- SMS login links rely on possession alone, leaving private accounts dangerously exposed
- Weak tokens allow attackers to guess valid links and gain access to other users’ accounts
- Unencrypted text messages remain a fragile basis for account authentication
Many online services now rely on log-in links or codes delivered via text messages instead of traditional passwords, reducing steps during account access and avoiding storing password databases that attackers often crack.
Despite its convenience, SMS remains an unencrypted communication channel, making it vulnerable to eavesdropping, reuse, and prolonged exposure.
And now, a new technical review has examined more than 322,000 unique URLs pulled from over 33 million text messages linked to more than 30,000 phone numbers and found the messages linked to at least 177 digital services, including platforms that offer insurance quotes, job postings and personal referrals.
Practical, but at what cost?
Even within a limited observation window using public SMS gateways, the review identified repeated exposure of sensitive user data across hundreds of service endpoints.
The biggest vulnerability involved authentication systems that treated possession of an SMS-delivered URL as sufficient proof of identity.
Anyone given such a link could access private user information without further verification, which often included dates of birth, bank details and credit-related records.
The researchers also observed that 125 services used low-entropy tokens, which made it possible to guess valid links by changing characters.
Some links remained active for months or even years, extending the risk well beyond the initial login attempt.
In addition, inconsistencies between visible interface elements and backend data requests caused unnecessary retrieval of personal information.
The number of affected services is likely underestimated given the narrow visibility provided by public SMS gateways.
SMS traffic runs without encryption, and previous disclosures have shown that stored text messages can remain accessible long after delivery.
Despite these known limits, SMS-based authentication continues to expand due to the perceived convenience and reduced reliance on password storage.
Of about 150 providers contacted during the study, only 18 acknowledged the reported weaknesses, and even fewer implemented corrective actions.
These changes reportedly reduced exposure for tens of millions of users, although most services did not publicly respond.
User-side defenses, such as a firewall, do little to reduce risks created by flawed authentication logic.
Similarly, malware removal tools offer little protection when access requires no more than a valid link.
The findings raise questions about how identity theft protection services assess threats that stem from design choices rather than outright account compromise.
These issues highlight a structural reliance on service providers to patch vulnerabilities that remain largely invisible to affected users.
Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews and opinions in your feeds. Be sure to click the Follow button!
And of course you can too follow TechRadar on TikTok for news, reviews, video unboxings, and get regular updates from us on WhatsApp also.
