Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer
    • Recent Topics

    • How to apply a tag to a ticket based on the to email address?

      I need to assign a tag to a ticket if the ticket was sent to a specific email address. For example, we have the email accounting[at]company.com forwarding into Zoho Desk. We would like all emails that were sent to this address to be tagged with an Accounting
    • How to work with getFieldNames formdata functions ,Any Examples

      I don't find any example showing usage of getFieldNames. Where do i find .is there any Help documents available
    • Ecommerce integration with prestashop

      Development of campaigns integration with prestahop. When???
    • Cannot associate event with other objects when creating?

      I am attempting to associate an Event with one or more other objects when creating it via the API. According to the API docs, the "Related_To" property is a jsonobject even though the description says "Provide the details about the entities the event
    • Zoho Cliq not working on airplanes

      Hi, My team and I have been having this constant issue of cliq not working when connected to an airplane's wifi. Is there a reason for this? We have tried on different Airlines and it doesn't work on any of them. We need assistance here since we are constantly
    • can i show alert when i finish running the function?

      how i can show alert inside the custom function or popup notification. when i use alert inside the custom function it show this error Error at line number:  2 'ALERT' task can be used only in on load, on validate and on change actions ​
    • Validation Rules Trigger on Untouched Fields

      In Zoho Desk, validation rules trigger for ALL fields during an update—even fields that weren't modified in the current edit. This behavior is fundamentally different from Zoho CRM and other Zoho products, where validation rules only apply to fields actually
    • Departments in Zoho

      I'm trying to set up a department. It looks like Departments have been removed from Zoho One. Is there another option? We have our main account setup, but want to set up a separate small department that can't see our tabs.
    • How to disable subform records dynamically

      Hi Everyone I have a requirement to dynamically disable or hide subform fields based on certain criteria. However, the code I tried didn't work as expected. It either disabled or hid all the fields in all subform records or none at all. What I actually
    • Client Script Operate Timeout

      Hi Zoho, I have set a client script that use for ( i =1; length < i , i++) to fetch all of the product in order I have an order have 30+ products, seems this script will be stopped when it is checking rough 10 + products because of timeout (may be). May
    • Why and When to Manually Regenerate Reports?

      What is the protocol for needing to regenerate reports?  It is very confusing when data in reports pulls correctly sometimes, but are inaccurate other times.   Why is report regenerating necessary at all - can the report function not read the live data as inputted into the forms?  We have built lots of reports and it is very tedious and time consuming to have to regenerate the report before each use of that data to make sure it is accurate.  Is there a way to know when a report should or shouldn't
    • Import template from Zoho Writer

      I am trying to import a mail merge template - tried to import direct from my .docx file on my hard drive and the formatting went all over the place. I then imported the .docx file in my Zoho Docs and then fixed up the formatting within Zoho Writer. Can
    • CRM for Everyone - More Actions Option to Create Record

      Please consider the option create a new record for the module from the More Actions menu. I know there is an "Add New" icon further down the menu to create a record for any module, but this just seems more intuitive and could reduce the need for the "Add
    • Configuración

      Hola acabo de instalar Zoho CRM y quiero configurarlo correctamente. Al respecto me surgen algunas dudas tales como la diferencia entre: Cuentas, posibles Clientes y Contactos. ¿Conceptualmente que son cada uno? ¿Como se se relacionan entre ellos? Si
    • Is there a way to request a password?

      We add customers info into the vaults and I wanted to see if we could do some sort of "file request" like how dropbox offers with files. It would be awesome if a customer could go to a link and input a "title, username, password, url" all securely and it then shows up in our team vault or something. Not sure if that is safe, but it's the best I can think of to be semi scalable and obviously better than sending emails. I am open to another idea, just thought this would be a great feature.  Thanks,
    • Enhancements to Custom Connectors in Zoho Creator

      Hello everyone, At Zoho Creator, we believe in providing you with the necessary tools to achieve a well connected ecosystem of apps. Our Custom Connectors feature is a testament to this, enabling you to integrate with a wide range of external services
    • AutoScan Not Working Since April -Support says it with engineering

      Hi there, Autoscan has not been working on my account since April. Without this feature, completing expenses reports is laborious and error-prone. I keep asking for updates seeing as this is a critical feature, but told that it's being looked into and
    • Clone a Module??

      I am giong to repurpose the Vendors module but would like to have a separate but very similar module for another group of contacts called Buyers. I have already repurposed Contacts to Sellers. Is it possible to clone (make a duplicate) module of Vendors
    • Zoho books bulk update for invoices

      Hi Zoho team, Why only 25 invoices can be bulk update at a time. I am booking 800 to 900 invoices in a month. Please increase this limit? Please dont tell that you dont have enough request for this task. 25 limit for bulk update is too much low
    • Querying CloudSQL using NodeJS?

      How can I query CloudSQL over nodejs? Are there any rest apis from which I perform Select Queries in the data of a Workspace? In the v1 we had C#, Python, Java for CloudSQL Now I only see Java? I am confused about the overall API of Analytics, there any
    • How can I move a ticket from Department A to Department B?

      Hi there, how do I move ticket from Department A to Department B? I went in the ticket and tried to scroll down the menu under the "department" but it won't let me, I am a support admin. Did I do anything wrong? or am I doing it in the wrong place?
    • Sending Email with Attachment (PDF, Excel file)

      Hi, I'm new to Zoho CRM and I'm setting up a flow to send an Email with Attachment when user reaching a certain stage of a Deal. In detail, I've created a Blueprint which requires user to attach a PDF file when reaching a certain point of the stage and
    • How to Integrate Zoho CRM with Traffic Rider Mod APK Unlimited Money?

