mobile, and Lumen. These attacks highlighted vulnerabilities in SMS MFA because it is not encrypted, meaning it is plain text, and anyone who grabs the message can read it. 

The telecom companies say they have eradicated all of the threats from their systems, but once hackers are in a system, ensuring they are cleaned out is virtually impossible. It is not like the telecom companies can just wipe all of their equipment.

To be fair, it is not just the Chinese attacking these companies. Lots of hacker groups are at it all the time. And the U.S. is constantly trying to hack Chinese companies. However, this series of attacks was different because of its massive scale and success.

Safer Alternatives to SMS MFA

The FBI and CISA suggest transitioning to more secure MFA methods. Here are some effective options:

1. Authenticator Apps
   Apps like Google Authenticator or Microsoft Authenticator generate one-time passcodes on your device, bypassing SMS vulnerabilities entirely.
2. Push Notifications
   Push notifications send login approval requests to your device through secure app-based channels. These are less prone to interception compared to SMS.
3. Hardware Security Keys
   Physical security keys, such as YubiKeys, provide great protection. You have to physically have these keys with you, making them nearly impossible to hack remotely.
4. Biometric Authentication
   MFA methods that rely on fingerprints, facial recognition, or other biometric data are also a great way to provide a high level of security.
5. Passkeys
   Passkeys are a way to use a hardware key, password manager, or biometrics to prove who you are. Passkeys have been around for a while, but even though they are easy to use once they are setup, adoption has been slow because they are a little harder to understand.

To be sure, migrating your current logins to a new system is going to be a real pain.

However, you are going to have to move to one or more of the methods above sooner or later because SMS MFA is going away. Also, if you stick with it, you are going to be the target of more and more attacks.

So, how do you move to one of these new methods, and which one do you pick?

That is the subject of the other articles in this series.

• An Introduction to Authenticator Apps
• An Introduction to Hardware Security Keys
• An Introduction to Biometric Authentication
• An Introduction to Passkeys