Deprecation of SMS-based multi-factor authentication (MFA) mode

Deprecation of SMS-based multi-factor authentication (MFA) mode

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.


Update (December 26, 2025) - Announcement page to be shown for administrators

We’re adding a new announcement page during sign-in to help organization admins currently enforcing SMS-based OTP switch to more secure MFA modes. If you're an organization admin, you’ll be asked to update the organization's MFA method by selecting from alternatives such as OneAuth, OTP Authenticator, or Security Key. Please make sure to update your organization's security policy to stay protected and comply with the new MFA requirements.

This announcement will be in effect from 29th December, 2025 (Monday).


Info
Note: Other users who currently use SMS-based OTP will receive a corresponding announcement and guided flow soon. We will update in this post once it’s available. Users can also switch to a more secure MFA mode anytime from the Multi-factor Authentication section in the Accounts page (accounts.zoho.com).

If you have any questions, please write to us at support@zohoaccounts.com.



    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

    • Recent Topics

    • Topics not loading in individual contact records in Zoho Marketing Automation

      When working correctly, an individual contact record in ZMA shows a "Topics" section in the "Subscription" tab of the individual record. However, in 2+ different Zoho accounts and different browsers, the "Topics" section doesn't load and instead it spins

    • Help: Capture full page URL in hidden field when same Zoho Form is embedded on multiple pages (iframe)

      Hi all, Goal Use one Zoho Form across multiple pages and record the exact page URL (incl. subdomain + path + hash) where the user submitted it. Example pages: https://www.example.com/cargo/ https://www.example.com/cargo/containers/#contact https://cargo.example.com/auto/

    • how to get transcripts with speaker and time marks?

      Hello, I downloaded the transcript of a recent meeting and noticed that the TXT file does not bring the speaker name and the time mark. Is there any way to make it happen using ootb resources from Zoho Meeting? best

    • SalesIQ's Summer '26 Release: For The Moments That Matter

      Every customer journey is made up of moments. The moment someone discovers your business. The moment they need help. The moment you decide to reach out. The moment a simple chat turns into something more. And the moments that continue long after the conversation

    • Cannot deploy digital employee-

      I followed the guide here https://help.zoho.com/portal/en/kb/salesiq-2-0/for-administrators/operators/articles/zia-agents-in-zoho-salesiq#Supported_SalesIQ_Tools but no matter how many times I try I cannot for the love of god make it work I get this error

    • Displaying only unread tickets in ticket view

      Hello, I was wondering if someone might be able to help me with this one. We use filters to display our ticket list, typically using a saved filter which displays the tickets which are overdue or due today. What I'd really like is another filter that

    • 【受付開始】Zoholics Japan 2026 開催のご案内

      Zoho が年に一度開催するユーザー向けイベント「Zoholics」。 今年は 「AI-Powered DX with Zoho」 をテーマに、2026年9月25日（金）に 東京駅直結の会場とオンラインのハイブリッド形式で開催します。 今すぐ申し込む AIの活用が加速する今、業務効率化やDX推進に取り組む企業にとって、 「どのようにAIを業務へ取り入れ、成果につなげるか」が重要なテーマとなっています。 Zoholicsでは、Zohoの最新AI機能や製品アップデートに加え、実際の活用事例や業務改善のヒントをご紹介します。

    • Print checks for owner's draw

      Hi.  Can I use Zoho check printing for draws to Owner's Equity?  This may be a specific case of the missing Pay expenses via Check feature.  If it's not available, are there plans to add this feature?

    • Reconciliation: don't auto-select transactions outside the entered Period

      When initiating a reconciliation for a defined Period (say April 1 to April 30), Zoho Books auto-checks transactions whose Statement Detail dates fall after the period end date. With "Show based on grouped bank statements" enabled (the default), the screen

    • How can be requests for new job managed in Zoho recruit?

      If we use both Zoho people and recruit, can our managers (heads of department) use Zoho products to create requests for new job to HR department? The current workflow is following: a head of department needs some extra HR, he creates a request describing the job and send it to HR director, HR director approves a request and forward to a HR manager. I see only one way to partly solve the problem - grant the heads of departments recruit administrator permissions, so they could create new jobs. It is

    • Linking the Overview window between reports on a dashboard

      Is there a way to link the Overview window for two or more charts on a dashboard? We have several dashboards where users often want to set the window for 3 or 4 reports to the same time period. Doing it manually is time-consuming and cumbersome, but I

    • Subforms and automation

      If a user updates a field how do we create an automation etc. We have a field for returned parts and i want to get an email when that field is ticked. How please as Zoho tells me no automation on subforms. The Reason- Why having waited for ever for FSM

    • "code":3001 ["Failed to update data."]

      I would like to seek your expertise - I might be wrong on my approach also.. I highly appreciate your advice. 1 problem remains is when a new row was added on the existing one [from another form that trigger upon Successful form submission ], it gets

    • BUG: If you put "Blueprint" at the top of Workqueue, tab switching leads to long loading and no display

    • WORKFLOW ISSUE: Zoho Finance Extension

      Workflows are no longer triggering in my extension. This is true for the testing environment and 5 other organizations it is installed on. There are no conditions set for the workflow, and this is true for both create and delete related actions. Workflows

    • Drive Zoho CRM adoption and usage through our native integration with Zoho DAP

      You chose Zoho CRM for its depth: its powerful automation, its rich analytics, and its extensive customizability. But there's a hidden last mile in every rollout: the gap between the software's capabilities and your team's daily execution. When new hires

    • Moving from Office365 to Zoho Mail

      I have few mailboxes on Office365. One of the mailbox is coming up for renewal. How can I move this mailbox to Zoho Mail and continue to have other mail boxes continue to use Office365 mail? Thanks, -Naveen

    • Best sales insights for target accounts?

