Millions of people are at risk due to the increasing use of SMS-based authentication links by online services, according to a recent study. Researchers found that these links, intended to simplify the login process, are making users vulnerable to scams, identity theft, and other crimes.

The study, published last week, identified over 700 endpoints delivering such texts on behalf of more than 175 services. These services, ranging from insurance quote providers to job listing sites and referral platforms for pet sitters and tutors, are increasingly relying on SMS authentication to bypass the complexities of traditional username and password systems. Instead, users provide their cell phone number during signup and receive authentication links or passcodes via text message when they want to log in.

A key vulnerability identified in the research is the use of easily enumerated links. This means that scammers can potentially guess valid links by simply modifying the security token, which is typically a string of characters at the end of the URL. By systematically altering these tokens, malicious actors can gain unauthorized access to user accounts.

"The ease with which these links can be manipulated poses a significant threat to user privacy and security," the study's lead author stated. "Services need to adopt more robust authentication methods to protect their users from potential harm."

The reliance on SMS-based authentication has grown in recent years due to its perceived convenience. However, security experts have long warned about the inherent risks associated with this method. SMS messages are not encrypted and can be intercepted by malicious actors. Additionally, phone numbers can be spoofed, allowing attackers to impersonate legitimate services and send fraudulent links.

The study's findings highlight the urgent need for online services to re-evaluate their authentication practices and adopt more secure alternatives, such as multi-factor authentication using authenticator apps or hardware security keys. Consumers are also advised to be cautious when clicking on links received via text message and to verify the legitimacy of the sender before entering any personal information.