Lock Down Your Logins Without a SIM Card

Two-factor authentication has become a standard defence against account theft, yet many Australians still rely on a six-digit text code sent to their mobile number. The method feels simple, but it carries real risks that have become harder to ignore in 2026. SIM swapping, lost handsets, and patchy regional coverage on parts of the NBN all make SMS codes fragile at exactly the wrong moment.

Across Sydney, Brisbane, and smaller towns along the coast, customers of Telstra, Optus, and Vodafone occasionally find their numbers briefly unavailable after network upgrades or outages. When that happens, the code that protects a bank, email, or MyGov account simply never arrives. Removing the phone number from the security equation removes that worry entirely.

There are several mature alternatives that work on a laptop, tablet, or dedicated token, and they tend to be faster and more resistant to phishing than SMS. The rest of this guide walks through the practical choices, the apps and keys that Australian services accept, and the habits that keep the system running smoothly.

Why phone-based two-step verification is losing ground

Text-message codes were a clever fix a decade ago, but the threat landscape has shifted. Attackers now trick carriers into transferring a victim's mobile number to a new SIM, a tactic that has been reported repeatedly to the Australian Cyber Security Centre. Once the number moves, every SMS code lands in the attacker's pocket, including the one for your email, which is often the master key to the rest of your digital life.

There is also the practical matter of coverage. Travellers driving between Adelaide and the outback often hit black spots where a one-time code cannot be delivered in time. Even at home, switching eSIM profiles on newer iPhones or Android handsets can briefly disable the line. Authentication that depends on a working mobile signal is, in short, authentication with a single point of failure.

Authenticator apps as a phone-free first step

An authenticator app generates codes locally on a device, which means no carrier is involved and no message needs to travel. Apps such as Microsoft Authenticator, Google Authenticator, and the open-source Aegis all support time-based one-time passwords and work on iPad, Android tablets, and even older iPhones kept on Wi-Fi. Many Australian banks, including the major four, now treat these codes as a stronger option than SMS.

The setup usually takes under a minute. Open the security settings of the account you want to protect, scan the QR code with the app, and confirm the six-digit number it produces. Storing the app on a tablet that lives on the desk keeps it separate from the phone, which is useful if your handset is ever lost during a weekend at the markets in Melbourne's Queen Victoria Market or a hike in the Grampians.

Hardware security keys for the cautious

For people who want the strongest option available to consumers, a physical security key plugs into a USB port or taps against an NFC reader. Brands such as YubiKey, Token2, and Feitian produce small devices that speak the FIDO2 protocol, recognised by Google, Microsoft, Apple, and many Australian government portals. The key does the cryptographic handshake itself, so nothing secret leaves the device.

Two keys are usually recommended: one that stays on the keyring and a spare kept somewhere safe, such as a locked drawer at home in Perth or a bank deposit box. Services that accept them include most major email providers, password managers, and the MyGov sign-in options used for ATO and Centrelink access. The cost is roughly the price of a decent lunch in Brisbane's CBD, and the keys typically last for years.

Passkeys, password managers, and going keyless

Passkeys take the idea further by replacing both the password and the second factor with a single cryptographic key stored on a device or in a password manager such as Bitwarden, 1Password, or Dashlane. Logging in becomes a fingerprint, face scan, or PIN confirmation, which is hard for a remote attacker to phish because no shared secret ever travels over the network.

In Australia, passkey support has spread quickly through retailers, streaming services, and the big four banks' mobile apps. If a service does not yet offer passkeys, a password manager with its own multi-factor option is a sensible bridge. The same password manager can also store recovery codes, which keeps the entire sign-in flow under one roof and removes the temptation to keep codes in a notes app.

Email and backup codes done right

Email is sometimes pitched as a replacement for SMS, but it carries the same phishing risk if the inbox itself is compromised. Used carefully, however, recovery or backup codes remain a useful last resort. Generate them once, print them, and store the sheet in a place a flatmate in a shared Surry Hills terrace or a visitor in a short-stay apartment is unlikely to find.

Rotate the codes whenever you suspect exposure, and never store them as a photo on the phone you are trying to de-couple from authentication. Some Australian services, including several superannuation portals, still demand a phone number for identity verification at signup, but allow an authenticator app or hardware key for the daily sign-in afterwards.

Setting things up across common Australian services

Most platforms follow a similar path: head to the security or sign-in section, choose a second factor, and confirm with a code from your existing method. Before switching off SMS, make sure the new method is working for at least one sign-in. Telstra and Optus accounts, for example, accept both authenticator apps and security keys through their online portals, while Google and Apple IDs work smoothly with passkeys on Australian-made apps.

For everyday banking, the apps from Commonwealth Bank, NAB, Westpac, and ANZ each describe their supported methods in the security menu. If you travel often between Melbourne, Hobart, and Darwin, the offline nature of an authenticator app means you can sign in from a regional airport lounge without worrying about which carrier has the strongest signal that morning.

What happens if you lose your second factor

Losing a phone is the obvious fear, but the real protection comes from planning for it before it happens. Most authenticator apps let you export accounts to another device or restore from an encrypted backup. Hardware key users keep a spare in a separate physical location, and password manager subscribers can sign in from any browser using their master password and a second factor stored in the vault.

A sensible weekly habit is to confirm that one backup path still works. Sign in using the backup method, glance at the device list, and remove anything unfamiliar. Building this into a routine is the same kind of small, predictable step as timing your shopping run; small choices repeated consistently are what protect a household over a year.

Pick one account that holds sensitive data, open its security settings today, and switch the second factor from SMS to an authenticator app while you still have full access.