Deprecation of SMS-based multi-factor authentication (MFA) mode

Deprecation of SMS-based multi-factor authentication (MFA) mode

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.


Update (December 26, 2025) - Announcement page to be shown for administrators

We’re adding a new announcement page during sign-in to help organization admins currently enforcing SMS-based OTP switch to more secure MFA modes. If you're an organization admin, you’ll be asked to update the organization's MFA method by selecting from alternatives such as OneAuth, OTP Authenticator, or Security Key. Please make sure to update your organization's security policy to stay protected and comply with the new MFA requirements.

This announcement will be in effect from 29th December, 2025 (Monday).


Info
Note: Other users who currently use SMS-based OTP will receive a corresponding announcement and guided flow soon. We will update in this post once it’s available. Users can also switch to a more secure MFA mode anytime from the Multi-factor Authentication section in the Accounts page (accounts.zoho.com).

If you have any questions, please write to us at support@zohoaccounts.com.



    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

    • Recent Topics

    • How do I increase the email attachment size in Zoho CRM ?

      It looks like I'm limited to 10MB when sending an attachment using the email widget on a record in Zoho CRM. Is there a way to increase the size? Or can I use some other tool? From what I'm reading online, I'm maxed out at 10MB. Any insight would be greatly

    • Cross Module Filtering – Use Fields from Lookup modules in Custom Views criteria and Advanced Filters

      Hello everyone, Zoho CRM now enables you to achieve deeper filtering of records in a module, using fields of a lookup, thereby enhancing your data management experience manifold. This filtering based on lookup module fields is now available in advanced

    • CRM Integration - Option to Sync Reporting Tags

      It would be nice to be able to sync reporting tags in Zoho Finance to a custom field in Zoho CRM. My use case is for a Customer in Finance to an Account in CRM (and vice-versa, of course), but I'm sure it's pretty obvious that this could also be used

    • Separator line

      Is there a way i can insert a line in an invoice or quote without showing qty or prices? e.g. Options I Item description qty and price Option II Item description qty and price Thanks

    • Global Constants / Variables

      It would be great if there were a Global Constant feature. The idea here is for managing constants that are used in multiple Flows and Subflows, but might change over time. The idea is that the change could be made in one place and cascade to all future

    • Do Not Disturb status not respected when Cliq bar is enabled across Zoho apps

      Hi Zoho Cliq team, I want to report what appears to be a bug with how the Do Not Disturb status interacts with the embedded Cliq bar in other Zoho apps. **Issue:** When my Cliq status is set to Do Not Disturb, I continue to receive notification tones

    • Customer image field

      I created a custom image field for estimates, and it works as expected. The only issue I have is that I want to be able to place the custom image field in the estimate invoice. Is there a way I can do that, the field does not give the option to display

    • Gemini Action - Add "inineData" Support

      Thank you guys for adding a Gemini action. I like Gemini models for the "grunt work" of AI, as they have the cheapest tokens of the trustworthy providers One thing that's missing in the action, though, is the ability to pass file data. If you pass a base64-encoded

    • Drop shipment cancellation

      Hello! I have a problem and need a piece of advice. Me and my customer had a deal. I have created all the documents ( SO, PO, Invoice, Bill), however, unfortunatelly, we have to cancell it. Now, I would like to mark all these documents as void. At the

    • Specific ListView Canvas on Canvas Home Page Always Loads Most Recent ListView, Not the One Specified

      I had mentioned this to ZOHO, but I mainly wanted to see if others in the Community are also facing this problem. I created a Canvas ListView for a Custom Module, and then created a Canvas Home page (technically on a tab item, but I'm not sure if that

    • New UI - Color Preference Not Saving Permanently

      Small, not very urgent problem I'd like to share regarding the new UI theme color. I've changed my theme preference to the default blue color around 20 times by now. It always reverts to a green color theme. I've followed the instructions of changing

    • Zoho Wont Login

      Can anyone tell me why my password stops logging in all the time? Is it a ploy to make you change your password? I have to use OTP all the time. I dont want to change passwords all the time. Over the last couple of years I've found myself using Zoho (as

    • Collapsible Sections & Section Navigation Needed

      The flexibility of Zoho CRM has expanded greatly in the last few years, to the point that a leads module is now permissible to contain up to 350 fields. We don't use that many, but we are using 168 fields which are broken apart into 18 different sections.

