Apple’s Two-iPhone Handoff Isn’t Really an SMS Security Story

Apple's new two-iPhone Handoff capability has raised concerns about SMS duplication. But multi-device phone-number access has existed for years, and the more important security question is what happens when an attacker gains enough control over an Apple Account and trusted-device ecosystem to access far more valuable credentials.

By way of context, Apple's new iPhone Handoff capability allows the same phone number to be used across two iPhones. Calls, messages, voicemail and other data can follow whichever iPhone the user is actively using. Only one iPhone is active on the T-Mobile network at a time, and both devices must be associated with the same Apple Account*.

But there’s a major risk: SMS forking. Essentially, if messages associated with the same number can appear across devices, what does that mean for SMS one-time passwords?

Handoff is already raising important questions about SMS duplication, but the capability has existed for years (as can be seen with T-Mobile DIGITS). The more consequential risk is what happens when the Apple Account itself is compromised.

If an attacker has gained sufficient control to establish an unauthorized trusted device, and ultimately gain access to the victim's synchronized credentials, intercepting an SMS OTP may not be the first concern.

SMS forking is an old problem in a new wrapper

There is an important distinction between Apple's Handoff capability and a traditional SIM swap. In a SIM swap, an attacker targets the carrier, attempting to transfer the victim's phone number to a SIM or eSIM under the attacker's control. If successful, the attacker will receive calls and SMS messages intended for the legitimate subscriber, but on a separate device.

Handoff operates differently. Both iPhones must be associated with the same Apple Account, and the additional iPhone must go through Apple's enrollment process. An attacker cannot simply enter someone's phone number into another iPhone and begin receiving their messages.

So, the security question quickly becomes larger than SMS: What must an attacker compromise to get their device accepted into the victim's trusted Apple environment?

Because of that, the threat model changes. The Apple Account now sits at the center of an ecosystem encompassing trusted devices, account recovery, iCloud data, messages, passwords, passkeys and other services. As more of a user's digital identity becomes portable across that ecosystem, the process governing which devices are allowed into it becomes increasingly important.

Persistent Identity Management: Infrastructure for an AI World

Learn how persistent identity management connects, authenticates, and continuously manages verified identities, helping organizations protect against today's threats while preparing for an agentic future.

Read the Whitepaper →

If you can reach the credentials, SMS becomes the secondary concern

Consider what an attacker is actually trying to accomplish.

Intercepting a six-digit OTP could enable an account login or transaction, and that’s hugely valuable. But if an attacker has gained sufficient control of the victim's Apple environment to establish an unauthorized trusted device and obtain access to synchronized credentials, the potential blast radius is dramatically larger.

Apple's iCloud Keychain makes passwords and passkeys available across a user's approved Apple devices. Apple says Keychain is end-to-end encrypted and specifically designed so that passwords and passkeys remain protected even if the Apple Account itself is compromised. A new device cannot automatically retrieve Keychain simply because someone knows the Apple Account password; Apple places additional protections around device approval and Keychain recovery.

But that distinction makes trusted-device security more important, not less. If an attacker can defeat those additional controls and get an unauthorized device approved for Keychain access, synchronized passwords and passkeys can become available on that device. Apple's own documentation says that once an additional device is approved for iCloud Keychain, Keychain begins updating on it.

At that point, SMS is just one part of the exposure. The more significant risk is access to synchronized credentials and the downstream accounts they protect.

Synced passkeys change the threat model

Passkeys are a major security improvement over passwords. They replace reusable shared secrets with public-key cryptography and are highly resistant to phishing. But many passkeys are also designed to synchronize across devices through services such as iCloud Keychain.

As a result, security teams need to ask both whether an attacker can steal a credential and whether an attacker can make an unauthorized device an approved place from which a legitimate synchronized credential can be used.

Apple has designed significant protections around this process. New devices join the iCloud Keychain synchronization circle by being sponsored by an existing Keychain device or through Keychain recovery. Apple also requires two-factor authentication for Apple Accounts using iCloud Keychain.

The architecture is designed to prevent an Apple Account password alone from providing access to synchronized credentials. But it also demonstrates why device enrollment and account recovery have become part of the authentication security boundary.

Attackers don't necessarily need to break a passkey's cryptography if they can compromise the processes determining which devices are authorized to use it.

SMS still has a security problem

None of this makes SMS OTP secure. NIST classifies authentication over the Public Switched Telephone Network (PTSN) as a restricted authenticator and advises organizations to consider signals including SIM changes, device swaps and number porting before delivering authentication secrets over the PSTN.

The deeper problem is treating receipt of an OTP as equivalent to proof of identity. A code proves that someone has access to a communication channel at that moment. It does not independently prove who that person is. For financial institutions and other high-value digital services, SMS possession should be one signal within a broader trust decision incorporating device history, telecom intelligence, identity information, account changes and behavioral context.

‍

* Details can be found here:

• MacRumors: AT&T Responds to iOS 27's New iPhone Handoff Feature
• MacRumors: iPhone Handoff Carrier Support and Availability

‍