Some recent research has thrown a spotlight on a lurking cybersecurity threat on a practice that makes it easy to log into websites. According to a new study by security researchers from the University of New Mexico, the University of Arizona, the University of Louisiana, and the cybersecurity firm Circle, millions of people are being placed at risk because of how some companies let you sign in by clicking a link sent to your phone in a text. These sms-style sign-in links are meant to make logging in easy without a password, but in many cases, they are dangerously insecure.
Yes, it is convenient to not have to actually create an account and keep track of yet another password, so this process has been seen as a big plus. If you haven’t come across it, some services send you an SMS with a link that lets you access your account. But those links often have predictable or weak security tokens at the end of their URLs. Attackers with only basic tools can guess or tweak these tokens to access other users’ accounts.
What happens if they do get access to your accounts? Well, it’s unlikely to be a surprise to anyone, but once inside, they can view or change personal details like names, dates of birth, and even financial data because the link itself is treated as enough authentication. Worse yet, many of these URLs stay valid months or years after they were sent, meaning access isn’t just fleeting.
2
If you click one of these SMS links from a service that’s using this weak system, your phone may open a legitimate sign-in session — but it could also hand over your credentials to an eavesdropper or let a scammer impersonate you. Even if the link looks genuine, an attacker or automated tool could have guessed a similar link and gained access to your account. Essentially, the convenience of “one-tap login” becomes a gateway for bad actors when poorly secured.
Not to fear. There are some ways to look out for yourself and your information.
- Choose to log into another way. Avoid clicking sign-in links in text messages whenever possible. Instead, open the service’s app or type its official web address manually and sign in there.
- Treat unexpected SMS sign-in links with suspicion, even from services you use. If you didn’t initiate a login, don’t interact with the link.
- Enable stronger authentication (like two-factor with an authenticator app) on accounts that offer it, so even if someone has a link or a token, they still need a second proof.
- Consider opting out of SMS authentication if a service lets you choose. There are more secure options such as hardware keys, authentication apps, and passkeys.
Bottom Line—That seemingly harmless text message with a “click here to sign in” link could be more perilous than you think. With millions of URLs floating around and inadequate protections on many of them, attackers only need a slight edge to breach your personal accounts. Staying alert and signing in through trusted channels can make all the difference.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
