Short answer: SMS codes are the weakest common form of two-factor authentication because a text message can be redirected to a scammer through a SIM swap, where your phone number is moved to their SIM card. Authenticator apps, security keys and passkeys are stronger, but SMS 2FA is still far safer than a password alone.

Two-factor authentication is one of the single most effective things anyone can do to protect an online account, and turning it on for anything important is genuinely good advice. But not every 2FA method offers the same level of protection, and the most common one — a code sent by text message — happens to be the weakest widely available option.

How much does a second factor help?…