iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Use a passkey or FIDO security key whenever the account supports one. These WebAuthn methods are designed to resist phishing because the credential is bound to the legitimate service. If FIDO is unavailable, use a time-based authenticator-app code or number-matched app prompt as a practical improvement over SMS, then disable SMS sign-in or fallback where the account permits it.
The safest migration starts with your primary email, financial services, work identity, cloud storage and other accounts whose compromise would expose additional accounts. Plan recovery before removing SMS: save recovery codes securely, enroll a second key or device when allowed, and test the new method on a separate sign-in before changing the old one.
Best alternatives at a glance
The right replacement depends on what each service implements. No single method works on every account, and a stronger factor does not automatically remove SMS from recovery or fallback flows.
Recommended Free Tools
| Method | Phishing protection | Protection from phone-number attacks | Best use | Main trade-off |
|---|---|---|---|---|
| Passkey (FIDO/WebAuthn) | Phishing-resistant when the service uses verifier-name binding | Not dependent on an SMS-capable number | Primary sign-in on supported personal, work and cloud accounts | Device, ecosystem and recovery behavior varies; credentials may be device-bound or syncable |
| Hardware FIDO security key | Strong phishing-resistant option | Independent of SIM and carrier interception | High-value accounts, administrators and people targeted by phishing | You must carry and protect the physical key and verify port, NFC or Bluetooth support |
| Authenticator-app TOTP code | Better than SMS, but the typed code can still be relayed by a phishing site | Avoids SMS interception and SIM swapping | Accounts without passkeys or security-key support | Requires access to the enrolled app and a migration or recovery plan |
| Number-matched app push | Improves basic push, but is not FIDO phishing resistance | Usually avoids SMS delivery | Interim option when an organization offers app approval | Unexpected prompts still require careful rejection |
| SMS or voice code | Not phishing-resistant | Exposed to SIM swapping, port-out fraud and telecom interception | Last resort when no stronger factor is available | May remain enabled as a fallback even after another method is enrolled |
Why SMS is the method to replace
An SMS code proves control of a phone number at that moment; it does not prove that the person entering the code is communicating with the real service. A criminal can persuade a carrier to move the number to another SIM, intercept or redirect messages through telecom attacks, or trick a victim into typing the code into a counterfeit login page. CISA identifies interception and SIM swapping as SMS risks, and NIST classifies public-switched telephone network (PSTN) out-of-band authentication as restricted.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
SMS also lacks a cryptographic connection to the login session or domain. A phishing page can ask for the same six-digit code that the legitimate service just sent, and the attacker can relay it immediately. CISA’s December 18, 2024 Mobile Communications Best Practice Guidance states that “SMS MFA is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals.”
That does not mean every account must eliminate SMS immediately. If it is the only available second factor, leaving it enabled is safer than using a password alone. Treat it as a temporary or last-resort control while looking for a stronger option, and review whether it remains enabled after enrollment.
Passkeys: the best built-in alternative
How a passkey works
A passkey is a FIDO/WebAuthn credential created for a particular service. During registration, the authenticator creates a key pair; the service stores the public key, while the private key remains protected by the device, an authenticator, or an approved synchronization system. At sign-in, the service sends a challenge and the authenticator signs it only for the legitimate domain.
NIST SP 800-63-4 describes WebAuthn as providing phishing resistance through verifier-name binding: the authenticator chooses its secret based on the authenticated domain name. A look-alike site therefore cannot obtain a valid signature for the real service in the way it can collect a typed OTP.
Device-bound and syncable credentials
Some passkeys stay on one device or security module. Others synchronize through an account ecosystem so that an authorized phone, tablet or computer can use them. The service determines which models it supports and how a replacement device is authorized. Before relying on a passkey as your only factor, check how that service handles device loss, synchronization and account recovery.
Biometrics such as a fingerprint or face scan usually unlock the local passkey; they are not automatically an independent, service-wide factor. A device may instead require a local PIN, pattern or hardware interaction. The security benefit comes from the FIDO credential and domain binding, not from treating a biometric as a universal replacement for MFA.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When a passkey is the right choice
- Choose it for accounts that show a passkey, FIDO or WebAuthn enrollment option.
- Use it first on your primary email and identity accounts, because those accounts can often reset other services.
- Keep another recovery path until you have tested sign-in on the devices you actually use.
