Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteUse a passkey or FIDO/WebAuthn security key whenever the account supports one. These methods bind the sign-in to the legitimate website and are the strongest widely available defenses against phishing. If FIDO is unavailable, use a time-based authenticator-app code or number-matched app approval as a practical fallback, then disable SMS sign-in where the account permits it and verify that recovery still works.
The short answer: choose in this order
SMS is better than a password alone, but it is the weakest common second factor because a phone number can be hijacked, redirected or socially engineered. The best replacement depends on what the service supports and how you will recover access if a device is lost.
As an Amazon Associate I earn from qualifying purchases.
| Method | Phishing resistance | Protection from phone-number attacks | What you must manage | Best use |
|---|---|---|---|---|
| Passkey using FIDO/WebAuthn | Strong when the service uses verifier-name binding | Strong; it does not rely on your telephone number | Device or passkey-account recovery, plus compatibility across devices | Default choice for personal, work, cloud and financial accounts that offer it |
| Hardware FIDO security key | Strong phishing-resistant authentication | Strong; independent of the mobile carrier | Keeping the physical key available and having a backup key | High-value accounts, administrators and people targeted by phishing |
| Authenticator-app TOTP code | Not phishing-resistant; a code can be relayed | Better than SMS because it is not delivered through the phone network | App enrollment, device migration and recovery codes | Services that do not yet offer passkeys or security keys |
| Number-matched app push | Not phishing-resistant | Usually better than SMS for account takeover scenarios | Rejecting unexpected prompts and retaining app access | Interim improvement where TOTP or FIDO is unavailable |
| SMS or voice code | Not phishing-resistant | Weakest: exposed to SIM swapping, port-out fraud and interception | Carrier account security and phone-number availability | Last resort when no stronger factor is offered |
CISA’s guidance says, “Businesses should aim to use a phishing-resistant MFA method.” In its December 18, 2024 Mobile Communications Best Practice Guidance, CISA says SMS MFA “is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals.” NIST SP 800-63-4 classifies PSTN-based authentication as restricted and describes WebAuthn as phishing-resistant through verifier-name binding.
Why SMS is the factor to replace
An SMS code is delivered to a telephone number, not bound to the website where you are signing in. An attacker can therefore try to obtain the code through a fake sign-in page, persuade a carrier to move your number to a different SIM, exploit telecom signaling or intercept a message on a compromised phone. Voice calls have the same basic dependency on the telephone network.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
SMS also often remains enabled after you add a stronger method. Enrollment screens commonly present it as a fallback, and recovery flows may continue to offer it even when your normal sign-in uses an authenticator app or passkey. Adding a new factor is not the same as removing the old one: inspect the account’s security settings and test recovery before disabling anything.
Phishing-resistant choices
Passkeys: the easiest strong option when supported
A passkey is a FIDO credential created for a particular service. During sign-in, the authenticator proves possession of the private key without sending a reusable code. WebAuthn uses the authenticated domain name to select the credential, so a fake site at a different domain cannot normally use the passkey created for the real one. This is the verifier-name binding NIST identifies as phishing resistance.
Passkeys can be device-bound or synchronized through an ecosystem’s credential manager. A device-bound credential can be harder to copy but requires a deliberate backup and recovery plan. A synchronized passkey can make multi-device use easier, while recovery depends on the security of the account or device ecosystem that synchronizes it. Read the service’s enrollment and recovery screens rather than assuming every passkey behaves the same way.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Many devices use a fingerprint, face scan or local device PIN to unlock a passkey. That biometric or PIN unlocks the local authenticator; it is not, by itself, a universal replacement for MFA across every service.
Hardware FIDO security keys: strongest separation from the phone
A hardware security key stores or performs the FIDO operation on a separate physical device. CISA names Yubico security keys and Google Titan as examples of this category; the relevant choice is the FIDO standard and the account’s support, not a particular brand. A key can be especially useful for administrators, journalists, public-facing people and anyone whose primary email controls other accounts.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Check the connector and transport before buying or enrolling one. A key may connect through USB-A, USB-C, NFC or Bluetooth, while a particular phone or computer may support only some of those options. Some services support a security key for sign-in but not for every recovery step. Enroll a second key and store it in a separate secure location if the account allows multiple keys.
