SMS-based recovery is an account reset or verification method that sends one-time codes or links by text message to a registered phone number. It is convenient because most users can receive SMS without extra setup, but it is weaker than app-based or hardware-backed recovery because control of the number can change.
In cyber attacks, SMS-based recovery is often abused after SIM swapping or carrier compromise. If an attacker takes over a victim’s number, they can intercept reset codes, approve login prompts, or change account settings, then lock the real owner out. This is especially dangerous for valuable targets such as email, financial, and cryptocurrency accounts. Defenders should treat phone numbers as mutable, not as proof of identity, and prefer stronger recovery options, such as authenticator apps, hardware security keys, recovery codes, and alerts for account changes.