For years, business owners were advised:

“Turn on MFA, and you’ll be protected.”

That advice was appropriate then.

However, the threat landscape has evolved. If your company still relies on SMS codes for multi-factor authentication (MFA), you may have a false sense of security.

For construction firms, professional services, and growing businesses in Fort Worth, identity attacks are the top entry point for cybercriminals. SMS-based MFA remains a weak link.

Here’s why and what modern businesses should use instead.

The Problem: SMS MFA Was Never Designed for Security

SMS-based MFA (the 6-digit codes sent to your phone) was designed for convenience, not security.

Although better than passwords alone, SMS MFA has critical weaknesses:

• It relies on outdated telecom infrastructure (SS7)

• Text messages can be intercepted or redirected

• It’s vulnerable to phishing in real time

• It can be defeated through SIM swapping attacks

Attackers are aware of these vulnerabilities.

Real-World Example

A construction firm CFO receives a fake Microsoft 365 login page. They enter:

• Email

• Password

• SMS code

Within seconds, the attacker logs in, having captured all credentials in real time.

This leads to:

• Wire fraud

• Vendor impersonation

• Payroll redirection

• Ransomware

We hear of incidents occurring daily across Texas.

SIM Swapping: A Silent Business Threat

One of the most dangerous threats to SMS MFA is SIM swapping.

Here’s how it works:

1. An attacker gathers publicly available information about you.

2. They call your mobile carrier pretending to be you.

3. They claim they lost their phone and request that your number be transferred.

4. Your phone goes offline.

5. The attacker now receives your calls and SMS MFA codes.

No malware is required.
No sophisticated hacking tools are needed.
Only social engineering tactics are used.

This poses a significant risk to executives, accounting teams, and project managers with access to financial systems.

The Shift: Phishing-Resistant MFA as the New Standard

For effective protection today, phishing-resistant MFA is essential.

These methods:

• Cannot be replayed by attackers

• Are tied to a specific website domain

• Do not rely on SMS

• Cannot be approved accidentally

The gold standard relies on FIDO2 and passkey authentication.

Here are your options.

Modern MFA Options Every Business Should Consider

1. Hardware Security Keys (Highest Security Level)

Physical devices such as YubiKeys that:

• Plug into a USB port or tap via NFC

• Perform a cryptographic handshake with the login service

• Cannot be intercepted over the internet

Benefits:

• Immune to phishing

• Immune to SIM swapping

• No codes to type

• Ideal for executives and administrators.

This should be mandatory for privileged accounts such as owners, controllers, and IT administrators.

2. Authenticator Apps with Number Matching Feature

Examples include:

• Microsoft Authenticator

• Google Authenticator

Generate codes locally on the device, not over SMS.

Modern versions include number matching, which prevents “MFA fatigue” attacks where users are spammed with push notifications until they approve.

This significantly reduces risk compared to SMS-based MFA.

3. Passkeys (The Future of Business Authentication)

Passkeys eliminate the need for passwords entirely.

They utilize:

• Device-based cryptographic keys

• Biometrics (Face ID, fingerprint)

• Secure cloud synchronization

Why this matters for businesses:

• No password resets

• No phishing risk

• Reduced IT support tickets

• Provides a seamless user experience

Microsoft 365, Google Workspace, and many enterprise platforms now support passkeys.

Why This Matters

Most firms are prime targets due to:

• Large wire transfers are common

• Vendor changes happen frequently

• Field teams access cloud systems remotely

• Email compromise leads to payment fraud

SMS MFA is insufficient to protect:

• Microsoft 365

• Accounting systems

• Project management software

• Banking portals

If your authentication is vulnerable to social engineering, your financial controls are at risk.

A Practical Roadmap to Upgrading Your MFA

We recommend Fort Worth businesses approach this as follows:

Step 1: Identify High-Risk Accounts

• Owners

• Executives

• Accounting

• IT admins

• Anyone with wire transfer access

Step 2: Eliminate SMS MFA for Privileged Users

Replace SMS authentication immediately with:

• Hardware keys, or

• Authenticator apps with number matching

Step 3: Enable Phishing-Resistant Policies in Microsoft 365

• Disable legacy authentication

• Require compliant devices

• Enforce conditional access policies

Step 4: Train Your Team Effectively

Explain:

• What SIM swapping is

• How phishing works

• Why approvals should never be rushed

Security is effective only when users understand the reasons behind changes.

The Cost of Doing Nothing

Many companies retain SMS MFA because:

• “It’s already enabled.”

• “It checks the compliance box.”

• “We’ve never had a breach.”

However, the reality is:

The average business email compromise (BEC) attack costs six figures.

The cost of upgrading authentication is minimal compared to the expense of a single fraudulent wire transfer.

Upgrading identity security offers one of the highest returns on investment in cybersecurity.

FAQ

Is SMS MFA better than no MFA?

Yes, but it is no longer sufficient to protect financial or administrative accounts.

What is phishing-resistant MFA?

Authentication that cannot be intercepted, replayed, or accidentally approved, typically using hardware keys or passkeys.

Are passkeys secure for businesses?

Yes. They rely on public-key cryptography and are currently among the strongest authentication methods available.

Inman Technologies Call to Action

Ready to Remove SMS MFA from Your Business?

If you still use text-message codes to protect Microsoft 365, banking, or project management systems, now is the time to upgrade.

At Inman Technologies, we help Fort Worth construction companies and growing businesses implement:

• Phishing-resistant MFA

• Secure Microsoft 365 configurations

• Conditional access policies

• Executive-level identity protection

• Ongoing cybersecurity monitoring

Do not wait until a SIM swap or phishing attack compromises your financial systems.

Schedule a Security Consultation Today

Your authentication system is your front door. Let’s make sure it’s locked properly.