SMS vs TOTP
Why the Delivery Method Changes Everything
Both send you a six-digit code, and there the resemblance ends. An SMS code is tied to your phone number, which someone else can take control of. A TOTP code is generated by a secret held on your device, which they would have to steal. If a service offers both, choose TOTP.
The Core Difference
SMS is delivered. The service generates a code and sends it across the mobile network to whatever device currently answers to your number. You are trusting your carrier, the network, and every system in between.
TOTP is generated. Nothing is transmitted. Your device and the service each compute the same code from a secret shared once at setup. There is no message to intercept, no carrier involved, and no network to trust.
That distinction produces every practical difference below.
Head to Head
| SMS code | TOTP code | |
|---|---|---|
| Tied to | Your phone number | A secret on your device |
| Vulnerable to SIM swapping | ❌ Yes | ✅ No |
| Works without signal | ❌ No | ✅ Yes |
| Works abroad | ⚠️ Roaming dependent | ✅ Always |
| Visible on a lock screen | ❌ Often | ✅ No |
| Third parties in the chain | Carrier, network, gateway | None |
| Resists real-time phishing | ❌ No | ❌ No |
| Service support | ✅ Very broad | ✅ Very broad |
SIM Swapping Is the Decisive Weakness
This is the attack that pushed standards bodies to downgrade their view of SMS.
An attacker gathers enough personal information about you - much of it public or breached - then contacts your mobile carrier posing as you. They report a lost phone and ask for the number to be transferred to a new SIM in their possession. If the carrier's staff are persuaded, your number now rings on their device.
From that moment every SMS code intended for you arrives with them. Your phone typically goes silent, which is often the first sign something is wrong, and by then password resets are already running.
Notice what this attack does not require: no malware, no access to your phone, no technical skill beyond a convincing phone call. It targets the carrier, not you, and there is very little you can do to prevent it from your side. See Common Password Attacks for how it fits alongside other techniques.
A TOTP seed is simply not exposed to this. It is on a device in your pocket, not attached to a number an operator can reassign.
The Smaller Problems With SMS
Beyond SIM swapping, four everyday annoyances that are also risks:
- No signal, no code. On a plane, in a basement, or abroad without roaming, you are locked out of your own account.
- Lock screen previews. Codes routinely appear on a locked phone, visible to anyone holding it.
- Delivery delays. Codes that arrive after expiry, or not at all.
- Changing numbers. Give up a number and the next person to receive it inherits your second factor on any account you forgot to update.
Be Clear About What TOTP Doesn't Fix
TOTP removes the delivery channel and everything that comes with it. It does not make the code phishing-resistant.
Both SMS and TOTP produce something you read and type, and a convincing fake page can collect either and relay it to the real site within seconds. Moving from SMS to TOTP is a real and worthwhile upgrade; it is not the end of the road. See Passkey vs OTP.
What to Do
If a service offers TOTP, use it and remove SMS as a method where the service allows it. Leaving SMS enabled as a fallback keeps the weakness available to an attacker.
If SMS is the only option, keep it - it is far better than no second factor at all. Ask your carrier about a port-out PIN or account lock, which makes an unauthorised transfer harder.
Where the seed lives is worth a thought too. In an authenticator app it sits on a general-purpose phone; on a Seedkeeper PRO it is written into a secure element and can never be read back out. See Adding a TOTP Account.
FAQ
Is SMS 2FA safe?
It is much safer than no second factor, and the weakest of the common options. Because it depends on your phone number rather than your device, an attacker who persuades your carrier to transfer that number receives your codes.
What is SIM swapping?
An attack where someone impersonates you to your mobile carrier and has your number moved to a SIM they control. Every SMS code then arrives on their device, with no malware and no access to your phone required.
Is an authenticator app better than SMS?
Yes. TOTP codes are generated on your device from a stored secret, so there is no message to intercept, no carrier in the chain, and no exposure to SIM swapping. They also work with no signal.
Should I remove SMS once I set up an authenticator?
Where the service allows it, yes. An account is protected by its weakest enabled method, so leaving SMS active keeps that route open for an attacker.
Does TOTP protect me from phishing?
No. Like an SMS code, a TOTP code is something you read and type, so a fake page can collect it and relay it immediately. Only a domain-bound credential such as a passkey prevents that.