SMS traffic travels without encryption, and prior disclosures have shown that stored text messages can remain accessible long after delivery.

Many online services now rely on sign-in links or codes delivered through text messages instead of traditional passwords, which reduces steps during account access and avoids storing password databases, which attackers often breach.

Despite the convenience, SMS remains an unencrypted communication channel, which makes it vulnerable to interception, reuse, and long-term exposure.

And now, a new technical review has examined more than 322,000 unique URLs drawn from over 33 million SMS messages tied to more than 30,000 phone numbers, finding the messages linked to at least 177 digital services, including platforms offering insurance quotes, job listings, and personal referrals.