![\"Shocked](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/11\/1763832370_822_0x0.jpg\")
<\/p>\n<\/p>\n
Do not leave your account at risk.<\/p>\n
getty<\/p>\n
Google warns hackers are actively targeting<\/a> your accounts, looking to steal your security credentials and gain access. Attackers are \u201cintensifying their phishing and credential theft methods,\u201d while infostealer attacks have surged 84% in the last year. That\u2019s why all users are warned to change their account security, to keep out these hackers.<\/p>\n You\u2019ll have seen the warnings to enable two-factor authentication (2FA) at a minimum or better still to add a passkey to all accounts. But that\u2019s not enough. Too many accounts still have SMS-based 2FA, even if passkeys are enabled as well. Beware \u2014 if your account can be unlocked by a password and an SMS, that account is at risk. Period.<\/p>\n ForbesOne Click Reveals If Your iPhone Or Android Is Secretly TrackedBy Zak Doffman<\/a><\/p>\n 1Password<\/a> warns that \u201cthe longstanding advice to phase out SMS-based MFA has finally become unignorable.\u201d SIM-swapping attacks, malicious texts tricking users into sharing codes, and man-in-the-middle attacks that intercept texts in transit are surging.<\/p>\n Google agrees, warning<\/a> that while \u201cany form of 2-Step Verification adds account security, verification codes sent by texts or calls can be vulnerable to phone number-based hacks.\u201d It warns users must \u201cnever share your verification codes with anyone,\u201d and that \u201cyou won\u2019t receive a call from Google to verify a code.\u201d But it\u2019s not enough.<\/p>\n The NSA<\/a> warns that SMS 2FA \u201cis not recommended” because it is “fairly simple to redirect SMS messaging and defeat the \u2018what you have\u2019 factor.” That means the physical device on which you receive an SMS, while the \u201cwhat you know\u201d factor is a password. But if the 2FA code can be taken, you don\u2019t need to \u201chave\u201d the device after all.<\/p>\n America\u2019s cyber defense agency<\/a> warns users \u201cdo not use SMS as a second factor for authentication. SMS messages are not encrypted \u2014 a threat actor with access to a telecommunication provider\u2019s network who intercepts these messages can read them.\u201d<\/p>\n All these warnings<\/a> have been interpreted as a reason to add passkeys or to use smartphone authenticator apps. But what has been largely missed is the need to remove SMS as a means of 2FA. That doesn\u2019t mean deleting your recovery phone number. But if you have a passkey and an authenticator app, you don\u2019t need SMS 2FA as well.<\/p>\n If you log into your Google Account and select Security from the menu, you\u2019ll see \u201c2-Step Verification\u201d as an option. Check you have a Passkey<\/a> enabled in the first option. And enable both a Google Prompt and Authenticator if you can. <\/p>\n But where is says \u201cPhone Number\u201d to “add phone numbers to get sign-in codes and security alerts,\u201d my advice is to delete your number and leave this disabled. That\u2019s not the same as \u201cRecovery Phone,\u201d which is used \u201cto reach you in case we detect unusual activity in your account or you accidentally get locked out.\u201d<\/p>\n