Your Locked Phone Is Lying to You About Your Texts

Picture this. Your phone is face-down on your nightstand. You're asleep. Your texts from today — the address you sent your kid, the medication question you asked your doctor, the frustrated vent to your best friend — are sitting in a carrier's database somewhere. And your face unlock? It has absolutely nothing to do with who gets to see them.

Most of us carry around a mental shortcut: locked phone equals private phone. It makes sense. You set up face recognition or a PIN. You feel secure. The problem is that this assumption only covers one very specific type of threat — someone physically holding your phone. It doesn't cover the systems your texts flow through on their way to the person you're sending them to. Those systems are a whole different world, and they have their own rules about who gets in.

SMS Was Never Built to Be Private

Here's something the phone companies don't put in their ads: SMS — the standard text message, the green-bubble kind — was designed in the 1980s to carry short signals between network towers. It was never meant to be a secure communication tool. There is no encryption built into the basic SMS standard. That means your messages travel, and often sit, in a form that the carrier can read. Not theoretically. Actually.

This isn't a fringe concern anymore. In December 2024, the FBI and the Cybersecurity and Infrastructure Security Agency — the federal agency whose entire job is protecting American digital infrastructure — issued a formal advisory. According to University of Tennessee's Security Learning Library, citing that advisory, CISA's direct guidance was stark: "Do not use SMS as a second factor for authentication." That's the federal government telling you, in plain language, that it doesn't trust SMS to protect sensitive actions like logging into your bank.

If it's not safe enough for a login code, think about what else you're sending over it. This article is part of a series — start with Europe Now Scans Your Face At The Border And Keeps It For 3 .

"Do not use SMS as a second factor for authentication." — CISA (Cybersecurity and Infrastructure Security Agency), December 2024, as reported by University of Tennessee IT Security

The Breach You Probably Forgot About

In 2024, AT&T disclosed to the Securities and Exchange Commission — the government body that oversees public companies — that a breach covering parts of 2022 and 2023 had exposed call records and text records for nearly all of its wireless customers. Not a small slice. Nearly all of them.

And it didn't stop there. A separate, highly sophisticated operation known as Salt Typhoon — linked to the Chinese government — was confirmed to have targeted the infrastructure of AT&T, Verizon, T-Mobile, and a company called Lumen. Their goal, according to Alvarez Tech Group, was intercepting SMS two-factor authentication codes — those six-digit numbers companies text you when you log in — to break into accounts at the highest levels. Federal agencies. Senior officials. Your carrier is one of the biggest targets in the world right now, and your texts live there.

None of those people had unlocked their phones. None of them handed a device to anyone. The breach happened entirely at the network level — in systems most people don't even know exist.

The Three Doors You Didn't Know Were Open

Device security and network security are two completely separate problems. Your face unlock closes one door. These three are still wide open.

The real gut-punch here is the framing. We've been trained to think of phone security as a single thing. Lock the screen, protect the phone, done. But "the phone" as we think of it — that warm rectangle in your pocket — is only one node in a much bigger system. Your texts are copies, essentially, spread across multiple places that aren't in your pocket at all.

The Mundane Texts Are the Ones That Matter

Look, most people think: "I'm not a spy. Who would want my boring texts?" But here's what's actually in a normal person's message thread on any given week: your home address sent to a delivery driver, your kid's school pickup schedule, a conversation with your insurance company about a claim, a doctor's office confirming an appointment with your date of birth in the message. That's not nothing. That's a profile of your life.

SIM swapping attacks — where a criminal calls your carrier, pretends to be you, and convinces a customer service rep to move your phone number to their device — have been used to drain bank accounts, take over social media profiles, and lock people out of their own lives. The vulnerability isn't technical genius. It's a customer service rep doing their job, and a system that was built for convenience, not security. SMS was built for human communication. The weakness, more often than not, is deeply human too.

There's also a harder truth sitting underneath all of this. If someone asked you right now to print out your text messages from the last month and hand them to a stranger, you'd probably hesitate. Not because you're hiding anything serious — but because it's private. It's yours. The false comfort of a locked phone screen has made most of us bolder about what we send over SMS than we'd be if we really thought about where those messages travel and sit.

One Thing You Can Actually Do Right Now

The single most useful shift you can make today doesn't require buying anything or learning new technology. Move sensitive conversations — medical stuff, financial stuff, anything that would embarrass you if it showed up somewhere — off of SMS and onto an end-to-end encrypted messaging app. That phrase, end-to-end encrypted, means the message is scrambled in a way that only the sender and receiver can unscramble it. Not the app company. Not the carrier. Not a hacker intercepting the signal. Signal is the most widely recommended option by security professionals. WhatsApp uses the same underlying encryption system. iMessage (the blue-bubble version, only between iPhones) also encrypts messages end-to-end.

The green bubble — the standard SMS — does not. That's the one to stop trusting for anything that matters.

Here at CaraComp, we spend a lot of time thinking about identity — specifically, whether the person in a photo or behind a profile is really who they claim to be. That question, it turns out, connects directly to this one. If someone can intercept the verification texts used to confirm your identity online, your face and your name can be used against you before you ever know something went wrong. Protecting the texts is part of protecting the identity. They're not separate issues.

The uncomfortable final thought? The carriers now logging your app sign-in patterns — ostensibly to make authentication more secure — hold a subscriber database that controls digital account access for hundreds of millions of people. That's an enormous amount of power concentrated in systems that have already been breached. The lock on your phone is doing exactly what it was designed to do. The problem is we were never told, clearly enough, how small that job actually is.

So here's the question worth sitting with: If you knew someone could read your texts without ever touching your phone, would you change what you write — or would you change where you write it?