    • Global Sets for Multi-Select pick lists

      When is this feature coming to Zoho CRM? It would be very useful now we have got used to having it for the normal pick lists.

    • Cannot See Available Deal States in Zoho Blueprint

      I am trying to create a blueprint to manage our sales pipeline and ensure data accuracy at each stage. I have already created a similar blueprint for handling leads. However, when I attempt to create the 'Deal Management' blueprint, the different stages

    • Is there a CRM Deluge function available to convert an RTF (rich text field) to plain text (with no formatting tags)?

      I know that we can run reports so that RTF fields can either show as plain text or the text or the text with the formatting fields included (which is wonderful, btw, as it helps me adjust tags when I need to troubleshoot and just see what I need to see

    • Como conectar a API de Conversões da Meta com a Zoho (Analytics, CRM e SalesIQ)?

      Não estou conseguindo saber de quais anúncios são os leads que chegam pelo SalesIQ e nem como retornar a informação pra Meta dos leads que tiveram conversão em venda.

    • IMAP Migration — Map Sent Items to Sent....

      Here's a common problem. The Sent folder on the other email service is called Sent Items. Rather than put those into the Sent folder on migration, it creates a separate folder. Is there any way I can have this done as part of the migration process. One of the Sent Items on an account I expect to migrate shortly has 25,000 messages. Manually moving them would be time-consuming and work against the migration feature. Solutions? Peace, Gene Steinberg

    • Tips & Tricks Series - #3 Setting question weights in quiz questions

      Hello everyone! Welcome back to our Tips & Tricks series, where we share useful features and best practices to help you get the most out of Zoho Learn. Today, we’ll be looking at question weights in quizzes. Not all questions in a quiz need to carry the

    • TimeBro/Memtime Time Tracking Import Errors

      Our staff use Memtime (formerly TimeBro) to track working time, and we have the Zoho Projects integration installed, so that the entries are mapped to Projects/Tasks/Issues automatically. Today, we've started getting the following error when attempting

    • Zoho Visual Editor Not Opening

      Hello There I am trying to build a website using zoho and I can't open the visual editor. It keep saying Loading...  Do you know why it is happening. Thanks in Advance Regards Rajat

    • Automate Backups

      This is a feature request. Consider adding an auto backup feature. Where when you turn it on, it will auto backup on the 15-day schedule. For additional consideration, allow for the export of module data via API calls. Thank you for your consideration.

    • Tip #85 – Never Lose Track of What Happened in a Session with Session Recording – 'Insider Insights'

      Tip #85 – Never Lose Track of What Happened in a Session with Session Recording – 'Insider Insights' Hello Zoho Assist Community! A technician wraps up a complex remote session. The issue is fixed, the customer is happy, and everyone moves on. But three

    • LinkedIn RSC is now live in Zoho Recruit

      LinkedIn Recruiter System Connect (RSC) is here. Your Zoho Recruit data (candidates, jobs, notes, stage updates, resume attachments, and more) now syncs with LinkedIn in real time. Note: LinkedIn RSC is included with your LinkedIn Recruiter Corporate

    • Turn off workflow Applied pop-up

      hi We are new to Desk. I have a rule to set to "waiting for customer" when agent sends reply. This comes up every time. How to i turn off? Or am i seeing as admin.

