400 Points
If you have the option, you should definitely avoid logins with one-time codes that are sent to you via SMS. These can easily be intercepted and also reveal which services you use.

More information

A cell phone number is not really a good second factor for securing logins. You could potentially lose your number and therefore access to your accounts.

However, it is also possible that other people, companies or authorities could gain access to your number. For example, by using your SIM card or having a new one issued.

Attacks on the mobile network are also possible. For example, there are companies that can intercept text messages and forward them to other people simply by using your cell phone number. This "service" is also sometimes offered to private individuals.

If possible, always use so-called Time-Based-One-Time-Passwords as a second factor for logins. You can manage these in free apps such as the Android app Aegis.

Not all offers support this type of second factor. Sometimes they are simply called "authentication app" or similar on the websites. In any case, you will always be asked to scan a QR code with your two-factor app during the initial setup. The time-rotating login code is then available in your app.

Sources and further links

  1. Cell phone espionage with SS7: Thousands of victims were probably spied on, heise.de, (de), 2025-10-15
  2. Two-factor authentication please, but not via SMS, heise.de, (de), 2024-07-10
  3. Aegis Authenticator, aegis, (en)
  4. SIM swap scam, wikipedia.org, (en)