SMS-based one-time codes fail in predictable ways. Number porting, SIM swaps, carrier account takeover, and telecom interception can redirect messages without touching the target phone.
Modern guidance increasingly treats PSTN and SMS out-of-band authentication as a high-risk method. NIST marks use of the public switched telephone network for out-of-band verification as restricted in NIST SP 800-63B. CISA guidance on phishing-resistant MFA highlights common bypass paths for weaker MFA methods and emphasizes stronger, phishing-resistant authenticators in its phishing-resistant MFA fact sheet.
The most important point for crypto is practical. If email is reset via SMS, and exchange access is reset via email, then SMS becomes the master key even when an app does not directly use SMS.
A no-SMS stack targets three common takeover routes:
The stack is designed so that stealing a phone number is not enough, and phishing a one-time code is not enough.
Passkeys use public-key cryptography bound to the legitimate site or app, making them resistant to classic phishing pages.
Security keys are physical FIDO authenticators that require presence. They are one of the strongest consumer-accessible factors for high-value accounts.
For many users, two keys is the minimum workable set:
Authenticator apps generate time-based codes (TOTP) from a shared secret. TOTP is standardized in RFC 6238, building on HOTP in RFC 4226.
TOTP is not phishing-proof. A real-time phishing proxy can capture it. It still removes entire categories of telecom risk that exist with SMS.
Recovery codes are the backstop for device loss and key loss. They must be stored offline to avoid turning recovery into another online credential.
The rule is simple: the recovery path should be stronger than the login path, not weaker.
This stack focuses on the accounts that control crypto outcomes.
Email is the reset rail for exchanges and many financial apps.
Recommended configuration:
A hardened email control plane is the foundation because it prevents downstream resets.
Exchanges are a high-value target because they combine custody and withdrawals.
Recommended configuration:
If an exchange offers both security keys and TOTP, security keys are the stronger factor for takeover resistance.
A password manager prevents password reuse and makes long passwords realistic.
Recommended configuration:
A password manager becomes safer than memory when it reduces reuse and creates unique credentials everywhere.
A no-SMS stack still benefits from reducing SIM swap risk, even if SMS is not used.
Recommended configuration:
CISA’s mobile communications best practice guidance includes recommendations that reduce SIM swap exposure and harden mobile accounts in the mobile communications best practice guidance.
Use passkeys as the primary sign-in and add a security key if the service supports it.
This combination blocks most phishing-based takeovers because a fake domain cannot use the passkey.
Use security keys as the second factor and keep a backup key offline.
Use TOTP and tighten the rest of the environment:
Treat that service as a risk bucket:
The goal is to reduce the blast radius for the one weak link.
A no-SMS stack must not become a lockout trap.
A stable recovery design has redundancy across devices and locations:
The recovery sequence should start with the strongest authenticator available, not with SMS.
A no-SMS approach works when the control plane is hardened first and every account has a planned loss scenario.
A no-SMS security stack removes the phone number as a master key. Passkeys and security keys provide phishing-resistant authentication, while TOTP covers services that have not adopted stronger standards. Recovery remains workable when it is planned in advance with redundant security keys, offline recovery codes, and a hardened email account that cannot be reset through SMS.
The post How To Build a No-SMS Security Stack (and What To Use Instead) appeared first on Crypto Adventure.
