Turning on multi-factor authentication is one of the best things a small business can do. But not all second factors are equal, and the six-digit code sent by text message is the weakest of them.
What goes wrong with SMS
- SIM swapping. An attacker convinces your mobile carrier to move your number to their SIM card, then receives your codes.
- Phishing. A fake sign-in page asks for the code and passes it to the real site in real time.
- Visibility. Codes often appear on a locked phone's screen, where anyone nearby can read them.
What to use instead
- An authenticator app such as Microsoft Authenticator, with number matching turned on.
- Passkeys or security keys for administrators and anyone handling money or patient data. These can't be phished.
If you use Microsoft 365, you can move staff off SMS in an afternoon. Book a call and we'll walk you through it.