# SMS two-factor statistics: how many services still send sign-in codes by text

Last updated: 2026-10-30
Canonical page: https://www.fwrdsms.com/sms-2fa-statistics
Data: https://2fa.directory

I counted how the 1,895 services in 2fa.directory with two-step sign-in send their codes.

## Key findings

- 46% of the 1,895 services in 2fa.directory that offer two-step sign-in send their codes by text message (869 services).
- 18% of those services (340) offer no authenticator app and no security key: their second step is a text, a phone call or an email.
- 8% (152 services) send the second step only by text message or phone call.
- 32% of the services that send codes by text offer no authenticator app or security key instead.
- 71% of banks with two-step sign-in send codes by text (139 of 196), and 30% offer no authenticator app or security key.
- 89% of insurers (25 of 28) and 85% of government services (34 of 40) send sign-in codes by text.
- Among services listed for the United States, 76% send sign-in codes by text (230 of 302), against 34% of services listed worldwide.

## By category

Categories with at least 20 services.

| Category | Services | Send codes by text | No app or key |
|---|---:|---:|---:|
| Insurance | 28 | 89% | 79% |
| Government | 40 | 85% | 20% |
| Travel | 22 | 82% | 55% |
| Utilities | 60 | 73% | 53% |
| Banking | 196 | 71% | 30% |
| Payments | 53 | 68% | 26% |
| Investing | 64 | 67% | 38% |
| Shopping | 70 | 66% | 51% |
| Health | 31 | 61% | 29% |
| Universities | 97 | 59% | 1% |
| Finance | 82 | 52% | 24% |
| Identity | 26 | 50% | 8% |
| Smart home and devices | 26 | 46% | 19% |
| Communication | 62 | 45% | 19% |
| Social | 50 | 42% | 14% |
| Backup and sync | 52 | 39% | 8% |
| Crypto | 129 | 37% | 2% |
| Marketing | 78 | 37% | 13% |
| Email providers | 43 | 37% | 2% |
| Cloud | 50 | 32% | 2% |
| Creative tools | 22 | 32% | 9% |
| Entertainment | 22 | 32% | 14% |
| Task management | 23 | 30% | 0% |
| Domains | 77 | 27% | 4% |
| Education | 26 | 27% | 27% |
| Developer tools | 141 | 25% | 6% |
| Gaming | 77 | 23% | 9% |
| Hosting | 101 | 23% | 5% |
| Remote access | 23 | 22% | 4% |
| Security | 62 | 18% | 10% |

## By country

Services listed for one country are mostly local banks, utilities, shops and public services, so they lean on texts far more than services listed worldwide (34% of 1,174).

| Country | Services | Send codes by text | No app or key |
|---|---:|---:|---:|
| United States | 302 | 76% | 35% |
| Italy | 38 | 71% | 32% |
| Australia | 104 | 69% | 48% |
| Canada | 84 | 67% | 36% |
| Spain | 35 | 63% | 31% |
| United Kingdom | 105 | 61% | 33% |
| France | 47 | 57% | 36% |
| Netherlands | 41 | 49% | 22% |
| Germany | 102 | 47% | 24% |
| Sweden | 49 | 39% | 16% |

## How I counted

- The list is 2fa.directory’s public data (https://api.2fa.directory/v3/all.json), read on 30 October 2026. It names 2,575 services: 1,895 offer two-step sign-in and 680 don’t.
- A service counts as sending codes by text when SMS is one of its listed two-step methods.
- No authenticator app or security key means none of these is listed: an authenticator app (TOTP), a security key (U2F or FIDO2), or the service’s own app or hardware token.
- Categories and countries are 2fa.directory’s own tags, and a service can carry more than one. A country means the service is listed for that country; services listed for no country are counted as worldwide. Categories with fewer than 20 services and countries with fewer than 35 are left out, because one service would move them too much.
- 2fa.directory is built by volunteers from each service’s own help pages, so it isn’t a random sample of the web, and it counts what a service offers, not what people choose.

Data: 2fa.directory, MIT License, © 2factorauth and contributors (2014–2020 © Josh Davis).

## Quoting these numbers

You’re welcome to quote any number here. Please link to https://www.fwrdsms.com/sms-2fa-statistics, so readers can see the method and the date.

Suggested citation: Fwrd, “SMS two-factor statistics: how many services still send sign-in codes by text”, 30 October 2026, https://www.fwrdsms.com/sms-2fa-statistics. Based on 2fa.directory data.

## Why it matters

A code sent by text goes to one phone number. When a team shares an account, or the phone with that number is in another country, the code has to reach someone else in time. I make Fwrd, an iPhone app that sends those texts straight to a Slack, Microsoft Teams, Discord or Telegram chat, or a webhook, and hands them to your shortcut for email, another phone or WhatsApp.

- [Share 2FA codes with your team in Slack](https://www.fwrdsms.com/blog/share-2fa-codes-with-team-slack)
- [One phone number for a team’s two-step codes](https://www.fwrdsms.com/blog/shared-phone-number-for-2fa)
- [Forward verification codes from your iPhone](https://www.fwrdsms.com/forward-verification-codes-iphone)
- [Not getting bank codes abroad](https://www.fwrdsms.com/blog/not-receiving-otp-abroad)