In this guide 6 sections
Use security keys for administrators, authenticator apps for most staff and SMS codes only where nothing else works. Keys resist phishing best. Apps remove SIM swap risk and cost little. SMS is easiest to roll out but the easiest to intercept, so treat it as a fallback.
How each second factor fails
An SMS code travels over the mobile network to a number. Anyone who controls that number, or the message on the lock screen, can read it. Attackers also trick users into typing the code into a fake login page.
An authenticator app generates a time-based code on the phone itself. Nothing crosses the network, but a user can still be talked into typing that code into a look-alike site.
A security key signs a challenge tied to the real website address. A fake page gets nothing. That one property is why keys are the strongest of the three.
SIM swap and phishing exposure
In a SIM swap, a fraudster persuades a carrier or a retail shop to move your number onto their card. Every SMS code then lands on their handset. Staff who post their number on websites are easier targets.
Real-time phishing kits sit between the user and the real login, relaying whatever code is typed. SMS and app codes both fall to this. Push approvals add a different weakness: tired users tap approve.
- SMS: exposed to SIM swap, number porting fraud and relay phishing
- Authenticator app: immune to SIM swap, exposed to relay phishing
- Push approval: exposed to prompt fatigue unless number matching is enforced
- Security key: bound to the site address, so relay phishing fails
What a lost phone or key really costs
A lost phone locks out an app user until someone verifies them and resets enrolment. For SMS, the user keeps the same number on a new SIM, which is why support teams like it.
Keys are cheap to buy but easy to leave in a laptop bag. Issue two per person and register both. The spare lives in a drawer, and one lost key becomes a minor errand.
Count helpdesk time, not hardware. Resets by phone call are where social engineers succeed.
Which factor for which account
Match the factor to what the account can damage. A cloud console admin can delete your company. A warehouse picker can view one screen.
Customers are a separate case. You cannot hand them hardware, so offer app codes or passkeys and keep SMS as a recovery option.
- Administrators: hardware security keys, two registered, no SMS fallback
- Office staff: authenticator app or passkey on a managed laptop
- Field staff: authenticator app, with SMS only where phones lack signal for apps
- Customers: app codes or passkeys, SMS as a last resort
Roll out in this order
Start with the identity provider or admin consoles, because that is where one stolen login does the most harm. Enforce keys there first. Then move email and the code repository, then the business application.
Write the lost-device procedure before launch: who verifies the user, how, and which record proves it was done. Test the reset with a colleague who plays the attacker.
Today, list every account that can create users or export data. Those get keys first.
Second factor decision sheet
Account types run down the left: administrators, office staff, field staff and customers. Columns cover the damage a stolen login could cause, the chosen factor, the fallback, devices registered per person, the lost-device reset owner and the enforcement date.
Open a blank worksheet to printQuestions owners ask
Is SMS two factor better than nothing?
Yes. It stops the common attack where a leaked password is reused. It is weaker than apps or keys, so plan to move sensitive accounts off it.
Do security keys work with phones?
Many keys connect by NFC or USB-C, and phones also act as passkey holders. Check each business application and your identity provider before buying in bulk.
What happens when a staff member leaves?
Disable the account in the identity provider, revoke app enrolments and collect the key. Keep the leaver ticket, since auditors sample those records.
Should we allow backup codes?
Yes, one printed set stored in a locked place. Backup codes beat SMS fallback because they cannot be intercepted by a SIM swap.