How do I disable SMS authentication completely, but leave two-factor authentication enabled?

3 replies
49 views

SMS is not a secure protocol. As long as a text message can be used to authenticate, my account cannot be secure. I use two-factor authentication, and I have already set it up. Sadly, the site still wants to use texting as a fallback option and I do not want that.

TurboTax Free Edition Online

HeatherPLO

Level 14

Often a verification code is provided to the user via text message or automated phone call. Please see this Help Article for more details.

**Say "Thanks" by clicking the thumb icon in a post. **Mark the post that answers your question by clicking on "Mark as Best Answer"

sabinxAuthor

Level 2

Thank you for the response. This is the exact behavior I wish to remove. Signing in with a text message might be okay for a casual games website or social platform, but is grossly inappropriate for websites that collect, store, process, and display extremely sensitive and valuable financial data.

Did you know that SMS Authentication is illegal for banking websites in some countries?

This website does have actual 2FA (code generator app) capability. I had to use it to sign in to write this reply. There is no good reason for me to fall back to text messages. SMS is the weak link in a strong chain; being able to bypass my code generator with a text message is not acceptable security and makes everyone more vulnerable.

eweb

Level 2

Does Intuit care about cybersecurity? No legitimate financial website still forces their users to use SMS text message as an option for 2FA/MFA. This should make the Inuit Chief Information Security Officer (CISO) very queasy.