SMS first-factor sign-in is a legacy authentication method where a one-time code is sent by text message and used as the primary step to prove a user’s identity. It is simple and familiar, but it relies on a shared secret delivered over a channel that was not designed to be a strong security boundary.
In cyber security, this matters because SMS codes can be intercepted, relayed through phishing, exposed by SIM-swapping, or read from a compromised device. Attackers often target SMS-based sign-in to bypass weak account recovery or trick users into handing over codes in real time. Defenders reduce this risk by replacing SMS with phishing-resistant methods such as passkeys, hardware security keys, or strong app-based authentication, and by auditing which users still depend on legacy login paths.