Useful fallbacks when FIDO is unavailable
Time-based one-time passwords (TOTP)
An authenticator app generates a short code locally, commonly refreshing about every 30 seconds. The code is not sent through the carrier network, so SIM swapping does not directly deliver it to an attacker. It is still an entered one-time password: a phishing site can ask for the current code and relay it to the real service before it expires. Treat TOTP as a meaningful improvement over SMS, not as phishing-resistant authentication.
Protect the enrollment secret and plan migration before replacing a phone. If the app supports encrypted backup, understand where that backup is stored and which account protects it. Otherwise, keep the service’s recovery codes in an encrypted password manager or another location that is available when the phone is not. Do not photograph codes into an unprotected camera roll or store them in an email account that the same factor is meant to protect.
Number-matched push approvals
Push authentication sends a prompt to an enrolled app; you type the number shown on the sign-in screen into the prompt. Number matching is an interim improvement over a simple “Approve” button because it makes accidental approval and push-bombing harder. It does not bind the approval to the genuine domain in the way FIDO does, so an attacker can still operate a convincing phishing session and ask you to enter the displayed number.
Reject every prompt you did not initiate. Repeated unexpected prompts are a warning sign, not a reason to approve one just to make them stop. Report suspicious activity to the service administrator and change the password from a known-clean device if you believe you approved a fraudulent request.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to replace SMS without losing access
- Inventory the accounts that matter most. Start with your primary email, password manager, financial services, cloud storage, work administrator accounts and device ecosystem accounts. These accounts can reset or unlock many others. Continue with social, shopping and other services after the critical accounts are protected.
- Open the account’s security page. Look for labels such as Passkey, Security key, FIDO, WebAuthn, Authenticator app or Two-step verification. Service labels and menu locations differ, so use the account’s own help documentation if the option is not visible.
- Enroll the strongest available factor. Register a passkey or hardware key first. If neither appears, enroll a TOTP app; choose number-matched push when that is the stronger option the service offers. Complete a real sign-in test in a private browser window before changing the fallback.
- Save recovery material. Generate recovery codes if the service provides them and store them offline or in a secured password manager. Where supported, enroll a second security key or a second trusted authenticator. Make sure the backup is accessible when your primary phone, laptop or passkey device is unavailable.
- Review every sign-in and recovery method. Security pages may list separate entries for primary MFA, backup MFA, account recovery, trusted phone numbers and remembered devices. Remove obsolete phones, lost keys and unknown sessions. Do not assume that deleting SMS from the main MFA list removes it from recovery.
- Disable SMS where the account allows it. Remove SMS as a sign-in factor or fallback only after the stronger method and recovery path have been tested. Some services keep SMS in a mandatory recovery flow; describe that as a service limitation and compensate with a carrier account PIN and stronger controls elsewhere.
- Repeat the test after the change. Sign out, authenticate with the new method, use a second device if possible and confirm that a recovery code works. Keep the old method temporarily only when the service requires a transition period, then return to settings and remove it.
Recovery planning is part of MFA security
The strongest factor is unhelpful if losing one phone permanently locks you out. Before removing SMS, answer these questions for each important account:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →- Can you sign in from a second enrolled device?
- Do you have a second hardware key stored separately from the first?
- Where are the recovery codes, and can you reach them without the account you are trying to recover?
- Does the service impose a waiting period, identity check or administrator approval for recovery?
- Will a synchronized passkey still be available if you lose the original device?
Keep recovery codes private and treat them like spare passwords. A person who obtains an unused recovery code may be able to bypass the normal MFA prompt. Revoke codes after suspected exposure and regenerate them when the service permits.
What works on which account?
