We recommend MFA on every account that supports it, and it remains one of the highest-leverage security controls available. But "we have MFA" isn’t a single answer, because the different methods have meaningfully different security properties — something that gets glossed over in a lot of general security advice.
SMS: better than nothing, but the weakest link
Text-message codes can be intercepted through SIM-swapping — an attacker convincing a mobile carrier to move your number to a device they control — or through SS7 network vulnerabilities in some cases. It’s also phishable: a fake login page can prompt for the code the same way it prompts for a password, and relay it in real time to the real site.
Authenticator apps: a meaningful step up
App-based time-based codes (Google Authenticator, Microsoft Authenticator, and similar) aren’t interceptable over the phone network, which removes the SIM-swap risk entirely. They’re still phishable in theory through a real-time relay attack, but that requires more sophistication than SMS interception does.
Hardware security keys: the strongest option
Physical keys (YubiKey and similar, using the FIDO2/WebAuthn standard) are cryptographically bound to the specific site being logged into, which makes them effectively immune to the phishing-relay attack that can catch app-based codes. For admin accounts, financial platforms, and anyone with elevated access, this is what we recommend as the default, not the exception.
Where we land on this for clients
For general staff accounts, an authenticator app is a solid, practical baseline. For anything with elevated privilege — domain admin, financial system access, your identity provider itself — we push for hardware keys specifically, because those are the accounts where a compromise does the most damage. SMS is what we tell clients to move away from, not what we set up as the default going forward.