The problem with SMS-only
SMS OTP has real weaknesses: it is vulnerable to SIM-swap attacks and interception, it depends on best-effort carrier delivery, and it costs money on every send that grows with scale. For low-risk convenience it is fine; for high-value accounts or high volume, leaning on it exclusively is a liability.
The modern answer is not "never use SMS" but "use the right factor per flow," often with SMS as a fallback rather than the primary.
- Security: SIM swap and interception can defeat SMS OTP.
- Reliability: delivery is best-effort and varies by country.
- Cost: every send is billable and scales with your users.
Passkeys (WebAuthn / FIDO2)
Passkeys replace passwords and OTPs with a cryptographic key pair bound to the user's device and unlocked by biometrics or a PIN. They are phishing-resistant by design, cost nothing per authentication, and are now supported across major browsers and platforms with cloud sync. For new consumer products, passkeys are increasingly the recommended primary factor.
- Strong: phishing-resistant, no per-use cost, excellent UX after setup.
- Weaker: account recovery and cross-ecosystem sync need careful design.
- Use as the primary factor for new flows, with a fallback for recovery.
TOTP authenticator apps
TOTP (time-based one-time passwords) generate a rotating 6-digit code in an app like Google Authenticator or Authy from a shared secret. There is no delivery dependency and no per-use cost, and it is far more resistant to interception than SMS. The trade-off is setup friction and recovery when a device is lost.
- Strong: no delivery risk, no per-use cost, resists SIM-swap.
- Weaker: enrollment friction; needs recovery codes for lost devices.
- Great as a step-up factor for security-conscious users.
Magic links
A magic link emails the user a one-time sign-in URL, removing passwords entirely for email-centric products. It is simple and familiar, but it depends on email deliverability and inherits email's phishing surface, and it works poorly when the link opens in a different browser than the one signing in.
- Strong: passwordless, familiar, no phone number required.
- Weaker: email deliverability and cross-browser link handling; phishing surface.
- Good for low-risk, email-first products; pair with device checks for sensitive actions.
Comparing the options
There is no single winner — match the factor to the risk and the audience. A common modern pattern is passkeys as primary, TOTP as a step-up, and SMS retained only as a last-resort fallback for users who have nothing else.
| Method | Security | Per-use cost | Best for |
|---|---|---|---|
| SMS OTP | Moderate (SIM-swap risk) | Per message | Broad reach, low-risk fallback |
| Passkeys | High (phishing-resistant) | None | Primary factor for new products |
| TOTP app | High | None | Security-conscious step-up |
| Magic link | Moderate | Email cost only | Email-first, low-risk flows |
How to migrate without breaking users
Do not rip SMS out overnight. Add a stronger factor as an option, encourage enrollment, and only then demote SMS to fallback. Keep a recovery path for every method so a lost device or channel never locks a user out.
- 1
Add, don't replace
Introduce passkeys or TOTP as an additional option while keeping SMS working.
- 2
Nudge enrollment
Prompt users to set up the stronger factor at natural moments, like after a sensitive action.
- 3
Demote SMS to fallback
Once adoption is healthy, make SMS the recovery/last-resort channel rather than the default.
- 4
Guarantee recovery
Provide recovery codes or an alternate factor so no single lost device locks anyone out.