Compatibility is account-specific. A security key or passkey helps only when the service has implemented the relevant FIDO/WebAuthn flow. A key that works over USB on a desktop may not work with a phone that lacks the required connector or NFC support. A passkey synchronized by one ecosystem may not appear on a device using another ecosystem. Check the service’s supported methods and your device’s connection options before relying on a particular setup.
| Situation | Recommended approach | Important check |
|---|---|---|
| Account offers passkeys | Enroll a passkey, then add a backup passkey or key if available | Understand synchronization and account-recovery behavior |
| Account offers security keys but not passkeys | Enroll two compatible FIDO keys | Confirm connector, NFC or Bluetooth support and administrator policy |
| Account offers TOTP but no FIDO | Use an authenticator app and protect migration and recovery data | Verify clock accuracy and keep recovery codes |
| Account offers number-matched push only | Use it as an interim control and reject unsolicited prompts | Confirm that number matching, not one-tap approval, is enabled |
| Account offers only SMS or voice | Use it only as a last resort | Set a carrier account PIN and watch for unexpected SIM or porting activity |
How to choose for different types of account
Primary email and password manager
Use a passkey or hardware key as the first choice. These accounts can reset other services, so a TOTP code or push approval should be treated as a fallback rather than the final target. Enroll an independent backup factor before removing SMS.
Banking and financial services
Use the strongest method the institution supports and inspect both normal sign-in and transaction-approval settings. Some institutions still require a telephone number for recovery or fraud alerts even when they offer an app or security key for login. Removing SMS from sign-in may therefore be possible while SMS remains part of a separate recovery process.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Work and administrator accounts
Follow the organization’s policy and ask an administrator which FIDO keys, passkeys and recovery procedures are approved. Administrators should prefer phishing-resistant MFA for privileged users and maintain documented break-glass access that is protected and audited rather than relying on a shared SMS number.
Social, shopping and cloud accounts
Use a passkey where offered. Otherwise choose TOTP over SMS, save recovery codes and review active sessions. Protect the email account that receives reset messages before upgrading these lower-priority accounts.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and fixes
“I enrolled an authenticator app, so SMS is gone.”
Usually it is not. Open the security and recovery pages and remove the phone factor where the service permits it. Check remembered devices and account-recovery contacts as separate settings.
“A biometric login is automatically phishing-resistant.”
The biometric often unlocks a local passkey or device authenticator. The security property comes from the FIDO credential and its domain binding, not from the biometric alone. Confirm that the account is actually using passkey or WebAuthn authentication.
Free tools Windows power users keep installed
One-click scans. No signup required.
“My TOTP code was rejected.”
Set the device clock to automatic network time, wait for the next code and try again. If the phone was recently replaced, use the service’s migration or recovery procedure rather than repeatedly entering old codes. Do not disable the only working factor until the replacement is confirmed.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
“The security key is not detected.”
Try the supported connector or NFC path, unlock the device, insert the key directly rather than through an incompatible hub and check whether the browser or operating system supports WebAuthn. If the account requires a particular key type, review its enrollment requirements.
“I keep receiving push prompts.”
Deny every unexpected prompt, change the account password from a trusted device and review active sessions and enrolled authenticators. Contact the service or workplace security team if the prompts continue. Number matching reduces accidental approval but does not make an unsolicited request safe.
“I lost my phone or key.”
Use the backup key, passkey device or recovery code, then revoke the missing authenticator from the account’s security page. Review sessions, change the password if the device might have been unlocked and enroll a replacement before removing the final backup.
Supplementary protections that do not replace strong MFA
A carrier account PIN can make unauthorized number porting harder, but it does not protect against a phishing page that captures an SMS code and it is not a replacement for a passkey or security key. Use unique passwords, a password manager, software updates, device lock screens and account alerts alongside MFA. These controls reduce the consequences of a compromised password or phone, while only a phishing-resistant authenticator directly addresses the fake-login problem.
A practical decision rule
- If the account offers passkeys, enroll one and create a separate recovery path.
- If it offers FIDO security keys, enroll two compatible keys for important accounts.
- If neither is available, use TOTP; choose number-matched push when TOTP is unavailable.
- Use SMS or voice only when no stronger option exists, and protect the telephone account with a carrier PIN.
- After every upgrade, remove SMS where the service allows it and test recovery from a second device or with a stored recovery code.
This order reflects the central distinction: passkeys and hardware keys authenticate the legitimate service, while app codes and push approvals still ask the user to relay or approve something that a phishing site may imitate. NIST’s WebAuthn guidance and CISA’s MFA hierarchy support treating FIDO as the destination and app-based methods as fallbacks.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