Hardware FIDO security keys
What makes a security key different
A hardware key is a physical FIDO authenticator. You activate it with a touch, PIN or other local gesture after connecting it to the device. Because the key signs only for the registered service domain, a phishing page cannot simply forward a copied code. CISA’s MFA guidance places physical security keys among the strongest options and names products such as Yubico keys and Google Titan as examples; those examples do not guarantee compatibility with every account.
Check the connection before buying or enrolling
Services and devices may use USB-A, USB-C, NFC or Bluetooth. A key that fits a desktop USB port may not be convenient on a phone, and a service may support only certain FIDO flows. Confirm the account’s supported methods and the reader on each device. If the service permits it, enroll two keys: keep one with you and store the spare in a secure location separate from the first.
Operational trade-offs
- The key is independent of your mobile carrier, so a SIM swap does not transfer it.
- Loss, damage or forgetting the key can block sign-in if no backup or recovery method exists.
- Physical possession matters; do not leave an enrolled key in an unsecured shared computer or lend it to another person.
Authenticator apps when FIDO is unavailable
Time-based one-time passwords (TOTP)
A TOTP authenticator app generates a short code from a secret shared during enrollment. CISA’s explanation notes that such codes may refresh every 30 seconds. The code is not delivered through the phone network, so SMS interception and SIM swapping do not expose it.
TOTP is still an entered one-time password. A phishing site can ask for the current code and relay it to the real service before it expires. For that reason, describe TOTP as a better fallback than SMS, not as phishing-resistant MFA.
Enrollment usually displays a QR code or setup secret. Store the service’s recovery codes before replacing a phone, and use the app’s supported migration or export process when moving devices. Do not photograph setup secrets into an unprotected photo library, and do not keep recovery codes in the same unlocked device that generates the codes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Number-matched app prompts
Some services send an approval request to an authenticator app and display a number on the login screen. You must enter or select the matching number in the app instead of approving a bare “Yes” prompt. CISA presents number matching as an interim improvement over basic push because it helps counter push-bombing and accidental approvals.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Number matching does not create WebAuthn’s domain binding. An attacker can still try to persuade you to approve a fraudulent login, so reject every prompt you did not initiate and report repeated unexpected requests to your organization or service provider.
How to choose for each account
Use the strongest option the account genuinely supports, then evaluate recovery and daily usability. The following order avoids choosing a method that looks strong on paper but cannot be used when you need it.
- Look for FIDO support. In the account’s security settings, search for labels such as passkey, security key, FIDO2 or WebAuthn. If present, enroll a passkey or hardware key.
- Check your devices. Confirm that your phone, computer and browser can use the chosen credential and that a hardware key has the required USB, NFC or Bluetooth connection.
- Assess account value. Prioritize email, financial, work-administration, cloud-storage and password-manager accounts before lower-impact services.
- Plan recovery. Identify recovery codes, a second key, another enrolled device or the service’s documented recovery process. Select only a method you can reach if your main phone is lost.
- Use TOTP or number-matched push if FIDO is absent. Prefer TOTP when an app is available; use number matching instead of undifferentiated push approvals when that is the organization’s supported choice.
- Leave SMS only when necessary. If no stronger method exists, retain SMS rather than dropping to password-only access, but treat the account as a candidate for future upgrade.
Step-by-step migration from SMS
1. Inventory the accounts that matter
Make a list of accounts protected by your phone number. Start with the email address used for password resets, then add financial services, work and school identities, cloud storage, social accounts, shopping accounts and any service that stores sensitive information. CISA’s mobile guidance specifically calls out valuable Microsoft, Apple and Google accounts as priorities.
Free tools Windows power users keep installed
One-click scans. No signup required.
2. Open the account’s security settings
Sign in through the service’s normal website or app, not through a link in an unexpected message. Open Security, Sign-in and security or the equivalent page. Look for passkey, security-key, FIDO, WebAuthn, authenticator-app and recovery-code controls. Terminology and available choices differ by service.
3. Enroll the strongest available factor
- For a passkey, choose Add passkey and complete the device’s local unlock step.
- For a hardware key, choose Add security key, connect the key, follow the browser prompt and touch or unlock it when requested.
- For TOTP, choose Authenticator app, scan the QR code with the app, enter the current code and save the resulting recovery codes.
- For number-matched push, install or open the organization’s authenticator app, complete registration and verify that the displayed number must match before approval.
4. Test before removing anything
Sign out and sign back in using the new method. Test from a private browser window or a second device if practical, and confirm that you can complete the local unlock step without relying on the old SMS. Do not delete the authenticator app, erase the passkey device or discard the hardware key until this test succeeds.
