It depends. Using SMS as a second (!) factor is fine. There are better options, but SMS is much better than no second factor at all. What you absolutely should

It depends. Using SMS as a second (!) factor is fine. There are better options, but SMS is much better than no second factor at all. What you absolutely shouldn't do is allowing password reset only via SMS token, because it's often not that hard to get access to SMS codes via social engineering (convincing a store clerk to issue a new SIM card, or stealing a phone and getting the code displayed on the lock screen) Having SMS as second factor requires the attacker to know the password AND do some social engineering. It's a significant security improvement over password only. SMS might even be safer than password less passkey login, if the user's passkey implementation is unsafe. It's possible to store passkeys in password managers, and people regularly manage to get their vaults compromised. This might only require a keylogger on a PC where the user logs in to the password manager.