Microsoft Ditches SMS Codes for Passkeys

Microsoft is transitioning personal account security away from SMS codes, a method now deemed a significant source of fraud. The company is promoting the use of passkeys and verified email addresses as more secure alternatives. This change affects users of services including Outlook, OneDrive, Windows, and Xbox.

SMS authentication is vulnerable to scams like SIM-swapping and phishing, which can compromise Microsoft accounts. Passkeys offer a more robust security solution by utilizing cryptography and device-specific authentication methods such as facial recognition or fingerprints.

While SMS codes have been a common security layer, their susceptibility to interception makes them a liability. Microsoft aims to guide users still relying on SMS to adopt passkeys and verified emails before a complete phase-out.

Setting up a passkey involves linking it to a trusted device or password manager. This method bypasses traditional password entry and is significantly more difficult for scammers to exploit remotely. Users are also advised to update their recovery email and remove outdated phone numbers.

Microsoft has not provided a universal cutoff date for SMS codes. However, users will be prompted to add alternative sign-in methods. This proactive shift aims to bolster account security against evolving cyber threats.