That familiar text message with a six-digit code you use to log into your bank account? It might be on its way out. Banks are increasingly moving away from SMS-based two-factor authentication (2FA), citing significant security vulnerabilities that leave customers exposed to fraud.

Key facts:

  • SMS-based two-factor authentication is being phased out.
  • This method is vulnerable to SIM-swapping attacks and interception.
  • Banks are adopting more secure alternatives like app-based authenticators.

Why the shift away from text messages?

For years, texting codes felt like a solid extra layer of security. But experts have long warned that SMS is far from foolproof. SIM-swapping attacks, where a fraudster tricks a mobile carrier into transferring a phone number to a new device, can intercept these codes. Once they have your number, they have your keys.

What's replacing texted codes?

The future of secure logins lies in app-based authenticators—like those from Google or Microsoft—or physical security keys. These methods generate codes offline or require a physical device, making them nearly impossible to intercept remotely. Many major financial institutions are already guiding customers toward these more robust options.

What should you do now?

Don't wait for a text from your bank to stop arriving. Proactively check your security settings. If your bank offers an authenticator app or supports security keys, make the switch. It takes a few minutes but drastically reduces your risk. Your financial safety is worth that small effort.