Microsoft officially announces the end of SMS codes for verification on personal accounts.
Microsoft is moving away from SMS-based authentication for personal accounts, as first noted by Windows Latest. According to Microsoft, SMS verification no longer meets security standards and is vulnerable to phishing and SIM-swap attacks. On its support page, the company encourages users to switch to passkeys.
Security standards
“Microsoft is committed to improving security standards, and therefore we will begin phasing out SMS as a method for authentication and account recovery for personal Microsoft accounts,” the company stated on its support page.
According to Microsoft, SMS codes are increasingly being exploited by cybercriminals and represent a weak link in security processes. By switching to passkeys and verified email, users can better protect their accounts against fraud and phishing.
Passkeys
The next time you log in, you will be asked to add a verified email address and set up a passkey. Passkeys are digital keys that use your device’s built-in authentication, such as facial recognition, fingerprint, or a PIN. Last year, Microsoft added support for passkeys in 1Password and Bitwarden.
According to Microsoft, passkeys are phishing-resistant and offer reliable recovery options. Users can continue to recover their accounts via email and don’t have to worry if they lose their phone or get a new number.