Convenient SMS Logins Leave Accounts Vulnerable

Online services increasingly rely on SMS sign-in links for easier account access, bypassing traditional passwords. However, this convenience comes at a significant security cost. SMS messages are transmitted unencrypted, making them vulnerable to interception and exposure.

A recent technical review examined millions of SMS messages linked to hundreds of digital services. It found that authentication systems treating SMS-delivered URLs as sufficient proof of identity allow unauthorized access to private user information. Some services also used weak tokens, enabling attackers to guess valid links and access accounts.

Furthermore, the review noted that some links remained active for extended periods, increasing the risk window. Mismatches in data requests also led to overfetching personal information. Despite contact from researchers, most providers failed to acknowledge or fix these widespread weaknesses, leaving millions of users exposed.