Why do online services still rely on phone numbers for verification?

The code is also time-limited and usually only useful alongside another credential, such as a password. So an attacker generally needs both the account password and temporary access to the phone number. That combination is not foolproof, but it blocks a lot of low-effort attacks.

A phone number is mainly proof that you can currently receive messages or calls at that number. Spoofing the caller ID or the number shown as the sender doesn’t normally give someone the ability to receive the verification code. It isn’t perfect security, but it’s more useful than simply trusting a password alone.

Convenience is a huge factor. Nearly everyone understands how to enter a phone number and type in a code from a text message. Authenticator apps and security keys are generally stronger, but they require more setup and can create support problems when users lose access or make a mistake.

Businesses choose authentication methods based on the level of risk they’re trying to manage. Taking over someone’s number can require convincing a carrier to transfer it, intercepting messages, or gaining access to the phone itself. That’s not impossible, but it raises the attacker’s effort enough for many ordinary accounts.

SMS verification does have serious weaknesses, especially SIM-swapping, recycled numbers, and carrier attacks. It shouldn’t be treated as the strongest available option. Passkeys, hardware security keys, and authenticator apps provide better protection, and many companies are gradually encouraging users to adopt them.