SMS codes, authenticator apps, passkeys: which actually stops account takeover

The advice "turn on two-factor authentication" is good and incomplete, and passkeys are why. The three common methods differ in one respect that decides whether they survive a phishing attack.

The distinction that matters

Ask one question of any second factor: can I be tricked into giving it to the wrong site?

• A six-digit SMS code: yes. It is a number, and you can type it anywhere.
• A six-digit authenticator code: yes, for exactly the same reason.
• A passkey or hardware security key: no. The credential is cryptographically bound to the site's domain, and it will not produce a valid response for a different one.

That is the whole hierarchy. Everything else is convenience.

How real-time phishing defeats codes

The attack is not sophisticated. A phishing page sits between you and the real site:

1. You land on a lookalike domain and enter your username and password.
2. The attacker's server immediately submits them to the real site.
3. The real site issues a genuine code to your phone or app.
4. The phishing page asks for the code. You enter it.
5. The attacker submits it within its validity window and receives a session.

Nothing was broken. The code was genuine, and it was used within its lifetime, by someone else. Toolkits that automate this proxying have been widely available for years, which is why security guidance has shifted from "any 2FA" to "phishing-resistant 2FA".

SMS has an additional weakness: SIM swapping, where an attacker persuades or bribes a mobile operator into moving your number to their SIM. That does not require you to make a mistake at all.

Why passkeys cannot be relayed

A passkey is a public–private key pair created for one site. The private key stays on your device or in your password manager; the site stores the public key.

When you sign in, the site sends a challenge. Your device signs it — and the signature includes the origin, the actual domain the browser is talking to. The specification behind this, WebAuthn, makes the browser supply that origin, not the page.

So if you are on a lookalike domain, one of two things happens: your device has no credential for that domain and offers nothing, or the signature it produces names the wrong origin and the real site rejects it. There is no code for you to type into the wrong box, because there is no code.

The security property is not that passkeys are harder to steal. It is that there is nothing to hand over, even if you want to.

Practical ranking

Passkeys or a hardware security key. Use wherever offered — this now includes most major email, cloud and social accounts. Register at least two: a phone and a laptop, or a security key and a backup key. Losing your only passkey is a real risk and the reason people avoid them.

Authenticator app (TOTP). Materially better than SMS: no SIM swap risk, works offline, not visible on a lock screen. Still phishable in real time. Save the recovery codes somewhere physical when you enrol.

SMS. Better than nothing, and for many accounts it is the only option. Where it is the only option, the surrounding hygiene matters more: a strong unique password, and a PIN or port-out lock with your mobile operator.

Email codes. As strong as your email account, which is usually the account you are trying to protect. Treat as SMS-tier at best.

The account to secure first

Your email. It is the recovery path for nearly everything else, so an attacker who takes it can reset the rest at leisure regardless of what those accounts use. Put your strongest factor there, and check its recovery settings — a phone number or backup address quietly added by someone else is a common and easily missed sign of compromise.

Then your password manager, then your mobile operator account, then banking. In that order, because that is the order in which a compromise cascades.

What is two-factor authentication?

Two-factor authentication is a second proof of identity required alongside your password, so a stolen password alone is not enough to reach the account. The security it adds depends entirely on whether that second proof can be handed to the wrong site, which is where the three common methods diverge sharply.

How do the methods compare?

Only one row is clean across all three columns, and the reason is structural rather than a matter of implementation quality: a passkey signs a challenge bound to the site's real domain, so there is no code for you to type into the wrong box.

Which accounts need the strongest factor?

In this order, because this is the order in which a compromise spreads:

1. Email — the recovery path for nearly everything else.
2. Password manager.
3. Your mobile operator account, which is what a SIM swap targets.
4. Banking and payment.

Register at least two passkeys on the first, keep printed recovery codes somewhere physical, and prefer a second passkey over leaving SMS enabled as a backup — a weaker fallback becomes the way in. See digital safety, account takeover and phishing.

What are passkeys?

Passkeys are public–private key pairs created for a single website, where the private half stays on your device and the site stores only the public half. Because the signature they produce includes the real domain the browser is talking to, a lookalike site cannot obtain a usable one.

That is the whole security property, and it is structural rather than a matter of being careful: there is nothing to hand over, even if you want to.

What happens if you lose the device?

• Synced passkeys restore with your platform or password manager account.
• Device-bound passkeys are gone, which is why you register at least 2.
• Printed recovery codes work when no device does — the case people plan for least.

The FIDO Alliance documentation sets out how syncing works across platforms. Register a second passkey on your email before anything else, because email is the recovery path for every other account you own. Passkeys are now offered by most major email, cloud and social accounts, which makes the strongest option also the most available one.

What to do this week

Add a passkey to your email account, then to your password manager. Those 2 accounts are the recovery path for almost everything else, and they are the ones where phishing resistance changes the most.

Then remove SMS as a fallback wherever a second passkey is possible, and store the printed recovery codes somewhere physical. Passkeys are only as strong as what remains enabled behind them.