5. Disable SMS sign-in and fallback where possible
Return to the same security page and inspect every method, not just the primary-factor selector. Some services leave SMS enabled as a fallback after authenticator enrollment. Turn off SMS as a login factor when the service offers that control, while retaining a recovery method you can actually access. Certain recovery workflows may continue to use SMS; that behavior is account-specific and cannot be assumed away.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Protect the phone number separately
Add a carrier account PIN or equivalent port-out protection. This can make unauthorized number transfers harder, but it is supplementary: it does not turn SMS into phishing-resistant MFA and does not replace a passkey or security key.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Recovery planning and lost-device scenarios
Store recovery codes securely
Recovery codes are usually one-time credentials. Generate a fresh set after changing factors, store them in a protected password manager or offline location, and mark each used code so you do not rely on it twice. Anyone who obtains an unused code may be able to bypass the normal second factor, so do not leave a plain-text copy in a shared drive or an unlocked notes app.
Enroll a second authenticator where allowed
A spare hardware key or an additional passkey on a trusted device can prevent a lost phone from becoming an account lockout. The service may limit how many credentials you can add or require an existing factor to authorize the new one. Add and test the backup while you still have access to the original.
If the phone or key is lost
- Use the enrolled backup key, passkey or recovery code to sign in.
- Revoke the lost credential from the account’s security page.
- Change the account password if the lost device could unlock the authenticator or contain recovery material.
- For a lost phone, contact the carrier and secure the mobile account; for a lost hardware key, remove its registration rather than assuming possession is harmless.
Service recovery procedures vary. Some providers require identity checks or a waiting period, and some may still offer SMS recovery. Read the account’s documented process before you disable your last reachable method.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Common mistakes and how to fix them
Enrolling a stronger factor but leaving SMS as the easiest route
Symptom: The account shows a passkey or authenticator app, but an attacker can still choose “text me a code.” Fix: Inspect backup and fallback settings separately and disable SMS sign-in where the service allows it. Keep only a recovery route that you have deliberately secured.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAssuming every passkey works everywhere
Symptom: A passkey created on one service cannot be selected on another, or a key is rejected by a device. Fix: Verify that the account supports the relevant FIDO/WebAuthn flow and that the browser, operating system and hardware connection meet its requirements. Compatibility is service- and device-specific.
Best Value
- The information below is per-pack only
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
Calling TOTP or push phishing-resistant
Symptom: A user enters an authenticator code into a page reached from an unsolicited message or approves an unexpected prompt. Fix: Navigate to the service directly, check the domain, never disclose a current code to a caller or chat participant, and reject unrequested prompts. Use a passkey or security key when the account supports one.
Removing SMS before recovery works
Symptom: A broken phone or deleted app leaves no way to sign in. Fix: Re-enroll the authenticator or backup key while the old factor still works, save recovery codes, and perform a second-device sign-in test before disabling anything.
Treating a biometric as the whole MFA strategy
Symptom: A fingerprint or face scan is assumed to protect every account independently. Fix: Identify what the biometric unlocks. In many implementations it unlocks a local passkey or device authenticator; the account’s actual second-factor security comes from that credential and its enrollment controls.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to expect from services that support only SMS
Some legacy or low-risk services offer no passkey, security-key or authenticator-app option. In that case, keep a unique password and SMS rather than removing the only second factor. Ask the provider whether an authenticator app, recovery codes or security key is on its roadmap, and revisit the setting periodically.
For an account that supports TOTP but not FIDO, move to the app and disable SMS if possible. For an account with number-matched push, use the matching-number workflow and train every authorized user to deny unexpected requests. Neither choice has WebAuthn’s verifier binding, so continue treating links, codes and prompts as phishing targets.
Official guidance in context
CISA’s small-business MFA guidance says, “Businesses should aim to use a phishing-resistant MFA method.” That hierarchy places FIDO security keys at the strongest end, with app-based methods serving as improvements when phishing-resistant options are unavailable. CISA’s live guidance can change, so account owners should check the current security controls offered by each provider.
NIST SP 800-63-4 is a standards publication rather than a promise that every consumer service implements WebAuthn identically. Its verifier-name-binding explanation describes why FIDO credentials can resist phishing; the service still controls enrollment, synchronization, fallback and recovery. The practical result is to select FIDO where it is supported, use an authenticator app when it is not, and verify the account’s real recovery behavior before turning off SMS.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
