The short version: a text-message code is much better than a password alone. Other second steps are stronger. When you can, move to a passkey or an authenticator app.
First: you are not doing it wrong
If you use text-message codes, there is no need to worry. You are already safer than someone with only a password. A text code is better than no second step.
This guide helps you go from good to better. Nothing here means “turn it off now”. Do not remove a text-message code until a better method works.
How a text-message code works
A website or app sends a short number to your phone number. This is an SMS, which is a text message. You type the number into the website. The site then knows you hold the phone. This is two-factor authentication (2FA). It is a second check after your password.
Why it is the weakest common choice
CISA (the US cyber agency) puts text and voice codes last on its list of second steps. NIST (the US standards agency) calls this method “restricted”. It describes it as a less secure approach. Here are the main reasons. Each one is a single idea.
1. Someone can take over your phone number. This is called SIM swapping. A criminal tricks your phone company into moving your number to a SIM card the criminal holds. A SIM card is the small chip that links a phone to your number. Then your calls and texts go to the criminal. The FBI says this lets criminals receive your text codes and reset your passwords. To learn more, read SIM swapping.
2. A fake website can ask for the code. Phishing means a fake message or site that copies a real one. A fake site can ask for your password and then your text code. The criminal types both into the real site right away. CISA warns about this. Codes from an app can be tricked this way too. A passkey is built to resist this.
3. A code can show on a locked screen. Depending on your settings, a phone can show the start of a text on the lock screen. Someone who holds your phone could see the code. You can change this in your phone’s notification settings, for example by hiding message previews. Check your phone’s help page. NIST says a service should not show a code on a locked device.
4. No signal can mean no code. A text needs a phone signal. NIST notes that people in places with limited coverage may not be able to get these codes. An authenticator app works without a mobile signal, as Google also points out.
These points describe the method, not you.
What to use instead, in this order
- A passkey or a security key. A passkey lets you sign in with your fingerprint, your face or your phone screen lock. A security key is a small device you plug in or tap. Both protect you from fake sites. Read passkeys.
- An authenticator app. This is an app on your phone. It shows a new short code every so often. It does not use the phone network, so it also works without a signal. Read authenticator apps.
Not every service offers these. Use the best one that the service has.
How to switch safely
Follow these steps in this order.
- Add the new method first. Keep the text code for now.
- Test it. Sign out, then sign in with the new method.
- Save your backup codes in a safe place. These are one-time codes for when you lose your phone.
- Remove text messages only if the service lets you. Some do not.
Never remove your only method. If you do, you could lose access to your account.
If a service only offers text messages
Some services only offer text codes. Keep using them. It is better than nothing. Then protect your phone number:
- Ask your phone company to add a PIN or a lock on your account. A PIN is a number only you know. The steps are in SIM swapping.
- Do not share a code with anyone.
- Use a strong, unique password for that account.
What a scam text can look like
Scammers may text you a code you did not ask for. They may call you and say they are from your bank. Then they ask you to read the code to them.
Do not do this. Anyone who contacts you and asks for your verification code is a scammer. Google says it will not call you to check a code. A real company will not ask you to read a code out to someone who called or messaged you. Never read a code to someone who contacted you first.
If this happens, hang up and stop replying. Call the company on a number from its real website, your statement or its app.
To report a scam text, forward it to 7726 (SPAM). Most phone companies in the US and the UK accept this. If it does not work, ask your phone company how to report scam texts. In the US, you can also report scams at reportfraud.ftc.gov. If you lost money or were hacked, in England, Wales and Northern Ireland use Report Fraud (formerly Action Fraud) at reportfraud.police.uk. In Scotland, call Police Scotland on 101.
Your email account is the main way into your other accounts, so protect it first. Read secure your email. To learn the basics of 2FA, read two-factor authentication.
Do this today (about 8 minutes)
- Open the security settings of your main email account.
- Add a passkey or an authenticator app as a second step.
- Test it. Sign out, then sign in again with the new method.
- Save your backup codes in a safe place.
- If the service allows it, remove text-message codes.
Never type a code or password into this website, and never read a code out to someone who contacts you.
Checked: 25 Oct 2026. Settings screens change. If yours looks different, search the company's help page.
