Is Two-Factor Authentication Still Worth It if It Uses SMS?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

Why is SMS a weak second factor in the Indian context?

Four reasons, all specific to how Indian fraud actually works. SIM porting, where a social engineering call to the operator moves the number to an attacker device, which then receives the code. Message interception, which historically required malware on the device and now includes apps that read notifications. OTP relay, where the customer is asked to read the code aloud to a fake agent, which no technical control stops but a better script and a policy do. And voice cloning, which the I4C flagged in June 2026 when it warned that deepfakes defeat facial authentication and video-based KYC. A second factor is only as strong as the channel it arrives on, and in India the phone number is the least protected channel most people own.

What is the right order of priority for a business deploying MFA?

Four stages, and the order matters because each stage removes more risk per rupee. Stage one, MFA on remote access, privileged accounts, email, cloud consoles and code signing, because those credentials are the ones that reach everything else; this is where a hardware security key or a passkey earns its cost. Stage two, MFA on customer and staff logins to internal applications, using an authenticator app at minimum. Stage three, phishing-resistant factors for the finance team, the administrators and anyone who can move money, because that is where the documented Indian losses are, such as the Rs 10 crore voice-cloned MD case. Stage four, removal of SMS as an authentication method for anything above low risk, and removal of shared accounts entirely, because a shared account cannot have a second factor at all.

Where do MFA programmes usually fail?

At enrolment and recovery, which is where the real breach is. If a support desk can disable MFA on an account after a phone call with a persuasive caller, the second factor is decorative, and Indian fraud in 2026 is heavily voice-based for exactly that reason. The controls that fix it: recovery requires a stronger factor than the one being recovered, such as a passkey or a security key plus a callback to a number on file. MFA removal or downgrade requires a named approver and produces a log entry. Enrolment of a new device is alerted to the account owner out of band, immediately. Suspicious activity triggers a step-up, not a silent bypass. And every one of these events is logged and retained for 180 days, as CERT-In requires, because the audit trail is what proves the control held.

What does the law and the regulator expect?

Section 43 of the Information Technology Act, 2000 makes unauthorised access to a computer, computer system or computer network an offence, so a defeated authentication step that is exploited becomes a criminal matter rather than a support ticket. CERT-In's directions require 6-hour reporting of listed incidents and 180 days of log retention, and the authentication logs are usually the first evidence set an investigator asks for. Banks in India operate under RBI's cyber security framework, which expects strong authentication for internet banking, and insurers increasingly expect evidence of phishing-resistant MFA at renewal. In short, MFA is moving from a best practice to a documented, evidenced control, and a business that cannot evidence it will find it reflected in premiums and in audit findings.

What are the common questions about T?