    • Make your IM workflows smarter: Automate sessions and personalize responses

      There are two simple ways to make IM workflows more efficient: automate how sessions are handled and personalize how agents communicate. Here's a look at both. 1. Automate IM session updates with the API The Update an IM Session API lets you update session

    • Discover related products for contacts and companies with new topping

      Greetings! We hope you're all doing well. We've heard your request for an easier way to view products associated with a contact or company—without having to open and go through every deal individually. To help you achieve this, we're happy to introduce

    • What’s New in IM: Shared Phone Number and 1,000 Templates

      Instant Messaging continues to evolve in Zoho Desk, giving teams more flexibility in how they manage WhatsApp conversations and messaging workflows. Here are two capabilities worth exploring. 1. Manage WhatsApp conversations across Zoho services using

    • Cliq iOS can't see shared screen

      Hello, I had this morning a video call with a colleague. She is using Cliq Desktop MacOS and wanted to share her screen with me. I'm on iPad. I noticed, while she shared her screen, I could only see her video, but not the shared screen... Does Cliq iOS is able to display shared screen, or is it somewhere else to be found ? Regards

    • CLIENT PORTAL (If clients can place orders directly on the portal)

      Zoho client portal is excellent. Everything is there except one thing. Client should be able to place orders directly on the portal. This would enhance the portal and end users will be extremely happy. This suggestion infact came from one of our client.

    • Exceed Limit Execution

      Hi Everyone, I begin to encounter some execution limit hit, The 1st part wherein when a record was being submitted, it checks and patch existing rows (Site Asset Services) matching the submitted row (PMS form) error: row1.Serial_N=Final_Rec.AV_Serial_N;

    • [For info] As CRM administrators its important to be aware that potentially sensitive business logic & operational parameters are available via unauthenticated URLs

      There are a collection of files within Zoho CRM that COULD contain potentially sensitive commercial parameters and logic in them, and that can be accessed without authentication. This includes the CRM Data Model, Custom Picklist values, Custom Role /

    • WhatsApp Calling Integration via Zoho Desk

      Dear Zoho Desk Team, I would like to request a feature that allows users to call WhatsApp numbers directly via Zoho Desk. This integration would enable sending and receiving calls to and from WhatsApp numbers over the internet, without the need for traditional

    • View Products (items) in Contact and Company

      Hi, I would like to know if there is an option to view all the products /(items) that were inserted in the pipeline deal stage for exemple "Win Pipeline" within the company and contacts module section? For instance, view with the option filter for the

    • zoho desk

      Hello, Did Zoho Desk have any issues today? Are tickets coming in late? I have an email account linked, and messages seem to be arriving with a delay—some email threads aren't coming through completely, and so on.

    • Transform your line of items into line items: ICR can now record your table values as subform values

      Enhancement in Zoho CRM Dear Customers, We hope you're well! Zia Vision’s ICR capability can now recognize, extract, and store tabulated values in your subforms. An ideal example is a university application form. It has printed fields and handwritten

    • Minor enhancements in Zoho CRM Dashboards: drill-down for Funnels, flexible Duration settings, and more

      Dashboards in Zoho CRM help you visualize data across modules, track performance, and make informed decisions. Components like charts, KPIs, and funnels bring together key metrics in a single view, making it easier to spot trends and take action. Over

    • Get a realistic picture of your revenue with Forecast Adjustments in Zoho CRM

      #crm25q1 Dear Customers, We hope you're doing well! Today, we're here with an important enhancement for business decision makers: forecast adjustments. Let's get straight to it! With technology on the rise and CX at its core, businesses are constantly

    • Three new ways to manage Instant Messaging in Zoho Desk

      Managing IM conversations isn't just about responding to customers. It's also about getting each conversation to the right team. Here are three updates in Zoho Desk that can help with exactly that. 1. Transfer IM tickets across departments Sometimes a

    • Ask the Experts 32: Managing Privacy, Security, and Data Administration in Zoho Desk

      Hello everyone, As organizations increasingly rely on AI, machine learning, and automation, there are pressing questions around privacy, security, and data governance. Every customer interaction involves sensitive business information, whether it's troubleshooting

    • Next Page