# How do you use SMS for two-factor authentication?

> SMS two-factor authentication (2FA) adds a second check to a login by sending a one-time passcode to the user's phone, which they enter alongside their password. It is the most widely deployed 2FA method because it works on any phone with no app, though for high-assurance flows it is increasingly paired with or replaced by phishing-resistant methods. Deliver it over direct routes with rate limiting and short expiry.

- Canonical URL: https://www.broadnet.me/answers/sms-for-two-factor-authentication
- Language: en
- Last reviewed: 2026-07-22
- Publisher: BroadNet (https://www.broadnet.me)

## How it fits into 2FA

2FA combines something you know (password) with something you have (the phone receiving the code). SMS delivers that second factor with universal reach and no app. See /answers/what-is-2fa and /answers/what-is-otp.

## Deliver it reliably

A 2FA code has value only if it arrives quickly. Send over direct, high-priority routes, monitor DLRs, and configure a fallback channel so a delayed SMS does not block the login. See /answers/best-channel-for-otp and /answers/sms-fallback-strategy.

## Defend against abuse

Rate-limit code requests per number and per IP to resist SMS pumping, expire codes in minutes, and allow one use only. See /answers/sms-otp-best-practices and /answers/what-is-sms-pumping.

## Know its limits

SMS 2FA is far better than a password alone, but it is not phishing-resistant on its own; for the highest-assurance accounts, layer it with or move primary login to passkeys, keeping SMS for recovery and reach. See /answers/what-is-silent-network-auth.

## Related

- [All answers](https://www.broadnet.me/answers)
- [Glossary](https://www.broadnet.me/answers)
- [What is 2FA (two-factor authentication)?](https://www.broadnet.me/answers/what-is-2fa)
- [What is OTP?](https://www.broadnet.me/answers/what-is-otp)
- [What are SMS OTP best practices?](https://www.broadnet.me/answers/sms-otp-best-practices)
- [What is the best channel for OTP delivery?](https://www.broadnet.me/answers/best-channel-for-otp)
- [OTP service](https://www.broadnet.me/products/otp)
- [MyOTP](https://www.broadnet.me/products/myotp)