Text codes, apps and keys: not all MFA is equal

From weakest to strongest

Text message codes. A code is sent by SMS. Much better than a password alone, but codes can be phished, and attackers sometimes convince a phone carrier to move your number to their SIM card, which sends your codes to them.

Approve or deny prompts. An app asks “Is this you?” and you tap Approve. Easy to use, but attackers send prompt after prompt until someone taps Approve to make them stop. (Read more.)

Number matching in an authenticator app. You type the number shown on your screen into the app. Blind approvals stop working, because you need to see the real sign-in screen.

Passkeys and security keys. A key stored on your device or on a small physical key that only works on the real website. A fake sign-in page cannot use it, which makes this the strongest common option.

What to do

• Turn it on everywhere it is offered, starting with email, banking and administrator accounts. Any method beats none.
• Prefer an authenticator app over text messages for work accounts.
• Use passkeys or security keys for administrators and anyone who handles money, where your systems support them.
• Never approve a prompt you did not start.