After passkeys, should SMS still be the default recovery path?

Once someone enables a passkey, should a phone number really remain the default escape hatch? It feels like we are adding a stronger front door while leaving a weaker side door open. A SIM swap can move texts to an attacker, numbers can be reassigned, and a family or shared phone can blur who actually receives the code. None of that makes SMS useless, but it makes it a questionable default for recovering a passkey.

I’d have the setup flow offer a second passkey or printed one-time recovery codes first, then let users add SMS if they need the accessibility and familiarity. Recovery shouldn’t quietly rely on something weaker than the credential it is replacing, but making SMS disappear would create avoidable lockouts. Do your own recovery habits justify that convenience trade-off?

The ordering matters more than banning SMS. The brief supports treating backup authenticators as at least as strong as the credential being recovered, while also recognizing that phone numbers remain a practical recovery option for some users. “Offer stronger first” seems much easier to defend than “remove SMS.”

From a product perspective, printed codes are easy to offer and easy to misunderstand. The flow needs a very explicit “store this somewhere safe” step, otherwise people will click through, lose the codes, and blame the service. I’d keep SMS visible, just stop presenting it as the obvious best choice.

The side-door analogy is basically right. If recovery by SMS can replace a passkey, then SMS is part of the account’s effective security boundary. Calling the account “passkey protected” without explaining that exception is misleading.

Shared phones are an underrated design problem. A code arriving on a family device may be convenient without being private, and the interface usually has no way to understand that social context. The choice should be framed around who can access the recovery channel, not just whether the user owns the number.

I’m less confident that “printed codes first” works for ordinary users. Some people will not print anything, some will store the paper beside the device, and some will lose it during a move. SMS is weaker, but a recovery method that users actually retain may outperform a stronger method they ignore.

A second passkey is the cleanest answer when someone has another device they control. Recovery codes are the resilient offline option. I’d make both prominent, then label SMS as a convenience fallback rather than pretending all three have the same properties.

The support burden cuts both ways. Strict recovery can prevent an account takeover, but it can also turn a lost phone into a permanent lockout if no backup was saved. Services should ask users to confirm a recovery plan during passkey setup, not discover the gap later.