The SMS Authentication Link Vulnerability: How 175 Services Put You at Risk

Convenience comes at a heavy price. New research reveals that the text message links you use to log in without a password are an open invitation for scammers to hijack your personal data.

The SMS Authentication Link Vulnerability Crisis

Websites are ditching usernames and passwords for the ease of SMS authentication, but this shortcut is imperiling the privacy of millions. According to a paper published last week, over 175 services—ranging from insurance providers to job boards—are leaving users vulnerable to identity theft.

How Scammers Guess Your Login Link

The flaw lies in 'link enumeration.' The security tokens at the end of login URLs are often predictable. By simply incrementing a number—changing 123 to 124—researchers could bypass security and view private details like partially completed insurance applications. It's a low-effort attack that's incredibly easy to execute at scale.