SMS (Short Message Service)

SMS, short for Short Message Service, is a text-messaging protocol standardized in the 1980s as part of the GSM specification. It was originally designed as a low-priority signaling-channel feature for delivering operator notifications to subscribers, and was not initially expected to become a primary communication channel between users.

A single SMS payload is limited to 140 bytes, which translates to 160 characters of 7-bit GSM-encoded text or 70 characters of 16-bit UCS-2 (used for non-Latin alphabets and emoji). Longer messages are split into multiple parts and reassembled by the receiving handset, a mechanism known as concatenated SMS or long SMS.

In practice, SMS comes in two forms relevant to most users today. P2P SMS (person-to-person) is the standard texting between two human users via their mobile carriers. A2P SMS (application-to-person) is the channel that delivers verification codes, marketing messages, and automated notifications from services to users, and accounts for the majority of all SMS volume in 2026.

A2P SMS is the workhorse of OTP-based authentication, including most 2FA deployments worldwide. The sender (a service like Telegram, Google, or a bank) hands the message to a CPaaS provider, which routes it through interconnect agreements with destination carriers using protocols like SMPP. The receiving handset gets the text on the same channel as a regular P2P message — the user cannot easily tell the difference.

SMS is structurally insecure: it is unencrypted on the wire, vulnerable to SS7 interception, susceptible to SIM-swap attacks, and routed through systems whose operators have legitimate read access. Despite this, it remains the dominant out-of-band authentication channel because it has near-universal reach and requires no app installation. Its replacement by RCS, IP-based messaging, and authenticator apps has been ongoing for over a decade and is still incomplete.