      Question for all the sales power-users out there: I would like to gain insights from Zoho CRM for a rotating list of target accounts. Each Outside Salesperson has 5 target accounts, and they can change these targets quarterly with management approval.

    • WhatsApp Vendors

      Hello, so WhatsApp works with the below, mainly with the customer side modules. Can we get functionality on the vendor side modules? WhatsApp is often the preferred method of communication with some vendors. Credit Notes Payment Receipts Sales Receipts

    • Text on Zoho Sign confirmation dialouge is very small compared to text used everywhere else on Zoho Sign.

      I've reported multiple times through Zoho's support email that the text on this notification is very small in contrast to all the other text on the Zoho Sign app. I think it's a bug and it just needs the font size to be increased. It's very minor but

    • Time Zone is incorrect

      Time zone is not working properly...I've checked it twice. I'm eastern U.S. time it's currently 12:22 pm EST. CRM shows 3:22 pm EST.

    • Over-the-Air (OTA) Updates for V3 Attendee Apps | Zoho Backstage

      Keeping participants on the latest version of your event app shouldn’t depend on App Store or Play Store review timelines. With Over-the-Air (OTA) updates for our V3 attendee app, the latest version is delivered directly to participants through an in-app

    • Please Remove the Confirmation Popup

      Currently, every time a recruiter changes the status of a candidate in Zoho Recruit, a popup confirmation appears that requires clicking “OK, Got it” before proceeding. This creates unnecessary friction in the workflow, especially for users handling high

    • Zoho Projects: Q2 Updates 2026

      Dear Users, During the first quarter, we launched our most advanced version of Zoho Projects, namely Zoho Projects Infinity. With support for Custom Modules, Custom Dashboards & Reports, along with built-in AI tools, we enabled users to create their own

    • Overview on users IMAP settings

      We have about 30 users who all have the channels/email/email configuration/IMAP integration/O365 enabled and emails are synchronized. Here my problem: Passwords for the email accounts are expiring on individual bases and most of the users forget to update

    • What is a realistic turnaround time for account review for ZeptoMail?

      On signing up it said 2-3 business days. I am on business-day 6 and have had zero contact of any kind. No follow-up questions, no approval or decline. Attempts to "leave a message" or use the "Contact Us" form have just vanished without a trace. It still

    • crm to books

      We currently sync CRM Contacts to Zoho Books Customers using two-way sync. We now wish to change to "Accounts & their Contacts". What happens to existing Books customers? Will they be merged with CRM Accounts, duplicated, left unchanged, or recreated?

    • Alternate color rows

      After I changed the background color to a dark gray and changed the alternate rows to a light gray. I have discovered that I can no longer change the text in the light gray rows to Bold.

    • Tax/Vat Number Field As Standard - Customer & Vendor

      Hello, when are you'll going to have the customer & vendor tax/vat number as a standard field under the relevant profile pages? I find it strange that after 6 years of using Zoho Inventory that I still have to use a custom field for a tax/vat number,

    • Is there a way to sync Tags between CRM and Campaigns/Marketing Hub?

      I wonder if there is a way to synch the tags between CRM and Marketing-Hub / Campaigns?

    • Restricting coupon codes and plans to specific customers

      Having the ability to restrict coupon codes, plans and add ons to specific customers (new or existing) e.g. sending an invite link out to a certain customer or allowing a certain group of customers the ability to use a certain promo code or sign up to

    • Coupon Management Lacks functionality

      Hey Zoho Team, Let me start of by saying I'm a huge fan of the entire Zoho suite. I have a couple of thoughts about the way coupons are handled and believe there they are in need of some improvement. There are a couple of key issues: 1. Coupons need to

    • Free Webinar Alert! Zoho Mail + Zoho CRM: Turn inbox replies into CRM deals

      Hello Zoho Community! Are your sales conversations happening in Zoho Mail while your customer data lives in Zoho CRM? Join our upcoming webinar to learn how integrating the two can help you automate follow-ups, capture leads faster, and keep every customer

    • Introducing the Employee Portal for internal job posting

      Employee referrals and internal applications are one of the most trusted hiring channels. But in many organizations, employees only hear about openings through messages, word of mouth, or after the role has already been open for a while. When employees

    • Marketing Tip #42: Keep policy pages updated and accessible

      Policy pages may not be the most exciting part of your store, but they play a big role in building trust. Before buying, many customers look for information on shipping, returns, refunds, privacy, and terms. If these pages are missing, outdated, or hard

    • Extend the Image Choice Field

      Hi, The New Yes/No field is great for what it does, and the Image Choice Field is good but could be better with some functions from the Yes/No field. Take an example, rather than just Yes/No you want Yes/No/Maybe (Or more than 3 choices), but unlike the

    • Migrate from Zoho Mail to G Suite

      I am unable to find any documentation on how one can migrate from Zoho Mail to another platform, like G Suite or Office 365. Please point me to the right documentation. Thank you.

    • The All New Attendee App | Zoho Backstage

      The Zoho Backstage attendee app is the primary touchpoint for attendees, speakers, exhibitors, and sponsors during an event. It helps participants access event information, manage their schedules, connect with other participants, engage with exhibitors

    • How do I show file uploads in my Zoho Creator approval workflow?

      As far as I can tell I'm not able to add the file upload field to the approval workflow show fields list. As a work around I'm making a plain text field that links to the files URL. But I'm not sure how to get a link to that url that will me to preview

    • Department Customization Copy/Paste

      Hello! I love the new customization of the layouts, rules and templates! However, we have several "departments" that operate similar and as I'm updating either ticket layout or workflow rules, I'm finding that I have to do it in each department. I would

    • Next Page