Note
An app code beats a text-message code because it can’t be taken by stealing your phone number: the app makes the code on your iPhone, while a text travels through your carrier to whoever controls your number. It can still be tricked out of you by a fake website, so type it only into a site you opened yourself.
Most accounts that offer two-step sign-in let you choose: get a code by text message, or get one from an authenticator app. They look the same, six digits, but they protect you very differently.
Here’s how they get in. A text message goes to your phone number, not your phone. In a SIM swap, someone convinces your carrier to move your number to a SIM card they control, often with a few personal details found online. From that moment, your codes go to them, and they can reset your passwords one by one. You usually notice only when your own phone suddenly says ‘No service’. The Canadian Anti-Fraud Centre describes the same fraud on its SIM card swap page (opens in a new tab).
An authenticator app works differently. The code is calculated on your iPhone from a secret that was set up once, when you scanned the QR code. Nothing is sent over the phone network, so there’s no number to steal.
It isn’t magic. If a fake website tricks you into typing the code, an attacker can use it within the next few seconds. So the second rule matters just as much: only type a code into a site you opened yourself, never one you reached from a text or email link.
Fix it in 30 seconds:
- Open the security settings of your email account first. Your email is the key that resets everything else.
- Choose ‘authenticator app’ instead of ‘text message’ for two-step sign-in, and scan the QR code.
- Save the backup codes the site gives you, somewhere safe and offline.
- Once the app works, remove the phone-number option if the site allows it.
- Ask your carrier for a port-out PIN or SIM lock, so your number can’t be moved without it.
Then do the same for your bank, your Apple Account and anything that holds money or photos.
Related guides: which apps and websites work with an authenticator app, and how to lock or hide any app on your iPhone.
MELKEM Authenticator (opens in a new tab), our offline code app for iPhone, is now on the App Store.
MELKEM INC. builds private, encrypted software in Ontario, Canada.
