--- title: Two-Factor Authentication via SMS · VitaminaWeb description: Learn how two-factor authentication via SMS helps secure your application and prevent phishing and hacking. source: https://vitaminaweb.digital/en/blog/two-factor-authentication-via-sms lang: en --- ![Two-Factor Authentication via SMS](https://vitaminaweb.digital/storage/blog/C3JReKHig4WyWtEK9JzEdgWFzOpnAbN1lo1uDGNu.webp) Two-factor authentication via SMS, also known as **2FA**, is a cloud messaging security solution that confirms a user's identity and protects the system from *phishing* or *hacker* attacks. ## How two-factor authentication via SMS works A unique PIN (or PIN code) is generated and sent to the user's mobile phone. The user receives the PIN code and enters it in the application to confirm their identity. If the PIN sent to the user matches the one they enter, they are allowed to continue the process. ## Steps in the two-factor authentication process via SMS 1. The user enters their phone number in the client's application (mobile or web). 2. The application sends a request for a PIN code, along with the user's phone number, to the SMS integration API; 3. The SMS integration API sends a number lookup request to the MNO (Mobile Network Operator); 4. The SMS integration API receives a "Number Lookup" response from the MNO; 5. The SMS integration API sends the number lookup response to the application; 6. If the number lookup result is valid, the SMS integration API generates the PIN code and sends the SMS; 7. The MNO delivers the SMS containing the PIN code; 8. The SMS integration API receives the delivery report for the message sent; 9. The user enters the PIN code they received in the application; 10. The application requests verification of the PIN code; 11. The SMS integration API verifies the PIN received and sends the response to the application; ## Why is the MNO involved in the process? Steps 3 and 4 are important for clients who want to check whether the user entered a valid phone number before sending the confirmation SMS. "Number Lookup" is used to check whether the phone number is valid. If the phone number is invalid (that is, it does not exist), no PIN code is generated and no SMS is sent. This helps avoid unnecessary costs. These steps are usually optional, depending on each project's needs. ## Read also What's New in Digital ### [Instituto da Maturidade Digital launches Agency Directory portal, developed by VitaminaWeb](https://vitaminaweb.digital/en/blog/instituto-da-maturidade-digital-launches-agency-directory-portal-developed-by-vitaminaweb) Instituto da Maturidade Digital launches Agency Directory, a platform developed by VitaminaWeb to organize and make it easier to discover compani... 03 Oct, 2026 · 5 min Development ### [All-in-One WP Migration flaw could put millions of WordPress sites at risk](https://vitaminaweb.digital/en/blog/all-in-one-wp-migration-flaw-could-put-millions-of-wordpress-sites-at-risk) CVE-2026-19949 affects versions up to 7.109 of the popular backup and migration plugin. An attack could escalate from SQL injection to remote cod... 03 Sep, 2026 · 5 min Development ### [Web Application Security: A Strategic Guide from Vulnerability to Digital Maturity](https://vitaminaweb.digital/en/blog/web-application-security-a-strategic-guide-from-vulnerability-to-digital-maturity) This guide offers an in-depth strategic analysis of the main risks, best mitigation practices, and the integration of security into the software... 23 Feb, 2026 · 5 min