SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/sec-sms-codes-phishable

Which sign-in method does CISA list as vulnerable to phishing?

SMS or voice codes.

Start playing free

  1. FIDO security keys
  2. Windows Hello
  3. SMS or voice codes ✔

Why: A code sent by text or voice call can be typed into a fake login page, and the attacker then uses it. It is still better than no MFA, but it is not the strongest choice.

Huh, didn't know that: CISA's fact sheet says SMS codes are also vulnerable to SIM swap attacks.

The dad joke
I'd tell you a joke about phishing, but you'd probably fall for it.
Like this card?
Play the game

References

Answer: SMS or voice codes. A code sent by text or voice call can be typed into a fake login page, and the attacker then uses it. It is still better than no MFA, but it is not the strongest choice.

  1. CISA: Implementing Phishing-Resistant MFA fact sheet www.cisa.gov/sites/default/files/publications/fact-sheet-implementing-phishing-resistant-mfa-508c.pdf
    Vulnerable to phishing, SS7, and SIM swap attacks.
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhich kind of MFA does CISA call the gold standard?Security & PrivacyCISA says the only widely available phishing-resistant sign-in method is what?Security & PrivacyWhat is push bombing, also called MFA fatigue?

That's stuff everyone should know.