You type in your password, and a few seconds later your phone buzzes with a six-digit code. You enter it, and you’re in. For millions of people, that text message is the extra layer of security on their bank, email and shopping accounts.

However, The Cybersecurity and Infrastructure Security Agency, the federal agency that leads US civilian cyber defense, has told some Americans to stop using it.

“Do not use SMS as a second factor for authentication,” the agency wrote in guidance issued in December 2024. “SMS MFA is not phishing-resistant; therefore it is not strong authentication for accounts of highly targeted individuals.”

That last phrase matters, and so does the context.

Why CISA said it

The guidance came after a hacking campaign known as Salt Typhoon, which Gizmodo describes as an operation by hackers aligned with the Chinese government that got inside US telecom networks. Reports of the breach surfaced in the fall of 2024. Access to that infrastructure gave attackers the ability to intercept unencrypted communication.

If someone can read your texts, they can read your login codes too. CISA’s Mobile Communications Best Practice Guidance was written specifically for “highly targeted” people, which the agency defines as those “in senior government or senior political positions and likely to possess information of interest to these threat actors.” Alongside the SMS warning, it urged them to use end-to-end encrypted messaging apps, such as Signal, for their communications.

The weaknesses go beyond one hack

CISA’s concerns about text message codes are older than Salt Typhoon. In an October 2022 fact sheet on phishing-resistant MFA, the agency ranked the common forms of multi-factor authentication from strongest to weakest. SMS and voice codes were at the bottom, described as “vulnerable to phishing, SS7, and SIM swap attacks.”

In plain terms, those are three different ways to steal a code:

Phishing is the simplest. A fake login page asks for your password and then asks for the code you just received. You type it in, and the attacker uses it instantly on the real site.

SIM swapping means persuading your mobile carrier to move your phone number to a SIM card the attacker controls. From then on, your texts, including login codes, go to them.

SS7 refers to weaknesses in the decades-old system phone networks use to route calls and texts between carriers. It can, in some cases, let attackers intercept messages without touching your phone at all.

The 2022 fact sheet said SMS codes “should only be used as a last resort MFA option,” though it can “serve as a temporary solution” while moving to something stronger.

What CISA recommends instead

The agency’s strongest option is what it calls phishing-resistant authentication. In the 2022 fact sheet, CISA states that “the only widely available phishing-resistant authentication is FIDO/WebAuthn authentication.” For most people, that means passkeys, which are now supported by Apple, Google and Microsoft, or a physical security key that plugs into a laptop or taps against a phone. Both work by checking that you’re on the genuine website, so a fake login page can’t capture anything useful.

Authenticator apps, which generate codes on your phone rather than receiving them by text, sit in the middle. They avoid SIM swaps and phone network interception, though a convincing phishing page can still trick you into typing in a code.

Should you turn off text codes?

Not if the alternative is nothing. A password plus a text message code is still harder to break into than a password alone. CISA’s own fact sheet treats SMS as weak, not worthless.

The better move is to upgrade where you can. Start with the accounts that would hurt most to lose: your main email account, since it could probably reset everything else, then banking and your phone carrier account. Check each one’s security settings for passkeys, a security key or an authenticator app. Once a stronger method is set up, some services let you remove your phone number as a backup.

The text message code isn’t going away overnight, and for many sites it’s still the easiest option. But the agency in charge of national cyber defense has said clearly what it thinks of it, and that is a good reason to move your most important accounts to something better.