Sydney, Australia — Macquarie Bank has issued a stark warning about the increasing vulnerabilities of SMS-based two-factor authentication (2FA), calling it outdated and inadequate for defending against modern cyber threats.
According to Olivia McArdle, Macquarie’s Head of Deposits, relying solely on SMS for verifying banking activity is no longer sufficient. “We believe that the days of Australian banks depending solely on SMS to verify customer account activity are numbered,” McArdle said, highlighting the need for more robust digital protections (source).
The warning follows a wave of high-profile cyberattacks on Australian superannuation funds, where hackers used “credential stuffing” — employing stolen usernames and passwords — to breach accounts. SMS 2FA often fails to provide users with clear or immediate context, making real-time fraud prevention difficult.
In response, the bank is encouraging customers to switch to the Macquarie Authenticator app, which has surpassed one million users. The app sends push notifications with detailed information about transactions — including amounts, accounts involved, and location — empowering users to spot and stop fraudulent actions quickly.
Two levels of protection are offered: Enhanced Mode and Ultimate Mode. The latter requires multi-factor verification for every login, any changes to the account, and all transactions. It also logs both successful and failed login attempts, complete with their origin locations — a crucial tool as cybercriminals refine their techniques.
While many customers still rely on SMS, Macquarie advises vigilance against impersonation scams, spoofed sender IDs, flash SMS attacks, and phone porting fraud — all of which allow criminals to intercept text messages.
This move by Macquarie reflects a broader industry trend toward proactive security, transparency, and customer empowerment. As cybercrime intensifies, banks are being pushed to adopt smarter authentication systems that go beyond the limitations of one-time SMS codes.
The shift could soon set a new benchmark for digital banking security in Australia — and send a clear message to consumers: evolving threats require evolving defenses.
