Standard Short Message Service (SMS) fails a security review because it lacks end-to-end encryption and travels as plaintext across carrier networks, where anyone with network access can read it. AT&T disclosed in a July 2024 SEC filing that intruders copied records of calls and texts covering nearly all of its wireless customers. The second question reviewers ask, which apps are safe for business communication, resolves at the platform layer, where message data resides and where the company governs access.
TL;DR
- Standard SMS is not encrypted, so carriers can read and store every message.
- The real threats sit at the carrier and phone-number layer: SIM swaps, smishing, and network breaches like Salt Typhoon.
- Federal guidance says stop using SMS for login codes, not for operational messaging.
- No vendor can secure the carrier hop, but any vendor can be judged on access controls and retention.
- Never send Social Security numbers, card numbers, or health data over plain SMS.
- SMS-based platforms like Yourco add enterprise-grade security, admin controls, and audit trails that consumer texting and WhatsApp groups simply don't provide.
Understand What Standard SMS Does and Doesn't Protect
The Cybersecurity and Infrastructure Security Agency (CISA) states it plainly in its Mobile Communications Best Practice Guidance, updated November 24, 2025: "SMS messages are not encrypted," and a threat actor inside a telecommunications provider's network who intercepts them can read them. The handset and cell tower apply only incidental transport encryption. SMS also runs on a store-and-forward model.
Every message passes through the carrier's Short Message Service Center, which stores it before forwarding, so the content sits on the carrier's infrastructure, subject to carrier policy and legal processes.
SS7, the 1970s-era protocol that routes texts and calls between carriers, lacks authentication and encryption, which makes it easier for attackers to intercept messages, track locations, and reroute calls or texts, according to the GSM Association (GSMA). Diameter, its 4G successor, inherited the same weaknesses.
Assess Real-World Threats: Salt Typhoon, SIM Swaps, and Smishing
The Salt Typhoon reached the carrier layer itself. The Federal Bureau of Investigation (FBI) and CISA attributed intrusions at U.S. telecommunications providers to People's Republic of China-affiliated actors, and an August 2025 joint advisory found that they were modifying backbone router firmware to establish long-term footholds. The Congressional Research Service reported that those actors could retrieve unencrypted communication such as voice calls and text messages.
Any review of texting risk should include these threat classes:
- SIM swapping: The FBI's Internet Crime Complaint Center (IC3) describes it in a July 2025 advisory as an unauthorized takeover of a victim's wireless account. Once the number moves, every call and text reaches the attacker.
- Smishing: Phishing over text. IC3 reported more than $262 million in losses across over 5,100 complaints since January 2025 for account-takeover fraud involving financial-institution impersonation, with fraudulent texts among the tactics, according to a November 2025 IC3 alert.
- Signaling-network interception: Weaknesses in SS7 and Diameter can expose messages or redirect messages before they reach the intended phone.
- Carrier data breaches: The 2024 AT&T breach exposed metadata rather than message content, and attackers can correlate metadata with publicly available information to infer identities.
These attacks operate at the carrier and phone-number layer regardless of which texting vendor an employer picked. The vendor determines everything above it.
Stop Sending Login Codes Over SMS
CISA's instruction on authentication is unambiguous: "Do not use SMS as a second factor for authentication." The same guidance notes that SMS multi-factor authentication (MFA) is not phishing-resistant, and CISA's MFA fact sheet ranks SMS and voice as a last-resort option vulnerable to phishing, SS7, and SIM swap attacks.
The National Institute of Standards and Technology (NIST) published SP 800-63B-4 in July 2025, and the standard designates SMS one-time passcodes as a RESTRICTED authenticator. NIST expects organizations that retain SMS codes to offer an unrestricted alternative, document the risk, and plan a migration.
That restriction applies to login codes. A login code is a secret whose entire value lies in confidentiality, while a shift alert is operational information whose value lies in reach and speed. For operational employee communication, CISA guidance focuses on keeping sensitive content out of the channel rather than abandoning it. Move authentication to phishing-resistant MFA, and govern operational texting with platform controls.
