Email codes are usually the safer of the two, on one condition: the mailbox receiving them must have a strong password and a proper second factor of its own. SMS codes depend on the security of your phone number, and phone numbers are moved between SIMs by social engineering every day. Both fall to the same phishing page, both are weaker than an authenticator app, and both are outclassed by a passkey. The honest answer is "email, if your email is good; neither, if the service offers something better".
Here is how each one fails, where they differ in practice, and where a throwaway address does and does not belong.
Can an SMS code be stolen without touching your phone?
Yes, and that is the attack with no email equivalent. A phone number is not fixed to your handset. It is an entry in your carrier's records that points at a SIM, and the carrier will repoint it when a convincing enough person asks. Someone who claims to have lost their phone and can answer a few questions pulled from a data breach often qualifies. Once the number points at the attacker's SIM, every code sent to it lands on their screen, and your phone quietly drops off the network. Porting the number to another carrier achieves the same thing.
Nobody can ring your mail provider and have your address moved to their account. The address is not a routing entry a support agent can edit. An attacker who wants your email codes has to get into the mailbox itself, which is the condition that runs through this whole article.
Interception on the way to you
Text messages are old technology. They cross carrier networks unencrypted, any app granted SMS permission can read them, and they are previewed on the lock screen where anyone holding the device can see them. Email in transit is encrypted between most major providers now. Reading it requires the mailbox credentials or a device that is already signed in.
That is a real difference, but narrower than it sounds. The practical risk for most people is not someone tapping a carrier backbone. It is a lost phone with notifications showing, or a malicious app. Turn off lock-screen previews for messages and you have closed the most common gap.
Phishing: where both are equally weak
A verification code is a short string you are expected to type into a box. A phishing page simply provides the box. You enter your password on a convincing copy of the login page, the attacker enters it on the real one, the real service sends you a code, and you type that into the fake page too. Whether the code came by text or by email makes no difference, because you are the one relaying it. The tooling behind this, including bots that phone you and ask for the code outright, is covered in how verification codes get stolen.
Only a method bound to the real website's address survives this. That is the point of passkeys, and it is why they sit at the top of any ranking.
Why are email codes only as safe as the mailbox?
Because the mailbox is the thing being trusted. If it is protected by a reused password and nothing else, then every service that sends codes to it is protected by a reused password and nothing else. Worse, that mailbox is almost certainly the recovery address for everything you own. An attacker inside it can reset passwords in bulk and intercept the codes that confirm the resets. One compromised inbox is a master key.
Turn it around and the same concentration works for you. Secure the mailbox properly and you have raised the floor for every account that relies on it. That is an afternoon's work:
- A long, unique password on the mail account, stored in a password manager.
- An authenticator app or a passkey on the mail account itself, with SMS removed as a fallback where the provider allows it.
- Recovery options checked recently, pointing only at things you still control.
- Lock-screen notification previews turned off on the phone that reads the mail.
There is no equivalent afternoon's work that makes your phone number resistant to a persuasive call to your carrier.
Recovery, travel and changing numbers
The quiet decider is what happens when you need to get back in rather than merely log in. Phone numbers get recycled. Give one up — move country, change carrier, let a prepaid SIM lapse — and after a quiet period it is issued to someone else, who then receives any codes still pointed at it. Email addresses can die too, since free providers delete inactive accounts, but an address you use is one you keep. You decide when it goes.
SMS codes also assume you are on your home network. Abroad, you may have no roaming, a local SIM in the slot, or a message that arrives twenty minutes late. Email arrives anywhere there is a connection. Changing your number is worse still, because it has to be updated on every account that uses it. The ones you forget are precisely the ones that will send a code to a stranger.
Use an authenticator app or a passkey where offered
Both kinds of code are a stopgap. Where a service offers an authenticator app, use it: the code is generated on your device, nothing is transmitted, and there is no number to swap or inbox to raid. Where a service offers passkeys, prefer those even to the app. A passkey refuses to work on a lookalike site at all, which removes the phishing problem rather than mitigating it. We compare the three in two-factor authentication explained. Keep SMS or email as the fallback they were meant to be, not the front door.
Where does a disposable inbox fit?
A temporary address is a good place for a one-off verification code: a signup you will not return to, a download behind a form, a service you are only inspecting. The code arrives, you type it in, and the address expires with nothing permanently attached to you. For that narrow job a temporary inbox is cleaner than handing over a real address or a phone number. The flow itself is described in how OTP verification works.
It is the wrong place for anything you will need to recover. Once the inbox is gone, so is every reset link and security alert that would have reached it, and no one can bring it back. Never set a temporary address as the recovery or two-factor channel on an account you care about. Never use one for accounts holding money, purchases or your name. If you are unsure which category a signup falls into, assume it is the second.
The bottom line
Ranked from strongest to weakest, for the accounts that matter:
- Passkey — immune to phishing, nothing to intercept, nothing to swap.
- Authenticator app — generated locally; still relayable to a phishing page, but no number or inbox to attack.
- Email code to a well-secured mailbox — no SIM-swap risk, works anywhere, but inherits every weakness of the mailbox.
- SMS code — convenient, universal, and the only one that can be stolen without touching anything you own.
Sources
- NIST SP 800-63B, Digital Identity Guidelines: Authentication and Authenticator Management — the standard that classifies out-of-band codes and their risks.
- passkeys.dev — the FIDO Alliance and W3C community reference on how passkeys resist phishing.
- Google Account Help: turn on 2-Step Verification — a major provider's own ranking of verification methods.
- Apple Support: two-factor authentication for Apple Account — how trusted devices and numbers are used for codes.