Authenticator apps avoid SMS-specific risks, but setup secrets and synced accounts need protection, and codes can be phished. Prefer passkeys or FIDO security keys when supported.
“Protect authenticator setup secrets, synced accounts, and one-time codes.”
Sources for this correction, checked October 17, 2026: https://pages.nist.gov/800-63-4/sp800-63b.html