Separate Last-Mile Limits From Platform and Data Security
Reviewers searching for safe business messaging apps find lists of encrypted consumer messengers, which answers the wrong question for a workforce channel. Every SMS provider shares the same last-mile limitation: once a message hands off to the carrier network, no vendor can encrypt that final hop.
Anyone asking about SMS security for business is asking two questions. Is the message content private, and is the platform holding that content governable? The vendor-specific work sits in the platform that stores records, governs access, and logs activity. A System and Organization Controls 2 (SOC 2) report on a texting platform attests to the platform's own controls over a defined audit period; the SMS protocol remains unencrypted.
Employers choose the controls above the carrier layer:
- Employers decide where the platform stores message data, how long it retains records, and who can export them
- Platform data should use encryption in transit and at rest inside the platform
- Access should follow role scope, with revocation when someone leaves
- Admin and message actions should appear in protected logs
- Company messages should not persist inside an app on a worker's personal device
Every one of those decisions belongs to the employer, not the carrier.
Address the Frontline Reality: Personal Phones, No Email, No Oversight
Many frontline employees lack a corporate email address and access company systems only via a personal phone. Without corporate email or managed devices, office-worker security models never attach to this workforce.
Managers text crews from personal numbers. That exposes numbers in both directions, and crews drift into WhatsApp groups no one in IT approved. Of mobile devices impacted by an attack, 70% are personal rather than corporate-issued, according to the Verizon 2025 Mobile Security Index. Personal devices can retain work conversations, co-worker contact lists, and company materials after employees leave.
Those messages are business records. Courts can treat texts as discoverable in litigation, and carrier retention will not preserve content. Bring-your-own-device (BYOD) arrangements complicate retrieval further when the phone belongs to the worker.
The frontline risk model combines unmanaged data and exposed personal numbers on personal devices with no admin oversight. SMS-based platforms like Yourco put those risks under admin control with platform-level SMS archiving that stores records on the single channel every worker already uses.
Run This Security Review Checklist Before Vendor Approval
Put the same questions to an SMS employee communication vendor as to any software-as-a-service (SaaS) platform handling workforce data:
- Encryption in transit and at rest mapped to NIST SP 800-53 controls SC-8 and SC-28
- SSO and System for Cross-domain Identity Management (SCIM) provisioning artifacts
- Role-based access control (RBAC) scope that follows least privilege
- Audit logging for message and admin actions, with protected log storage
- Data residency and Standard Contractual Clauses for EU workforce data
- Retention controls matched to the records policy, since carriers hold SMS content only briefly and cannot be relied on to preserve records
- Subprocessor transparency, including SOC 2 carve-outs for subservice organizations
- SOC 2 report access: a Type II from the past 12 months, with a bridge letter if the window lapsed
- Penetration tests at least every 12 months and after significant changes, per PCI DSS Requirement 11.4
- Report scope check: SOC 2 requires Security in every audit; check for Confidentiality and Availability
Vendors that answer all ten in writing are worth a pilot.
Draw the Line: What Never Belongs in a Text
The Payment Card Industry Data Security Standard (PCI DSS) addresses primary account numbers (PANs) directly in Requirement 4.2.2, which instructs organizations never to send unprotected PANs via end-user messaging technologies, including SMS, email, instant messaging, and chat.
The Social Security Administration tells the public not to send personal information, especially Social Security numbers, over the internet. Set the floor there: no PANs, Social Security numbers, protected health information (PHI), or similar regulated data over plain SMS.
Operational content, such as shift schedules and safety alerts, still fits within SMS when written policy and platform controls govern the channel. Employers can treat HIPAA (the Health Insurance Portability and Accountability Act), SOC 2, the Telephone Consumer Protection Act (TCPA), and retention policy as review checkpoints rather than channel verdicts.
A texting vendor that stores messages for a HIPAA-covered entity generally signs a business associate agreement before handling PHI. A common approach is to capture texting opt-in during onboarding, since the Federal Communications Commission (FCC) consent-revocation rules, effective April 11, 2025, allow recipients to revoke consent in any reasonable manner.
This information is for general awareness only. For specific compliance guidance, consult with qualified legal professionals.
