SMS authentication and mortgage lenders
IT Brief examines avoidable exposure created when mortgage lenders rely on SMS as an authentication factor.
Read sourceMortgage broker guide · Authentication
SMS login codes won't save the conversation
Multi-factor authentication protects account access. It does not prove that the caller quoting a loan file, requesting a change or confirming a payment is your client.
Two controls, two identity questions
Login MFA asks for another factor before granting access to software. Strong MFA is essential because passwords are stolen, reused and phished. But once a session is open, it cannot vouch for every instruction that reaches a broker by phone, email or message.
Human-channel verification starts at the point where a person asks the firm to disclose information or act. The broker pauses, uses contact details already held in a trusted record and asks the counterparty to demonstrate possession during the live interaction.
Calling both controls “SMS authentication” hides the distinction. One protects a session. The other creates an independent break in a conversation.
Category difference
MFA authenticates access to an account. A caller check tests whether the caller can return a code sent to the number on file before a human follows an instruction.
Side by side
- 01
Question answered
Login MFA: may this device or session enter the account?
Caller verification: is the person in this live interaction tied to the established client channel?
- 02
Moment protected
Authentication at sign-in or a step-up event.
Disclosure, instruction or change during a call, email exchange or settlement workflow.
- 03
Initiator
The person attempting to sign in.
A staff member who pauses the interaction and starts a check against contact details already held by the firm.
- 04
Evidence
An identity-provider or application login event.
A timestamped record of requester, masked target, method and outcome, exportable for the firm to keep with its own file.
How SMS login can be bypassed
The problem is not that every SMS code fails. It is that a bearer code proves possession at one moment, while attackers target the carrier account, the person holding the phone or the authenticated session.
SIM swap
A criminal persuades or compromises a carrier process so the victim's mobile number is moved to a SIM the criminal controls. SMS login codes then arrive with the attacker.
Vishing
A caller posing as a bank, lender, broker or support technician asks the victim to read out a genuine login code. The code works; the story around it is false.
Session theft
Malware, adversary-in-the-middle phishing or stolen browser sessions can bypass the need to repeat the original login challenge.
Compromised colleague
A legitimate staff account can be used to send or support a fraudulent instruction. Successful account login does not authenticate every person later appearing in a conversation.
This is why a mortgage business should prefer phishing-resistant login factors where its systems support them. It is also why stronger login does not remove the need to verify an unusual caller or payment instruction.
Address the obvious objection
Yes, Vericode also uses SMS. The threat model is different.
Staff highlight the client's phone number already visible in a browser-based CRM, lender portal or email client, right-click and send a one-time code. The message travels through Australian SMS provider MobileMessage using Vericode's ACMA-registered sender ID, VERICODE, and the person reads the code back during the live interaction. The check is initiated by the firm at the moment of risk, not by someone trying to enter an account.
A SIM swap or fully compromised device can still defeat possession-based SMS. Vericode does not claim otherwise. The control is designed to stop a different and common path: a convincing caller who knows the file, spoofs a number or controls an email thread but does not possess the established client channel.
Each check also creates a timestamped, hash-chained record of the requester, masked target, method and outcome, which compliance-authorised users can export as PDF or CSV. That audit trail documents the procedure; it does not guarantee a fraud, insurance or compliance outcome.
Questions technical readers ask
Sources
AI and cyber threats for brokers
Mortgage Professional Australia reports the regulator's warning on AI-enabled cyber risk facing mortgage brokers.
Read sourceGeneral information only. This guide is not security, legal or compliance advice. Select controls for your systems and threat model with qualified advisers.
Protect both control points