Glossary Term

SMS Authentication

More About Plurilock


White Paper: Advanced Authentication

The state of authentication today—and why you need Plurilock products.

Plurilock Quad Chart

Quick, visual summaries of Plurilock value, use cases, architecture, and typical clients.

2019 Authentication Guide

Summary of authentication recommendations from major standards bodies, plus Plurilock’s own recommendations.

Behavioral Biometrics Guide

The definitive guide to behavioral biometrics, a core Plurilock technology.

SMS Authentication is a kind of identity proof often used for two-factor authentication (2FA) or multi-factor authentication (MFA). In SMS authentication, the user provides a code that has sent to their phone via SMS as proof of their identity.¶In theory, SMS authentication provides a second identity factor. While usernames and passwords represent something that only the right user knows, an SMS code delivered to a particular mobile device is evidence of the possession of something (a particular mobile phone) that only the right user should have.¶In practice, however, SMS authentication is a poor avenue for this identity factor because the world's SMS systems themselves are tremendously insecure, having been designed and deployed decades ago when cybersecurity was in its infancy and often not considered at all.¶SMS infrastructure is often authentication-free, stores, transmits, and receives data in plain text making it susceptible to interception and eavesdropping, and relies on phone numbers that are themselves generally unsecured and easy to steal, spoof, or port.¶For these reasons, most experts do not recommend heavy reliance on SMS codes as an authentication factor, though the ubiquity of mobile phones and users' familiarity with them has led many organizations to deploy SMS authentication anyway as the path of least resistance to 2FA or MFA compliance.

Stay informed. Join our low-volume list for news and updates.


Plurilock is the leader in advanced, risk-based authentication. We provide invisible, device-free MFA for corporate endpoints, Citrix sessions, cloud applications, and their users in finance, healthcare, education, and SaaS.



Contact Plurilock

Have a question or comment?