Companies embracing SMS for account logins should be blamed for SIM-swap attacks

Original Article ↗ Hacker News Discussion ↗

Companies that use SMS for login and account recovery are increasingly being blamed for SIM-swap fraud, where attackers hijack a victim’s phone number to reset passwords and seize accounts. Commenters argue that SMS is fundamentally weak as an authentication factor—phone numbers are easy to social-engineer, get reassigned, and fail when people travel or change carriers—yet businesses favor it for its ubiquity, low friction, and side benefits like bot filtering and user tracking. Alternatives such as TOTP apps, hardware keys, email-based flows, and government-backed digital IDs are seen as more secure but raise their own usability, recovery, and ecosystem challenges, leading to debate over whether regulators, telcos, or online services should bear primary responsibility for fixing the problem.

Security weaknesses of SMS authentication

  • SIM-swap is seen as the core risk: attackers socially engineer carriers to port numbers, then reset passwords and drain accounts. Users cannot “lock down” their number like they can harden email.
  • SMS is described as an “open postcard”: interceptable via weak SS7 networks, compromised SMS gateways, or insider abuse at carriers.
  • Number recycling (after non‑payment, moving countries, prepaid expiry) can hand control to a new person, yet many services still treat the number as a strong identifier.
  • Some cite standards (e.g., NIST, EU PSD2 rules) that effectively deem SMS insecure as a primary or sole factor for sensitive actions.

Usability and why companies keep using SMS

  • SMS is nearly universal, no app install needed, and mobile OSes auto-fill codes, giving very low-friction UX, especially on phones.
  • Many users struggle with password managers, authenticator apps, or hardware keys; losing phones or not saving backup codes is common.
  • Businesses offload identity-proofing and bot-friction to telcos: a phone number is harder to mass‑farm than email and ties into KYC processes.

Alternatives: pros, cons, and gaps

  • Email: argued by some as “more securable” (can add strong 2FA), but average email hygiene may be worse than average phone security.
  • TOTP/apps: widely viewed as safer than SMS, but poor ergonomics, confusing recovery, and limited mainstream awareness.
  • Hardware keys/WebAuthn/passkeys: considered best practice by many, yet costly, complex to support, and risky if users lose them or if sites don’t allow multiple keys.
  • Bank/ID apps and national e-ID schemes are praised where they exist, but others fear centralization or government control.

Recovery, lockouts, and travel

  • Numerous anecdotes of being locked out of critical accounts (banking, email, social) when losing a number, traveling abroad, or lacking reception.
  • Some turn off SMS 2FA entirely after being unable to log in from unusual networks; others describe broken “try another way” flows.
  • Number changes, international moves, and rural/indoor dead zones make SMS-based recovery particularly fragile.

Responsibility and regulation

  • One camp blames companies for knowingly building on a weak link and marketing SMS as “secure 2FA.”
  • Another camp blames carriers’ lax porting processes and argues they should require stronger identity checks or delays on swaps.
  • A minority argues the primary blame should still rest on criminals, warning against over-penalizing “innocent” companies.
  • Some call for regulation: banning SMS as a sole factor for high-risk accounts, mandating better recovery mechanisms, or introducing government-backed digital identities.