The 1:14 AM Login Alert That My SMS Backup Would Have Missed

The alert said Singapore. I was in my apartment in Toronto, awake cuz of a sick cat, and at 1:14 AM my phone lit up with two notifications in a row: a new login attempt on my exchange account, and a password reset request. Neither was me. The cat stared at me like I had caused this personally.

The attempt failed. Not cuz I am clever — because the second factor was a rotating code from an app on my phone, and the person on the other end of that login form did not have it.

the two kinds of second factor

Most people, myself included til that night, treat all two-factor as one feature: "I have two-factor, I am protected." There are actually two awfully different creatures wearing the same label. A code sent by text message is a second factor that travels over the phone network, in plaintext-adjacent conditions, to a little SIM card in your pocket. An authenticator app generates the code on the device itself, offline, touching no network on its way to your eyes.

The difference is academic right up til someone manages to intercept or redirect your texts. Then it is the difference between a locked door and a stage prop.

why I had already made the switch

The honest answer is boredom, not foresight. Two years earlier, my carrier was doing network maintenance and my texts were delayed for two days. During those two days, my bank codes arrived late and one exchange code never arrived at all, and I missed a time-sensitive login cuz of it. Annoyed, I moved everything I could to an authenticator app and forgot about it.

That is worth pausing on. I did not make the switch for security. I made it for convenience, and it sat there quietly for two years waiting to matter. Plenty of good security works exactly like that — you install it cuz of a slight annoyance, and it repays you once, enormously, at 1:14 AM on a random Tuesday.

what happened during the next twenty minutes

After the failed attempt, I did the checklist while the kettle boiled. Changed the password from a different device. Reviewed active sessions and revoked two I did not recognize — an old tablet and a browser I had used at a print shop, which is its own lecture I gave myself later. Checked my email account for forwarding rules, because that is the quieter way in. Emailed the exchange's support with the timestamps.

Then, cuz I was already awake and furious, I looked at my phone plan and found the detail that turned my relief into something colder: my account still had SMS listed as a recovery fallback for one service I had never migrated. The front door had a steel lock and one window was propped open with a spoon. That got closed the same night, and recovery codes moved to paper in a drawer.

the uncomfortable question of who it was

I will never know. The IP resolved to a commercial hosting provider, which tells me approximately nothing except that this was automated infrastructure, not one guy in a hoodie reckoning. The likeliest story is boring: my email address appeared in some old breach list years ago, my password from that era was reused somewhere that got dumped, and a script tried its luck against my exchange login at scale, along with ten thousand others, at 1:14 AM.

That is the part I want people to sit with. I was not targeted. I was swept. Automation does not care who you are; it just runs all night against every address on a list, and the only variable it cannot brute force is a six-digit number that lives on your phone and dies every thirty seconds.

what I tell friends who resist the app

The pushback is invariably friction. "What if I lose my phone?" You will not lose your phone more frequently than your number gets intercepted, and even if you do, the recovery codes on paper solve it. "Texts are fine, nobody wants my account." Nobody wanted mine either. The script that hit me did not want my account; it wanted any account, and mine just happened to be next on a list.

fifteen minutes per service

The switch takes about fifteen minutes per service. Download the app, scan a square from the security page, print the backup codes, done. I timed my sister's migration last spring: eleven minutes, including an argument about whether her cat could sit on the keyboard.

the quiet afterward

The failed login at 1:14 AM was the only attempt of its kind, as far as the logs show. Nothing else came. My account sat there, guarded by an offline code generator, uninteresting to scripts and honestly arduous for anything smarter.

I still think about how close the whole thing was to a different story. One toggle in a settings menu, made two years earlier outta irritation with slow text messages, stood between me and writing an awfully different article about an emptied account. Security is rarely cinematic when it works. It is one buzz at 1:14 AM, a kettle boiling, and a sick cat watching you type a new password — the most boring crisis I have ever been grateful to have.