Two-Factor CodesWhich two-step sign-in method is best
Any second step is better than none. Some are much harder to attack than others.
What the official sources say
The CISA fact sheet "Implementing Phishing-Resistant MFA" (October 2022) says that any form of multifactor authentication is better than none, but that not all forms are equally secure: some are vulnerable to phishing, "push bombing" attacks, exploitation of SS7 weaknesses and SIM swap attacks. It calls phishing-resistant MFA the gold standard.
NIST SP 800-63B-4, in its section on one-time passwords, says that OTP authentication is not phishing-resistant. The same document says that email must not be used for out-of-band authentication, because it can be reached with only a password, intercepted or rerouted. For authentication over the telephone network (SMS or voice) it sets extra conditions, for example that the number is tied to a physical device, and says the verifier should look for risk signs such as a SIM change.
The methods
| Method | Strength | Main weakness |
|---|---|---|
| SMS or voice code | Easy, no app | SIM swap, number porting and SS7 weaknesses; can be phished |
| App code (TOTP) | Works offline, no phone number | Can be typed into a fake site; lost phone needs recovery |
| Push approval | One tap | Push bombing: repeated requests until someone taps yes |
| Security key or passkey | Phishing-resistant | Needs support from the site; a lost key needs recovery |
| Email code | Better than nothing for low risk | NIST says it must not be used as an out-of-band authenticator |
A practical order
- Where a site offers a security key or passkey, use it for important accounts (email, banking, work).
- Otherwise use an authenticator app.
- Use SMS only if it is the only choice, and add a strong password.
- Never approve a sign-in request you did not start.
What phishing-resistant means
NIST describes "verifier impersonation resistance": the sign-in method ties the proof to the real website, so that a fake website gets nothing it can use. Typed codes do not have that property, and keys and passkeys do.
Is SMS so bad that I should not use it?
No. CISA says any MFA is better than none. It is a weaker choice, and the sources advise moving to stronger methods when possible.
Is an app on the same phone as my email safe?
It is a different secret, but if the phone is stolen and unlocked both are exposed. Lock your phone.
Sources
- CISA: Implementing Phishing-Resistant MFA, October 2022 (cisa.gov, fact sheet PDF)
- NIST SP 800-63B-4: Authentication and Authenticator Management (pages.nist.gov/800-63-4/sp800-63b.html), sections on OTP, out-of-band and phishing resistance
Read on 14 November 2026.
This is an independent guide. It is not connected with the IETF, NIST, CISA, any authenticator app or any company named here. Facts were read on 14 November 2026 from the documents named on each page; codes and examples were calculated with Python and with the page's own code, and checked against the RFC test vectors.