Most mobile carriers transmit SMS as unencrypted data across their networks and store messages in plain-text format. Despite this, many of us still use SMS to receive One-Time Passwords (OTPs) for our most sensitive accounts–from banking to social media and more. A 2026 Harris Poll commissioned by Cape shows that, in spite of the availability of more secure options like authenticator apps or hardware security keys, SMS continues to be the most popular two-factor authentication (2FA) method, used by 54% of Americans. That’s because nothing beats SMS in terms of convenience, and many services mandate it as the only option for identity verification.
Because SMS messages travel in plain text, anyone who intercepts them can read them instantly, leaving us vulnerable to a range of threats:
- SS7 or Signaling Attacks: Attackers can exploit flaws in global roaming protocols to trick the system into rerouting your SMS directly to them.
- Rogue Base Stations: Stingrays or IMSI catchers impersonating legitimate towers can trick your phone into connecting to them. Once connected, they can “see” your SMS traffic as it passes through.
- Compromised Infrastructure: Even legitimate, certified telecom base stations can be compromised. In 2025, Korean authorities disclosed a nearly “undetectable” compromise of femtocells (mini-base stations) that allowed hackers to intercept SMS and hijack financial accounts.
- Malicious Apps: If a malicious app gains SMS permissions, it can read your messages directly from your device, where they are stored without protection.
At Cape, we’ve always believed that security and convenience shouldn’t be mutually exclusive.
That’s why Cape’s Secondary Numbers are Last-Mile Encrypted. While true end-to-end encryption isn’t possible for SMS (as the protocol required decryption for carrier interoperability), we’ve engineered a middle-to-end encryption layer for greater defense-in-depth.
When Last-Mile Encrypted Texting is enabled:
- Cape encrypts your SMS/MMS Secondary Number messages the moment we receive them, and delivers them securely through the Cape app. Even if your SMS were intercepted somewhere between Cape and your phone, it’s unreadable without the private key stored on your device.
- Our physical infrastructure partners cannot see or log your SMS/MMS messages.
- You can optionally set your messages to auto-delete after 1, 7, or 30 days.
How to get started
On January 27th, 2026, Cape exited our beta and launched several new features, including Secondary Numbers, Secure Global Roaming, and Identifier Rotation (for iPhone & Pixel). For our other new features, you can find access instructions here.
Share it
