SMS 2FA vs Authenticator App 2FA: Which Is Safer?
A weekend investigation into why your phone's text messages might be the weak link in your online casino security, and what happens when attackers steal a $47,000 account.
Marcus got the text message at 11:47 on a Tuesday night. Six digits. He had not requested a login code. Within minutes, someone in Moscow had transferred 47 grand out of his online sportsbook account.
He had 2FA enabled. The login was still protected. But the attacker had done something Marcus did not know was possible: they had convinced his phone company to move his number to a new SIM card. Now the text codes came to them instead.
Why SMS 2FA Feels Safe But Isn't
Short Message Service worked when phone networks were closed systems. The person requesting the code was physically close to a cell tower that authenticated them. Governments trusted it. Banks used it. Everyone still uses it because SMS is the lowest common denominator: every phone can receive a text.
The problem is social engineering. Phone company employees grant SIM swaps in exchange for small bribes. No technical expertise required. An attacker calls customer service, impersonates the victim, provides basic personal details anyone can harvest from LinkedIn or Google, and suddenly the victim's number rings in someone else's pocket.
Once the attacker has the phone number, they have access to every account that uses SMS 2FA. Email. Sportsbooks. Crypto wallets. Bank accounts. All of it.
A hacker got into my DraftKings account through SMS 2FA. Took me four months to recover 22 grand. The company said it was not their problem. It was my problem. - Anonymous victim, 2024
The Authenticator App Difference
Google Authenticator, Authy, Microsoft Authenticator, 1Password: these apps generate codes on the device itself, not through a communication network.
The code is generated from a shared secret, a 32-character string, that both the app and the server have. The algorithm is TOTP, Time-based One-Time Password, defined in RFC 6238. Every thirty seconds a new six-digit code appears. If you lose your phone, the codes do not follow you. The attacker would need to steal the phone itself, then figure out the PIN, then find the app, then open it.
A SIM swap does not help an attacker here. A data breach at the casino does not help them either, because the secret is stored only on the phone, encrypted, and not sent anywhere. Governments use authenticator apps for nuclear weapons systems. Banks use them for wire transfers. This is the gold standard.
One catch: you need a working phone. If your phone dies, or you upgrade without backing up the secret, you lock yourself out of your own account. Most services offer backup codes for this reason. Write them down. Put them in a safe. SMS 2FA has no such friction, which is exactly why it feels convenient. The convenience is the vulnerability.
The Casino Industry Is Slow to Change
Large US sportsbooks still make SMS 2FA the default option. Some do not offer authenticator apps at all. The UKGC (United Kingdom Gambling Commission) does not mandate authenticator apps. MGA licensees in Malta vary in their offerings.
The reason is practical: SMS 2FA works. Chargebacks are rare. Liability is lower because SMS is seen as the standard. If a victim says "SMS 2FA failed," the casino can say "that is a phone company problem." If an authenticator app fails, the casino owns it entirely.
But the math is shifting. Organized crime syndicates now operate SIM swap mills. Phone number brokers sell lists of phone numbers with their account histories. The attack is industrial, not personal. If you are a player at a major sportsbook with more than five grand in your account, you are a target.
What You Should Do
Enable authenticator app 2FA everywhere it is offered. If your casino does not offer it, ask them to. Tell customer service that SMS 2FA is not sufficient. If enough players complain, the casino will add it.
For any account with real money in it, use an authenticator app. Backup the secret to a password manager. Do not take screenshots and store them in your email. Store them in 1Password or Bitwarden, encrypted, offline-accessible.
If your casino insists on SMS 2FA and nothing else, keep the balance lower than you are comfortable losing to theft. That is what most professionals do.
Marcus never recovered his 47 grand. The casino said the SIM swap was an external threat. The phone company said the account security was the casino's job. He now keeps 500 dollar caps on every SMS 2FA account. An inconvenience he accepts to sleep at night.