A private code.
A shared delivery chain.

Lighthouse Reports’ June 2025 investigation examined almost 100 million telecom data packets. It identified sensitive login messages associated with more than 1,000 companies passing through Fink Telecom Services. The investigation matters because a brand can have no direct relationship with an intermediary while still relying on it somewhere in the delivery chain.

The report linked the network to controversial surveillance activity and recorded responses from the company and the affected industry. Those allegations should remain attributed; routing a company’s message does not prove that its customers’ accounts were successfully taken over.

For a buyer, the lesson is to ask about routing, subcontractors, access to message content, retention and incident notification. A fast delivery rate is commercially useful, but it does not answer the question of who can see a security-sensitive message.

Global Titles are signalling addresses used by mobile networks. Misuse can support interception or tracking; Ofcom’s April 2025 decision targeted leasing and certain sub-allocation arrangements involving UK numbers. The new-arrangement ban applied immediately, with most existing arrangements ending in April 2026 and two specified migration exceptions running to 22 October 2026.

That action reduces particular routes to abuse. It does not turn the international SMS system into an end-to-end encrypted channel. The wider telecom compromise concerns reflected in CISA’s December 2024 mobile guidance provide another reason to reduce reliance on SMS for sensitive authentication, particularly for highly targeted people.

Cifas’s Fraudscape 2025 reported UK SIM-swap filings rising from 289 to nearly 3,000 in 2024, a 1,055% increase. These are recorded cases for that period, not a 2026 prevalence estimate or the probability that any particular employee will be targeted.

A service using SMS is therefore not providing “zero protection”. An attacker still has conditions to meet, and SMS may be better than a password alone when stronger options are unavailable. The sensible transition is to improve the method while keeping an effective second factor in place.

An authenticator app can remove the SMS delivery route and reduce exposure to SIM swapping for that login. A manually entered one-time code can still be phished or relayed. NIST distinguishes replay resistance from phishing resistance: a code that expires quickly is not necessarily bound to the genuine service.

Passkeys can be device-bound or synchronised, depending on the implementation. A biometric or PIN commonly unlocks use of the credential locally; a biometric is not, by itself, a remote authentication protocol. Avoid presenting all passkeys as device-bound or every biometric prompt as equivalent to a FIDO login.

Security keys can be an appropriate choice for privileged or high-impact access, but the organisation must plan spare keys, replacement and revocation. Otherwise a lost key may push users towards an improvised help-desk bypass.

Similarly, a QR code is not a security property on its own. Some QR-based flows are part of sound authentication, while a deceptive QR journey can still take someone to the wrong destination. Judge the protocol and the recovery process, rather than the visual form of the prompt.

Inventory where a mobile number is still used: normal login, password reset, transaction approval, customer support and recovery of a synchronised credential account. Removing SMS from one screen while leaving it as an easy reset can preserve much of the original exposure.

Include the people who cannot use a particular device or authenticator. A workable alternative and a documented exception process are better than quietly weakening the service whenever someone encounters difficulty. Minimise the sensitive identity evidence collected during recovery and control its retention.

Help-desk staff need permission to pause an unusual request, a reliable escalation route and a way to record the decision. Do not ask them to infer identity from a confident caller, an employee’s public information or a video image alone.

• Prioritise: privileged access, email, finance, identity administration and other accounts whose loss would have serious consequences.
• Pilot: test the chosen method with real workflows, accessibility needs, device changes and recovery.
• Remove weak fallbacks deliberately: make sure the replacement process is ready before retiring the old one.
• Review suppliers: distinguish their supported authentication methods from their account-recovery arrangements.
• Measure: report coverage of important accounts, unresolved exceptions and recovery tests—not just the number of enrolled users.

Ask for evidence that a person can recover safely when the usual phone is missing and that an impostor cannot easily do the same. Keep emergency administrative access tightly controlled, monitored and rehearsed.

The objective is a more dependable account lifecycle, not a claim that one product makes an organisation immune to compromise. Endpoint security, session handling and staff judgement still matter after the authentication method improves.