The Hidden Risks of SMS-Based Multi-Factor Authentication by Lucie Cardiet

**Executive summary:** This blog explains why SMS-based two-factor authentication is no longer a defensible enterprise control, demonstrates real-world failures (phone number recycling and account takeover), and details attacker playbooks—SIM swapping, social engineering, and mass-number exploitation—used by groups such as Scattered Spider to bypass MFA, escalate privileges, establish persistence in cloud environments, and exfiltrate or monetize access; it recommends replacing SMS MFA with phishing-resistant methods (FIDO2/passkeys/security keys) and continuous identity monitoring.