The SMS Trap – Why “Everybody Has a Mobile” is a Dangerous Assumption

Banks, government agencies, and online retailers have increasingly turned to SMS codes as the standard for two-factor authentication (2FA). At face value, this looks sensible: text a code, type it in, and you’re confirmed as the legitimate user. It’s painted as the easy, universal solution. But here lies the problem — this whole system rests on a dangerous assumption: that everybody owns a mobile phone.

The truth is that not everyone does. And in building digital services with SMS-only verification, or worse still – requiring a custom mobile “app” to authenticate, institutions are quietly locking millions of people out of essential services.

When “Optional” Becomes Mandatory

There are many reasons why someone may not own a mobile phone, and none of them mean these individuals are careless about security or unworthy of digital access. For example:

• The elderly and house-bound: Many older citizens live comfortably without a mobile. They may not see the need, prefer the simplicity of a landline, or lack the dexterity to use small touchscreen devices. These are also the people most likely to need frequent access to government and healthcare services — services increasingly locked behind SMS walls.
• Children and young people: It is entirely reasonable — even responsible — for parents to restrict or delay phone ownership. Cost, distraction risks, and safety all make delaying mobile access a wise decision. Yet, as schools and youth services add mobile-only logins, these children are excluded by design.
• Financial limitations: Not everyone can afford the cost of owning, maintaining, and replacing mobile devices. Prepaid plans still require ongoing fees, while smartphones can be prohibitively priced. Should access to a bank account or a government benefit really require purchasing a luxury device?
• Rural and remote residents: In communities with patchy or non-existent reception, forcing SMS verification is absurd. A message that never arrives is not simply inconvenient — it can be the difference between being able to file taxes, shop safely, or pay bills, and being completely shut out.
• Those concerned with privacy and digital minimalism: Some people choose not to carry a mobile as a matter of personal freedom, valuing privacy, reduced tracking, or a life less tethered. They should not be punished for making different but valid choices about their technology use.

These groups are not small. They represent millions of people. Yet, in each case, the assumption that “everybody has a mobile” excludes them from the digital world, forcing conformity rather than supporting genuine accessibility.

Security by Exclusion Is Not Security

Ironically, many of those being excluded by SMS-based 2FA are not careless users; they are often the most careful ones. People who rely on password managers like KeePassXC are already well ahead of average users when it comes to security. Their discipline with unique, complex passwords reduces risks far more effectively than an SMS code ever could.

And SMS is not the unbreakable wall it’s often marketed as. It remains one of the least secure forms of two-factor authentication, vulnerable to SIM-swapping, interception, and convincing phishing schemes. It is “better than nothing,” perhaps — but far inferior to the alternatives already available.

Better Options Already Exist

The irony is that truly robust, inclusive methods are already here:

• Hardware security keys like YubiKeys — portable, unphishable, and simple.
• Authenticator apps for desktops — generating codes without requiring a phone number.
• WebAuthn and FIDO2 — browser-based standards for password-less authentication using laptops, biometrics, or tokens.
• Secure email verification — a practical and familiar fallback that works across all devices.

These methods are not futuristic experiments. They’re here now, stronger than SMS, and do not assume every user carries a particular device.

The Time to Push Back is Now

This trend does not need to continue, and it will not stop unless ordinary people demand better. If you feel locked out by SMS-only policies, you are not alone — and you are not the problem. Systems that force mobile ownership are flawed by design.

As readers, consumers, and citizens, you can push back against this lazy assumption:

• Raise the issue with your bank, retailer, or government agency. Ask them to support multiple authentication options, not just SMS.
• Choose services that are inclusive of different security pathways. Reward organisations that prioritise choice.
• Speak up in community forums, customer feedback surveys, and even in conversations with friends and family. The more visible this exclusion becomes, the harder it will be to ignore.

We should not allow a single device — a mobile phone — to become a requirement for participating in modern life. Digital security should protect, not exclude. And access to banking, government, and communication should never be conditional on ownership of a consumer gadget.

The assumption that “everybody has a mobile” is wrong. It always has been. And unless we speak out now, it threatens to harden into a rule that strips away the right to digital access for millions of people.

The fix is simple: demand choice. Demand security solutions that include everyone. Demand digital systems that reflect reality, not lazy assumptions. Because in the end, technology should serve people — not the other way around.