Govern Every Frontline Message With Yourco
Yourco is an SMS-based employee communication platform built for frontline workforces and for the security reviews that approve them. The platform uses end-to-end encryption, with data encrypted in transit and at rest, and a multi-tenant architecture that keeps each customer's data separate. Message authentication and logging track every send, regular penetration tests and security audits back the platform, and admins work from a centralized dashboard while employees receive standard SMS with no app to install.
Yourco pairs the capabilities frontline teams rely on with the platform controls a security review asks about:
- Access control: role-based access control, single sign-on, and passwordless authentication for admins and managers
- Scoped permissions: admin seats add, remove, and update employee records and message the whole workforce, while manager seats reach only the locations, groups, departments, or individuals they are granted, with admins retaining visibility across all of it
- Directory-controlled sending: only employees in the company directory can send or receive on the company number, and removing someone ends their messaging and revokes their file access
- Number privacy: employee cell numbers stay hidden from other employees, including on all-employee and group sends, and admin and manager numbers sit behind the dedicated company number
- Custom dedicated numbers: messaging runs on company numbers that lower phishing risk and give employees a consistent sender to trust
- Locked file sending: files go out as links rather than attachments, and a locked file texts a single-use PIN to the employee's own number before it opens
- SMS to any phone, including basic flip phones, with no app installed on a personal device
- Two-way messaging so employees respond and report issues through one archived channel
- AI-powered translation across 135+ languages and dialects
Yourco's 240+ HRIS and payroll integrations sync the roster from the Human Resource Information System (HRIS) of record, adding and terminating access on employment status, so messaging lists never run on a manager's saved contacts. For multi-location organizations, Enterprise Bridge supports one-way broadcasts from corporate leadership to the entire frontline, with custom data retention policies and e-discovery tools for enterprise records requirements.
Frontline Intelligence provides IT and HR leadership with centralized visibility into frontline messaging activity across all locations. Corporate teams can review communication patterns by site or department from a single dashboard, rather than collecting exports from individual managers, thereby supporting the oversight an enterprise security review expects.
Organizations with large frontline workforces describe the difference one governed channel makes.
"We have nearly 700 employees and 80% are non-desk based, communication is a challenge. Yourco provides a quick easy way to reach everyone and a secure way for employees to reach HR and leadership without a computer."
— Felisha Parker, VP Human Resources, McCarthy Auto Group
After 90 days with Yourco, two-way employee engagement increased to 86%.
Try Yourco for free today, or schedule a demo to see the difference the right workplace communication solution can make for your company.
Frequently Asked Questions About SMS Security for Employee Communication
Is SMS encrypted?
No, standard SMS has no end-to-end encryption. The carrier's message service center stores and forwards every message, where it sits in readable form, and the only protection is incidental transport encryption between the phone and the cell tower.
Is SMS-based 2FA secure?
No, as far as two-factor authentication (2FA) goes, SMS one-time passcodes are the weakest option because SIM swaps or exploitation of the signaling network can intercept them. Use phishing-resistant multi-factor authentication for logins, and reserve SMS for operational communication.
What are SIM swap and SS7 attacks?
A SIM swap is a form of fraud in which an attacker convinces a carrier to reassign a victim's phone number to a device they control, capturing every call and text. An SS7 attack exploits the legacy carrier signaling network to intercept messages, reroute calls, or remotely track a phone's location.
Is RCS more secure than SMS?
Sometimes, person-to-person consumer Rich Communication Services (RCS) chats now support end-to-end encryption when both devices and carriers support it. RCS Business Messaging is not end-to-end encrypted, and businesses, messaging providers, and carriers may access content, so RCS does not change the security picture for enterprise messaging.
Is SMS HIPAA, SOC 2, or TCPA compliant?
Compliance depends on governance, consent, retention, access controls, and the data sent through the channel. Covered entities should keep protected health information off plain SMS. SOC 2 attests to a platform's controls, not the SMS protocol, and the TCPA governs texting consent. SMS-based platforms like Yourco maintain archived, timestamped records.
Is texting or email more secure?
Email and text both lack end-to-end encryption by default, but they fail in different ways. Email offers more filtering layers and admin controls, while SMS gives defenders fewer signals to evaluate, which makes smishing harder to catch. For reach, SMS reaches frontline workers who lack corporate email, provided a governed platform manages the channel.
