How to Disable SMS Authentication: Google, Apple ID

If you still get a text message with a six-digit code every time you log into your Google or Apple account, you're using a form of two-factor authentication that the U.S. government now tells people to avoid. Disabling SMS authentication isn't complicated, but each platform hides the setting in a different place, and removing it before you have a replacement in place can risk locking yourself out. Here's where to find the switch on Google and Apple ID, and what to turn on instead.

Why should I disable SMS authentication?

SMS codes travel over the ordinary cell network, not an encrypted connection. In December 2024, the FBI and CISA jointly told Americans to stop using text messages as a second login factor. CISA's own guidance, as quoted in 1Password's breakdown of SMS-based MFA risks, is blunt: "Do not use SMS as a second factor for authentication. SMS messages are not encrypted–a threat actor with access to a telecommunication provider's network who intercepts these messages can read them."

That warning wasn't theoretical. It came on the heels of the Salt Typhoon espionage campaign, in which, as 1Password explains, "bad actors infiltrated multiple telecom companies and accessed call and data logs for an unknown number of victims." Attackers who gained that kind of access to telecom networks could, in theory, intercept the very codes people rely on to prove it's really them logging in.

What is SIM swapping, and what does NIST say about SMS codes?

SIM swapping is the attack where someone convinces a carrier to move your phone number onto a device they control, after which any text message meant for you — including a login code — goes straight to them instead. The telecom-level interception described above is a related but separate problem: an attacker doesn't need to hijack your specific number if they already have access inside the carrier's network.

The National Institute of Standards and Technology, the federal agency that writes the government's digital identity rules, puts phone- and text-based codes into a category it calls "restricted." Its Digital Identity Guidelines FAQ states plainly: "Currently, authenticators leveraging the public switched telephone network, including phone- and Short Message Service (SMS)-based one-time passwords (OTPs) are restricted."

"Restricted" isn't an outright ban, but it comes with conditions: anyone still relying on SMS is expected to offer at least one non-restricted alternative and to tell users about the risks. Even the agency that wrote the standard treats SMS as a fallback, not the main event — the opposite of how most people use it today.

How do I disable SMS 2FA on my account?

Google

Google's help documentation lays out the process for turning off 2-Step Verification on a computer. Open your Google Account, find the 2-Step Verification option in the "Security & sign-in" section (signing in again if prompted), click Turn off, then confirm in the pop-up window that appears — the exact sequence is spelled out on Google's 2-Step Verification help page.

That turns off 2-Step Verification entirely, including SMS codes but also any other second factor you had set up. If you only want to drop the SMS option while keeping a different method active — an authenticator app or passkey — add that method first inside the same 2-Step Verification settings, then remove the phone number as a backup, rather than switching everything off and back on.

Once you've changed your setup, Google's help page flags two cleanup steps so old codes can't be used against you. It tells users to "Destroy all the backup codes that you've saved for signing in to this account," and separately warns that anyone using app passwords tied to the old setup "may get errors when you turn off 2-Step Verification," so those should be revoked too.

Apple ID

Apple ties two-factor authentication to trusted phone numbers and trusted devices rather than offering a single SMS on/off switch. On an iPhone, open Settings, tap your name at the top, then Sign-In & Security > Two-Factor Authentication, where your trusted phone numbers are listed. On the web, sign in at account.apple.com and open the Sign-In & Security section. Before you touch it, confirm another trusted device is still signed into the account — Macworld's walkthrough of Apple ID settings is direct about the risk: "It's simple to remove a trusted number, but you must be sure first that you still have access to other trusted devices for the account. Otherwise, you could lock yourself out," according to Macworld's guide to Apple ID trusted phone numbers.

In practice: open Trusted Phone Numbers, add a second trusted device if you only have one, then remove the SMS-based number from the list. Skip the first step, and removing your only trusted number can cut off your own ability to approve sign-ins.

What should I use instead of SMS for two-factor authentication?

Removing SMS doesn't mean removing two-factor protection — it means swapping it for something CISA rates higher. CISA's assessment, cited by 1Password, holds that "FIDO authentication uses the strongest form of MFA and is effective against MFA bypass techniques," and that "passkeys are an acceptable alternative" for people who aren't using a physical security key.

Two realistic replacements cover most people:

• An authenticator app generates a rotating code on your device instead of sending one over text. It can't be intercepted the way an SMS message can, because it never travels over the phone network.
• A passkey replaces the password-plus-code combination with a cryptographic key stored on your device, often unlocked with your face, fingerprint, or device PIN. For how that mechanism actually works, see Privacy Unpacked's guide to how passkeys work for account security; for the privacy tradeoffs specifically, see whether passkeys offer better privacy.

CISA adds a warning worth repeating: enrolling in an authenticator app isn't the same as disabling SMS. "Just because you've enrolled in an authenticator app doesn't mean you've fully unenrolled from SMS," the guidance notes via 1Password's explainer. "It's important to turn off the functionality entirely to ensure you haven't created a backdoor for attackers." Leaving both methods active side by side defeats the point — an attacker who still controls your phone number can simply use whichever path is weaker.

Checklist for switching away from SMS

Follow these steps in order so you don't lock yourself out partway through:

1. Pick your replacement first — an authenticator app or a passkey — before touching your SMS setting.
2. On Google, open your Google Account, go to the "Security & sign-in" section, and add the new method inside 2-Step Verification settings.
3. On Apple, go to Settings > [your name] > Sign-In & Security > Two-Factor Authentication on your iPhone (or Sign-In & Security at account.apple.com) and confirm a second trusted device is listed before removing a number, as Macworld warns.
4. Remove or replace the SMS-based phone number only after your new method is active and tested.
5. Save new backup codes somewhere safe, and destroy old ones tied to your previous SMS setup — Google's help page recommends this explicitly.
6. Revoke any app passwords generated under the old 2-Step Verification setup, since they can stop working or create gaps once you switch methods.
7. Double-check that two-factor authentication is still turned on overall — the goal is dropping SMS specifically, not removing account protection altogether. If you want to turn off two-factor authentication entirely for some other reason, read Privacy Unpacked's guide on how to disable two-factor authentication entirely first, so you understand the tradeoffs.