Why You Should Stop Using Two-Step Verification via SMS

It’s super easy to fall into the trap of feeling safe because the online service you’re using utilizes a second layer of identity verification known as two-step verification. This involves either an SMS message sent to your phone number through the carrier network, or a one-time code generated by an app such as Google Authenticator or Authy.

In theory the two-step verification system protects users when shopping online or when logging in to an account from a new device or new location. The reality, however, looks very different. This process builds on a flawed system that provides hackers with a backdoor through which they can access user data: intercept SMS messages, eavesdrop on your phone calls, and track your location.

SIM swap fraud

According to the U.S. Fair Trade Commission (FTC), phone account hijacking, known as SIM swap fraud, is rising: while in January 2013 there were only 1,038 reported incidents, that grew to 2,658 such incidents in January 2016, representing 6.3% of all identity thefts reported to the FTC that month. SIM swap can be done in various ways, even remotely by deploying SIM malware, or by calling the telecommunication companies’ customer service and hijacking a mobile phone account in the victim’s name.

How to protect yourself against the SS7 flaw and identity theft

If you’re now thinking it’s a good time to change your passwords and stop using the two-step verification method, you’d be right. That extra layer of security can be counterbalanced with a strong (more than 12-character-long) password, using our password recipe. However, changing the passwords to more secure ones usually requires additional effort from the brain to remember them, so it’s easier to use a password manager.In addition, you should make use of the extra layer of security that carriers provide. AT&T and T-Mobile, for example, have a feature requiring users to provide a passcode for any online or phone interactions with a customer rep. Sprint and Verizon users can set a PIN and choose security questions when setting up the service. As always, change your passwords at least as often as the password manager of choice suggests.