Microsoft to phase out SMS authentication for account recovery

Tech Radar reports that Microsoft is phasing out SMS authentication and recovery methods for its accounts due to increasing fraud risks. The company is actively encouraging users to adopt more secure, passwordless authentication options.

Microsoft has announced it will begin phasing out SMS-based authentication and account recovery, citing it as a leading source of fraud. While a specific timeline for the complete phase-out was not provided, the company emphasized its commitment to a passwordless future, promoting alternatives like passkeys and verified email. Passkeys utilize cryptographic keys stored on a user's device and the service, offering enhanced security against phishing and data breaches through methods like fingerprint or facial scans. However, concerns have been raised by researchers regarding potential browser-based vulnerabilities in passkey workflows.

Despite these concerns, the move away from SMS, which has long been criticized by security experts for its susceptibility to SIM-swapping attacks and general insecurity for two-factor authentication, is seen as a positive step for account security.

Source: Tech Radar