AI agents for business finance: what they can and can't do
What AI agents can do in bookkeeping, close, collections and compliance today, where a person must stay in charge, and how to judge a product.
The short answer
An authenticator app is safer than SMS codes because the code is created on your own device rather than sent over the mobile network, so a SIM swap, a stolen SIM or intercepted texts do not give a fraudster your codes. Security agencies such as the US CISA treat SMS as one of the weaker forms of two-step verification. Neither method is safe if you read the code out to a scammer.
What two-step verification is
Two-step (or multi-factor) verification means you need two different things to get in or to approve a payment: something you know, such as a password or PIN, and something you have, such as your phone. Most Nigerian banks send a one-time password (OTP) by SMS as the 'something you have'. The idea is sound. The weakness is the SMS itself: the code travels over the mobile network to whoever controls your number at that moment, and that is not always you.
Why SMS codes are the weak point
- SIM swap: if a fraudster gets your number moved to their SIM, your codes go to them. See SIM swap fraud.
- Stolen phone or SIM: codes often appear on a locked screen, or the SIM can be put in another phone.
- Social engineering: the code arrives as a text you can read aloud, which makes 'please read me the code' scams easy. See fake customer care.
- Network weaknesses: SMS was not designed as a secure channel.
The US Cybersecurity and Infrastructure Security Agency (CISA) published guidance on multi-factor authentication that ranks phishing-resistant methods highest and treats SMS and voice codes among the weaker options, recommending stronger methods such as authenticator apps with number matching where phishing-resistant methods are not yet possible.
How an authenticator app works
When you set it up, the bank or app shares a secret key with the authenticator on your phone, usually by showing a QR code to scan. From then on, the authenticator uses that key and the current time to create a new short code every 30 seconds or so. The service knows the same key and can check the code. Nothing travels by SMS, so there is nothing to intercept on the mobile network, and a new SIM in your number gets nothing.
| SMS code | Authenticator app | |
|---|---|---|
| Where the code comes from | Sent by text to your number | Created on your device |
| SIM swap risk | High: codes follow the number | Low: codes stay on the device |
| Works without network signal | No | Yes |
| Shown on lock screen | Often | Only if you open the app |
| Can be read out to a scammer | Yes | Yes, so never do it |
| If you lose the phone | Get a new SIM | Use backup codes or the provider's recovery process |
Setting one up safely
- Install a reputable authenticator from the official app store.
- In your banking or fintech app, find the security settings and choose the authenticator option. Follow the steps to link it.
- Save any backup or recovery codes somewhere safe and offline, not in your photos or chats.
- Lock your phone with a strong PIN so nobody can open the authenticator.
- When you change phones, move the authenticator properly before wiping the old one, following each provider's process.
Worked example
Example only. Seun's SIM is swapped at night. The fraudster now receives his texts and tries to reset his email and approve a ₦300,000 transfer from one of his accounts. On the account that sends SMS codes, the reset code goes to the fraudster. On the account that uses an authenticator app, no text is sent, the fraudster has no code, and the transfer cannot be approved. Seun blocks both accounts in the morning, but only one had been at risk.
Common worries
People sometimes avoid authenticator apps because they fear being locked out. The risk is real but manageable: save your backup codes when you set up, keep them on paper somewhere safe at home, and move the authenticator to a new phone before you wipe or sell the old one. Some authenticators can back up your accounts in encrypted form, which helps if a phone is lost; if you use that, protect the backup account with a strong password too.
Others worry about not having data. An authenticator app does not need a network connection to make codes, because it works from the shared key and your phone's clock. If codes are rejected, check that your phone's time is set automatically. An SMS code, by contrast, cannot arrive at all when you have no signal, which is a common problem when travelling or in buildings with poor reception.
Other layers that help
- A transaction PIN separate from your login. See your transaction PIN.
- Device binding, where only your registered phone can approve payments.
- Transaction limits you can lower in the app.
- Alerts by email or push notification as well as SMS.
Security of the login is one part of keeping money safe; who holds your deposits is another. See is your money safe in a Nigerian fintech.
Where Pryme fits
Pryme does not use SMS codes. Sign-in and approvals use an authenticator app plus a transaction PIN, for both Personal and Business accounts, so the SIM swap route to your Pryme account is closed. See how it works on security, or open an account.
Questions people ask
Is an authenticator app safer than OTP by SMS?
Yes, for most people. The code is made on your device, so a SIM swap or intercepted text does not reveal it.
What happens if I lose the phone with my authenticator?
Use backup codes if you saved them, or follow the provider's recovery process, which usually involves identity checks.
Do Nigerian banks support authenticator apps?
Some banks and fintechs offer authenticator or in-app approval options; many still rely on SMS. Check your app's security settings.
Can a scammer get my authenticator code?
Only if you give it to them or they control your phone while it is open. Never read out a code to anyone.
Sources
- CISA: Guidance on phishing-resistant and number-matching MFA · accessed Oct 2026
- CISA fact sheet: Implementing phishing-resistant MFA · accessed Oct 2026
- NCC: NCC demands MNOs, agents, consumers comply with SIM Replacement Guidelines · accessed Oct 2026
- US FTC: SIM swap scams, how to protect yourself · accessed Oct 2026
This article is general information, not financial, legal or tax advice. Products described are provided under the terms on this site and are subject to regulation and eligibility.