“SMS isn't a secure message service, right? It's a short message service. … We had an employee who lent his phone in a club for someone to make a call. Next morning, he woke up and found his bank account had been removed from his phone, and his whole account had been reset, because they just sent a password reset via SMS to his phone and that was it. SMS definitely improves security, but it's not the panacea by any stretch of the imagination.”
The Modern .NET Show · Hands-On Engineering Podcasts · November 2026
Context
The host had just said to stop sending one-time codes by email. Andy goes further, saying SMS codes are also weak, and tells a story about a colleague whose bank account was reset after he lent someone his phone.
Transcript
…a solution that is solid and robust. And hopefully our customers don't have to worry about it because we're there every three months doing the maintenance, checking everything skewed and solid and all the packages are updated and there's no back door. So yeah, it's super important, I think. Yeah.
…If I send an email from me to Andy, it needs to go through a bunch of servers. In order to get through those servers, the server has to read the entire email contents to be able to send it to the right place. It is not secure. Stop sending things that are like one-time codes through email, please.
I think it goes further than that. I think, you know, SMS is not secure message service, right? It's short message service. But, you know, and all the telcos hate the fact that all the banks have leveraged it, right? And again, trying to educate a lot of our customers to say, like, you know, SMS is super convenient, right? Pretty much every demographic in the UK, irrespective of age, understands SMS. Trying to get them to understand passkeys is a little bit more harder, but SMS isn't secure, right? And then we had an employee that lent his phone in a club for someone to make a call next morning, woke up and found that his bank account had been removed from these phone and he's had his whole account reset because they just sent a password reset via SMS on his phone and that was it. And they overdraft set and they cleared him out. And yeah, SMS is another terrible thing that, you know, it definitely improves security, but it's not the panacea by your search and imagination. Oh,
yeah, absolutely. And this has quickly turned into how to phish people. But like, you don't even need to go that far. You don't need to be in a club and hand someone your phone to let them do something on it. If I know enough information about you, I can call your phone provider and have a new SIM…
Oh, 100%. Yeah. I dropped the
SIM into my phone and then suddenly your SMS one-time passwords come to my device, not yours.
More from The Modern .NET Show
