SMS, app or security key: choosing a second factor
The best second factor is the strongest one each account allows: a passkey or a security key first, then an authenticator app, then a code by text message. Text codes are the weakest option because phone numbers can be taken over, but the UK’s NCSC and the US FTC both say that any second factor is far better than none.
Which second factor should you choose?
Use the strongest method each account offers, and keep a weaker one only as a backup. For most small businesses that means a passkey or an authenticator app on everyday accounts, a security key for the few accounts that control money or the domain, and text message codes only where nothing else exists. This page expands on our guide to adding a second factor to your logins. The NCSC’s guide to setting up 2-step verification, written for individuals and small businesses, starts from the same principle: any second step is a big improvement, and some are better than others.
The methods compared
The ranking below combines the guidance of NIST and CISA in the US and of the NCSC in the UK, which agree on the order.
| Method | Resists fake login pages | Works without a mobile signal | Cost | Main risk |
|---|---|---|---|---|
| Passkey | Yes | Yes | Free | Depends on the account that stores and syncs it |
| Security key | Yes | Yes | About $29 to $58 per key | Losing it without a spare |
| App approval with number matching | Partly | No, needs data | Free | Being tricked into approving |
| Authenticator app code | No | Yes | Free | Typing the code into a fake page |
| Code by text message or call | No | No | Free | Phone number takeover (SIM swap) |
“Resists fake login pages” is the key column. NIST’s definition of phishing resistance is that the method itself refuses to hand a valid answer to an impostor site, without relying on you to notice. Only passkeys and FIDO security keys do that, because they are bound to the real website’s address. Anything you type by hand, a code from an app, a text message, or a backup code, can be typed into a fake page.
Is SMS two-factor authentication safe?
Safer than nothing, weaker than everything else. NIST classifies codes sent through the phone network as a “restricted” authenticator: services may still use them, but must offer at least one alternative and explain the risks. The main risk is a SIM swap, in which a criminal persuades your mobile carrier to move your number to their SIM card and receives your codes. Google says on its 2-Step Verification page that codes sent by text or call can be vulnerable to phone number-based hacks, and Microsoft has said it will start phasing out text messages for sign-in and recovery on personal Microsoft accounts.
CISA goes further and tells people not to use SMS as a second factor, but that advice appears in guidance written for highly targeted people, such as senior officials. For most readers, the balanced approach is the one CISA also recommends: add a stronger method, then remove the text message option where the service allows it, and add a PIN to your mobile carrier account to make a SIM swap harder.
Push approvals: only with a number to match
Some apps, including Microsoft Authenticator and Google’s prompts, ask you to approve a sign-in on your phone. NIST says that a prompt asking you only to tap “approve” is no longer acceptable, because people end up approving requests they did not make, a pattern known as MFA fatigue. The safer version shows a number on the login screen that you type or confirm in the app. Microsoft applies number matching to all Authenticator push notifications for work and school accounts.
Codes by email
NIST tells services not to use email as a second channel for authentication. The NCSC is more tolerant: it accepts an email code as a second step if it goes to a different account from the one being protected. Either way, email codes are only as safe as the inbox that receives them.
Backup codes
Backup codes are not phishing-resistant either, but they are your safety net when a phone is lost. Keep them on paper or offline, never in the same place as the account they protect.
What to choose, account by account
- Your main email and the Google, Apple, or Microsoft account that syncs your passkeys: a passkey, plus a security key if you can.
- Domain registrar, bank, and admin accounts: a security key or a passkey; an authenticator app if neither is offered.
- Everyday business tools: a passkey or an authenticator app.
- Services that only offer text messages: turn them on anyway, and protect your carrier account with a PIN.
Picking the app
If an authenticator app is your main method, the choice matters for backups and phone changes. See how the main authenticator apps compare.
When a hardware key is worth it
For the few accounts that would hurt the most if lost, a security key is the strongest option. Read who benefits from a YubiKey or similar key.