Adding multi-factor authentication to your accounts is one of the most effective things a business can do to reduce account takeover risk. The ACSC Essential Eight lists MFA as a baseline control for good reason — it stops the vast majority of credential-based attacks.
But not all MFA is equal. If your second factor is an SMS code, you have meaningful protection — but there are real attack techniques that bypass it. For high-value accounts, that's a problem worth understanding.
Why SMS is weak as a second factor
SMS codes are vulnerable to several attack vectors:
SIM swapping — An attacker contacts your mobile carrier, impersonates you, and convinces them to transfer your number to a SIM they control. All SMS messages — including your MFA codes — are then delivered to the attacker. This attack is more common than most people expect and has been used to compromise banking, email, and cryptocurrency accounts.
SS7 protocol vulnerabilities — The Signalling System 7 protocol underpins global mobile networks and has known security weaknesses that allow interception of SMS messages. This is a sophisticated attack, but it's within reach of well-resourced threat actors.
Real-time phishing proxies — Tools like Evilginx2 and Modlishka act as transparent proxies between the victim and the real site. The victim enters their credentials and their SMS code on a fake page; the attacker captures both and uses them in real time, before the code expires. These toolkits are openly available and require no specialist skills to operate.
Malware on the device — If the same phone receiving SMS codes has malware installed, the code can be captured before the user even sees it.
SIM swapping in NZ and Australia
SIM swap fraud has been reported in both NZ and Australia, including cases involving bank account takeover where SMS-based authentication was bypassed. The ACSC's 2023 Cyber Threat Report notes that identity fraud — including SIM swapping — is an increasing concern.
What to use instead
Authenticator apps (TOTP) — Time-based one-time passwords generated by apps like Google Authenticator, Microsoft Authenticator, or Authy. The code is generated locally on the device and never sent over SMS, removing the SIM swap and SS7 risk. This is the minimum upgrade from SMS for most business accounts.
Push notifications with number matching — Apps like Microsoft Authenticator support push notifications where the user must match a number shown on the login screen to one shown in the app. This defeats real-time phishing proxies because the attacker can't replicate the number matching challenge.
Hardware security keys (FIDO2 / passkeys) — Physical keys like YubiKey provide the strongest protection. They're phishing-resistant by design — the key cryptographically verifies the domain it's authenticating to, so a fake login page gets nothing. For privileged accounts (admin access, financial systems, email), this is the gold standard.
Which accounts to prioritise
You don't need to immediately move every employee off SMS. Start with your highest-risk accounts:
- Email (especially Microsoft 365 / Google Workspace) — email account compromise enables password reset on almost everything else
- Financial systems and banking
- Admin and privileged access to your IT infrastructure
- Any account with access to customer data
Practical steps
- Audit which accounts in your business currently use SMS MFA
- Move email and financial accounts to authenticator apps immediately
- Enable number matching on Microsoft Authenticator if you're on M365
- Evaluate hardware keys for admin and privileged accounts
- Update your acceptable use policy to specify minimum MFA requirements by account type
- Include MFA configuration in your onboarding checklist
CERT NZ's guidance on MFA is worth bookmarking as a reference for staff.
Getting your team configured
SecureAZ training covers MFA setup, why it matters, and how to recognise MFA bypass attempts like push bombing. If you're rolling out an upgrade from SMS to authenticator apps, pairing the technical rollout with training significantly reduces support calls and resistance. For the broader threat context, see What Is a Security Awareness Program. Start a free account to see the MFA training modules.