      Hello, I am exploring the possibilities of integrating Zoho CRM with a mobile game app. I am working on a Traffic Rider Mod APK Unlimited Money version where we want to store user engagement data like session time, high scores, and in-app interactions.
    • Rename Record Templates in Zoho Creator

      Hi Team, I need to rename the Record Templates based on the name of the employee which i have configured in Zoho Creator Deluge Script. How to do this one? // Attachments :template:PDF_ECF:Exit_Clearance_Form input.ID as PDF
    • Les Zoholics 2025 sont de retour

      Bonjour à tous, Préparez-vous pour deux jours exceptionnels au cœur de l’écosystème Zoho ! Nous avons le plaisir de vous convier à Zoholics France 2025, un événement dédié à l’innovation, à l’expertise et à la communauté Zoho. Au programme : • Présentations
    • Engineering Change Order Process using Tickets?

      Hi Zoho Community, I'm working with my company to create an Engineering Change Order/Request (ECO/ECR) process where engineers can internally create tickets for changes in a product that must be reviewed, approved and implemented by people or teams in the company.  I'm using Blueprint to create statuses and transitions for the various ticket states as the ECO is being processed, but it continually seems like Tickets aren't a good way to build an ECO process. My question is:  Does anyone have experience
    • Sesión "Ask me anything" Zoho en Español - 26 de junio de 2025, de 14:00 a 17:00 (en español)

      ¡Hola Comunidad! ¿Quieres entender mejor Zoho CRM o Zoho Desk? Nuestros expertos estarán disponibles para responder a todas tus preguntas durante nuestra sesión "Ask me anything". Puedes comentar este artículo y durante tres horas, nuestro equipo estará
    • Not receiving instagram verfication emails

      Hi- I'm not receiving Not receiving instagram verfication emails.  I have seen other users having the same issue and your answer was to contact instagram.  But instagram no longer has a support email.  
    • CRM Feature Request

      When enabling Translation in Zoho CRM I would like to see the ability to remove the language "English (US)". I have encountered a user experience issue with a client recently. The client uses English (UK) but they are based in Spain, so they have activated
    • Change work hours per day for employees

      Hello, Is there a way to modify the work hours per day for employees in Zoho projects? This would be helpful for resource allocation to more accurately see when an employee who works 35 hours a week vs 40 hours has a full schedule. Thanks.
    • Is there a way to set Document Owner/Sender via the API

      When sending requests for zoho sign, it would seem zoho uses the id of the person that created the zoho api cred to determine the owner_id, is there a way to set a default for this?
    • Zoho Commerce

      Hi, I have zoho one and use Zoho Books. I am very interested in Zoho Commerce , especially with how all is integrated but have a question. I do not want my store to show prices for customers that are not log in. Is there a way to hide the prices if not
    • Name Change and Delete Email ID and Alias

      Hello please i require urgent assistance, 1.) I would also like to change the name that appears when people receive my emails. I have an info@spacetraiders.com but when people receive my email its say Ronma Adedeji instead of either Info or Space Traiders..
    • PROBLEMA AL CONECTAR EL DOMINIO

      hola buenas tardes hoy estoy tratando de crear mi registro y no me deja conectar el dominio  me dice que el dominio ya está vinculado a una cuenta y la verdad no tiene conectado el dominio a ninguna cuenta  tengo acceso al hosting y cpanel que se compro pero al revisar los dns estan apuntando al mismo hosting del panel  del proveedor del domini ... como hago para poder crear la cuenta con ese dominio, incluso cree un registro pero no  me deja vincularlo el dominio es integrasoft.co agradezco me ayuden  
    • Delay in delivery of emails

      I'm experiencing random delays for emails sent from Zoho account. Headers show that the message reached mx.zohomail.com almost instantly, followed by a delay of anywhere from 3-15 minutes (and counting). Please confirm whether this is a system-wide
    • SMTP Email Sending Not Working for My Domains and Apps

      Hello Zoho Support Team, I am experiencing a critical issue with sending emails via Zoho SMTP for my domain humanhup.com. Both of my applications, HumanHup and CheapUI, are unable to send emails using Zoho SMTP, even though the same setup was working
    • Company Name not pre-populating when using Quick Create: Contact

      Hi Devs, This has bugged me for a long time, and it's a simple UX design change to solve it. Problem: Users creating Contacts not linked to Companies/Accounts Cause: When a user creates an Opportunity where after browsing the Contacts they realise they
    • Zoho Mail not working. Constant OTP

      Firstly, my emails have been playing up for over a year. They are struggling to send and I have to press Send a few time to make them going. They mostly hover with a loading note saying Sending. I emailed Zoho and they got it working, but now it is doing
    • Zoho Mail Storage Usage Discrepancy – Incorrect Storage Reporting

      Dear Zoho Support Team and Community, I previously raised a concern about inaccurate storage usage reporting in Zoho Mail but did not receive a clear or satisfactory response. To investigate further, I meticulously calculated the storage used by all folders
    • Announcing 12 new connectors in Zoho DataPrep

      We’ve just made data management even easier - Zoho DataPrep now supports 12 new external connectors to help you build more robust, scalable ETL pipelines. Why it matters: ✅ Broader data access ✅ More automation, less manual work ✅ Smarter pipelines, better
    • Next Page