There are growing concerns among boards of directors regarding identity theft through ransomware attacks, large-scale data breaches, and various types of social engineering. While some large organizations continue to allow employees to use their own mobile phones for Multi-Factor Authentication (MFA) and other purposes within Bring-Your-Own-Device (BYOD) programs, this creates significant security gaps in BYOD environments.
Using a single location for all verification channels can provide better oversight of employee usage, make it easier for HR to disconnect access rights for departing employees, help reduce the likelihood of SIM swaps, and help an organization establish greater controls to meet the needs of regulators and insurance companies.
Personal Mobile Devices Are a Source of Enterprise Risk
In many cases, BYOD policies were established as a way to reduce organizational capital expenditures for hardware while allowing employees to utilize their personally owned devices for work-related activities, including sending and receiving email, texting, and using specific software.
Although using employees’ personal devices can be convenient, it creates a security risk. Corporate authentication codes sent via SMS depend upon the employee’s device being secure, the carrier account being configured correctly, and proper security practices being followed.
If an employee allows malicious software onto their device, is subjected to a phishing scheme, or loses control of their cellular account, an attacker could potentially intercept the MFA codes intended for accessing corporate resources.
Employees utilizing their personal devices also reduce the level of administrative oversight and visibility available to IT staff. The IT department may not own the mobile phone or SIM card used by an employee to send and receive corporate authentication codes. It may therefore be unable to:
- Enforce consistent mobile device management policies across all devices.
- Monitor the overall security posture of employees’ devices.
- Exert control over employees’ cellular accounts.
Additionally, utilizing employees’ personal mobile devices can lead to “shadow IT,” where employees use unauthorized tools or hardware for corporate-related tasks.
The Principle Behind SMS-Based MFA Is Sound but May Be Compromised
The concept of Multi-Factor Authentication is sound. It requires users to know something, such as a password, and have something, such as a smartphone or another device.
The vulnerability exists when a consumer mobile phone number and SMS messages are used as the basis for the second factor. SMS-based MFA can be compromised due to vulnerabilities inherent in the carrier processes and telecommunications systems that deliver messages containing One-Time Passwords (OTPs).
SIM Swap Attacks Represent a Significant Threat
One example of how SMS-based MFA can be compromised is through an attack known as SIM swapping.
An attacker collects sufficient information about an authorized user of a company’s VPN, financial platform, cloud environment, or another resource. The attacker then uses social engineering tactics to convince the authorized user’s wireless carrier to transfer their phone number to a different SIM card.
The attacker subsequently requests a password reset for one or more of the user’s accounts and receives the SMS-based OTP needed to gain access.
Even if a company has implemented advanced security controls or purchased multiple layers of defence-in-depth security products, there may be little to prevent an attacker from accessing organizational assets once the SMS-based authentication mechanism has been compromised.
This is precisely why forward-thinking enterprises choose to rent a phone number for SMS verification. By partnering with a dedicated cloud telephony provider, the IT department can lease blocks of clean, secure virtual numbers and assign them individually to employees or departments.
Cyber Insurance Costs and Regulatory Compliance Issues
As ransomware attacks and the resulting breach costs have increased, cyber insurance carriers have begun tightening their underwriting standards.
Underwriters now evaluate how well a company:
- Protects its privileged accounts.
- Manages its MFA solutions.
- Limits third-party access to its resources.
- Removes credentials from departing employees.
Companies that continue to use personal mobile numbers for MFA and software verification may demonstrate poor authentication governance to underwriters. Consequently, these companies may face higher premiums, diminished coverage options, or difficulty obtaining a cyber insurance policy.
If a company experiences a breach originating from a compromised personal SIM used for corporate authentication, its cyber insurer will likely scrutinize the reasonable measures the company took to protect the integrity of its authentication chain.
Regulatory Compliance Requirements
Regulatory compliance issues stem from similar problems. Regulations such as the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) require organizations to develop and maintain adequate protections for personally identifiable information (PII).
Companies must therefore be able to document and explain:
- How they manage access to sensitive systems.
- How they authenticate employees and other users.
- How they remove access when it is no longer required.
Personal Numbers Create Employee Offboarding Problems
Another problem created by the use of personal phone numbers relates to employee offboarding.
When an employee leaves a company, IT personnel typically need to terminate that person’s email account and revoke any remaining corporate credentials. However, if the employee previously used a personal mobile number for SMS/MMS-based MFA or other purposes involving CRM systems, vendor portals, or financial institutions, the company may not be able to terminate or recover the number easily.
These “orphaned accounts” represent potential security vulnerabilities for as long as they remain active. Former employees may continue receiving password-reset codes intended for corporate accounts.
Terminating orphaned accounts can also be problematic because companies often do not possess the authority to cancel the number itself. They may not have prior knowledge of every service for which the personal mobile number was configured.
Corporate-Owned Virtual Numbers Offer an Alternative
Businesses can minimize employee offboarding problems and increase administrative oversight by implementing centrally managed cloud telephony systems for MFA.
Employees receive verification messages through a company-managed portal or application instead of through their personal mobile phones. This provides IT personnel with:
- Greater insight into access activity.
- Audit trails for verification attempts.
- The ability to assign and remove access rights quickly.
- Continued ownership of verification numbers when employees leave.
However, care must be taken when selecting vendors. Many banking and cloud services prohibit Voice over Internet Protocol (VoIP) numbers as a way of reducing fraudulent access.
Companies should verify that any proposed solution:
- Supports messages from all relevant platforms.
- Complies with security best practices.
- Meets the company’s data-retention requirements.
- Provides the required level of availability and uptime.
This is one reason progressive organizations choose to lease a telephone number for SMS-based MFA purposes. When employers designate company-owned virtual numbers for MFA, IT staff retain ownership and control of the designated numbers regardless of changes to employees’ personal phone numbers.
Implementation Steps for Centralized Verification Systems
A centralized verification solution can be introduced through an organized rollout process:
- Identify relevant systems: Locate every internal system, SaaS application, vendor portal, and other service that uses SMS-based MFA.
- Map personal-number dependencies: Determine which business accounts are connected to employees’ personal phones.
- Prioritize high-risk roles: Begin with employees who have access to sensitive data, financial systems, administrative accounts, or critical infrastructure.
- Verify platform compatibility: Confirm that every relevant platform is compatible with the proposed virtual-number system.
- Enhance access controls: Apply suitable security measures to protect the centralized verification platform.
- Develop an offboarding process: Establish a procedure for removing access immediately when an employee leaves the company.
- Update company policies: Require employees to follow the organization’s revised authentication and device-use policies.
- Document the improved architecture: Maintain clear records for auditors, regulators, and cyber insurance providers.
Last Updated: August 27, 2026
