Choosing a second factor: SMS, app codes, or hardware

Two-factor authentication is the single highest-value change most people can make. But the options are not equivalent, and the differences matter for accounts that would hurt to lose.

SMS codes

Better than a password alone, and often the only option offered. The weakness is the phone number itself: SIM swap fraud transfers your number to an attacker, after which every SMS code goes to them. Where a service supports something better, use it — and where SMS is your only option, ask your carrier about a port-out PIN.

Authenticator app codes (TOTP)

A shared secret on your device generates a rotating six-digit code. No phone number involved, works offline, and it is widely supported. It is still phishable — a convincing fake login page can ask for the code and use it within its validity window — but it removes the SIM swap risk entirely.

Save the recovery codes when you enrol. Losing a phone without them is the most common way people lock themselves out.

Hardware keys and passkeys

These bind the login to the site's actual domain, so a phishing page cannot use them even if you are fully convinced. This is the only category that resists a well-executed phishing attack.

A sensible approach: passkeys or a hardware key on email and financial accounts, an authenticator app for everything else, and SMS only where nothing better exists.