# Why Did Buffer Replace SMS Verification with Email? The story of moving away from SMS for security and cost balance. - **Source:** [Overflow - Buffer Resources](https://brifing.si/source/a6c4ab48-d486-43b0-91d8-dcf0ac6c953d) - **Published:** 2025-10-03 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/ce377f82-bad3-4859-a66d-686e9c91a6f7 ## Seeking Balance in Security Buffer decided to remove SMS-based two-factor authentication (2FA) to protect user accounts while simplifying the login process. This radical step raised questions about traditional security approaches. ## The Hidden Costs of SMS International SMS costs and carrier dependencies were costing Buffer hundreds of dollars monthly. Differing regulations across countries also increased administrative burdens. ## SIM Swap Attacks The biggest weakness of SMS verification was the vulnerability of phone numbers being hijacked. Unencrypted SMS traffic and SIM swap attacks made this method unreliable. ## Advantages of Email Infrastructure Buffer leveraged its existing email infrastructure to generate time-limited verification codes. This channel, already familiar to users, offered a more secure and sustainable solution than SMS. ## Unexpected Benefits Post-transition, support requests decreased, and engineering team productivity improved. Email accounts' own 2FA options provided an additional security layer. ## Thinking Beyond Standards Buffer’s decision may not suit every company but highlights the importance of context-specific solutions. Its focus on real security over security theater sets an example for the industry. ## Sources covering this story - https://buffer.com/resources/we-replaced-sms-authentication-with-email-and-authenticator-apps-heres-why/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._