4

My bank started using 2-factor authentication with phone being part 2, so I am wondering is it difficult for someone to impersonate my mobile phone to receive the text message with the code?

Improve this question
1
  • 3
    It is certainly better than no two-factor but there have been instances where attackers sweet-talked customer service into redirecting texts to another phone. Generally speaking, Google Authenticator and similar apps that generate the code locally based on the time are more secure, but unfortunately some sites only offer SMS two-factor.
    – tlng05
    Oct 1, 2016 at 0:53

1 Answer 1

Reset to default
5

NIST (National Institute of Standard and Technology) is recommending not to use SMS based 2 factor authentication. According to NIST guidance.

OOB [out-of-band verification] using SMS is deprecated, and will no longer be allowed in future releases of this guidance.

This article by Brian Krebs has details on how the current 2 factor auth using SMS can be used by bad guys to scam people. It also has details on the alternatives which are more secure.

SMS is easy to intercept because of the SS7 protocol used by carriers which was designed with no security.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .