Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

      • Recent Topics

      • Auto-Create OneDrive Folder Structure Upon Lead Creation

        Hello, New to Zoho and looking for help on a critical process automation I'm looking to implement. My company currently utilizes OneDrive for file management and the folder structure is Proposals -> Client Name -> Address (where I need to initially create

      • 🔍 How to effectively organize data in a CRM? – My approach and questions for you

        Dear ZOHOssians! While working on organizing data in a CRM, I decided to use the native modules: Leads, Deals, Contacts, and Accounts as a solid foundation for managing processes. However, I’m now exploring the next steps and considering various options

      • Stock Count

        The stock count is a nice new feature, but we cannot figure out how to: 1. Use it without assigning to a person, we have a team or one of multiple do stock counts as do most any company. 2. Add any extra fields to what the "counter" sees. The most important

      • Annoying Pop-Up Zoho Advertisements and Announcements Within Apps

        It is beyond frustrating to have to close out Zoho's announcements for Webinars, Zoholics, updates, events, etc while working within ANY of the Zoho apps. I see it when accessing Zoho One, Cliq, Creator, and CRM. Zoho boasts to be a professional solution

      • Images uploaded onto text notes through the mobile app won't render

        When uploading am image onto a text note, exiting the note and going back in, the image is gone and shows an error icon in its place, and also won't display directly on other devices, including on the desktop version. Uploading the same image on the same

      • Marking a Desk ticket as Unread after merge

        We have a custom script that runs against every new ticket and auto-merges it with any existing ticket that matches our criteria. That works fine but there is no functionality that reverts the newly-updated ticket back to an "unread" state. I found the

      • Trying to do commission tracking with zoho crm, can i do a Lookup against multiple fields in a module?

        So i'm still designing my zoho one crm as i come over from salesforce. One of the things i'm trying to build is a commission tracking module. At some point i'll probably hire someone to help with custom code, I'm just proof of concepting it. I"m not sure

      • Internal Support and Assigning Tickets

        I want to set up an Internal Desk Support system. Here is what I need... We need our internal "Support" staff to be the Ticket Owner We need to be able to identify who the "Account Manager" is on that client and get emails as part of the ticket. I'd like

      • Filter a Zoho Creator main report by a field and display other related reports in sections on a Zoho Creator page

        Hi, How can I filter a Zoho Creator main report by a field and display other related reports in sections on a Zoho Creator page? Part of what I was given below is setting up sub-reports, but the subform field prompted me to link a form, not a report.

      • FAQs on Approval Process - Post your Questions

        Dear All, Greetings! Approval process allows to validate records and streamline the process across organization to ensure a systematic approach. To resolve your probable queries, we are constantly gathering relevant FAQs and publishing them to address

      • Recurring Events Not Appearing in "My Events" and therefore not syncing with Google Apps

        We use the Google Sync functionality for our events, and it appears to have been working fine except: I've created a set of recurring events that I noticed were missing from my Google Apps calendar. Upon further research, it appears this is occurring

      • Introducing Social Toolkit

        Hi everyone, We're thrilled to launch Social Toolkit, a one-stop dashboard to help take your social media presence to new levels by letting you create aesthetic profiles and share content that your audience will actually enjoy engaging with. Social Toolkit

      • Requesting a file upload in Zoho Workplace not possible?

        I’m new to Zoho Workplace and am mostly liking it. However, it seems as though collecting/requesting documents is not available in the workplace version of WorkDrive. Am I missing something, or would I need to subscribe separately to another WorkDrive

      • Poor Email Delivery

        Our company used Zoho about 2 years ago and always had trouble understanding why a great deal of our emails from Zoho CRM and Zoho Marketing Automation ended up in the recipient's spam folder regardless of the email content and despite having our domain

      • No table view in "All departmens" mode

        Hello, I would like to have an overview of all tickets, so I have to switch to "all departments". But here I don't have the possibility to activate the table view. But this is mandatory, so that I can see certain fields without having to open each ticket

      • Where to Map Candidate fields to Employee fields in Zoho People 5.0

        I can not find options anywhere on Zoho people 5.0 where I can choose how the data fields are mapped from the candidate form to the onboarding form

      • Get Creator Form Record ID and Subform ID's

        Good Afternoon everyone. I have a Creator form with a on success workflow. I'm trying to get the form record ID and the subform record ID(s) but they keep coming up null. There is data in the subform I use it elsewhere. Can anyone help me pull the ID's.

      • WhatsApp and Zoho Creator Integration

        How we have integrate WhatsApp App with Zoho Creator without using external application ?

      • Guidance on Making Zoho Desk Connections Available for All Data Centers

        Hi Team, I’m currently developing an application using Zoho Desk connections to manage OAuth for my third-party products. Could you please advise on the steps required to make it available across all data centers? Looking forward to your thoughts on

      • Can we create Sprint with tasks from Multiple projects?

        Hi Team, We were using Zoho Sprints for quite sometime. Currently we have started the process of Sprint method. We couldnt create the active sprint board with the tasks from multiple projects. I would like to know whether this is possible or Any timeline

      • Ability to use Dynamic goals in Motivator

        Is there any way to create dynamic goals in Zoho Motivator? By "dynamic" I mean: not the same target every period, but varying from period to period. For example, in our organization, sales reps are supposed to target beating the same month's sales last

      • Using Snippets in Comments

        One of our Agents asked about using snippets in comments. We don't see this as an option at this time, only in reply mode. Is there a way to enable this?

      • Calendar - "super compact" week view

        every time i go to my calendar i have to re-engage the "super-compact view" for the week view...is there a way to make "super-compact" a default view so I dont have to keep on setting it manually?

      • zoho calendar week view - "super compact by default"

        every time i go to my calendar i have to re-engage the "super-compact view" for the week view...is there a way to make "super-compact" a default view so I dont have to keep on setting it manually?

      • CRM portal: no Create/Edit options available for custom module

        I'm experimenting with setting up a CRM portal. I'm not able to select Create and Edit permissions for a custom module, even though the data sharing settings for this module has been set to Public Read/Write/Delete. What other settings do I need to enable

      • Which are the IP addresses to use for 'split delivery' with Office 365? (Zoho mail inbound gateway)

        Hi, I'm trying to set up 'split delivery' (email routing) with Office 365. I'm following the instructions to set up Office 365 as the primary server (https://www.zoho.com/mail/help/adminconsole/coexistence-with-office365.html) One of the prerequisites

      • Allow submitter to type a choice in a 'Multiple Choice' field

        Is there any way to allow the person filling out a form to manually type in a choice in the 'Multiple Choice' field? So like have the option of allowing the last field to be 'Other' with an input field...

      • How to Add Portal Users in Zoho Creator's Development Environment for Testing?

        Hello, I’m working on a Creator app with a customer portal and implementing filters based on the logged-in user (customer). To test these filter functions, I'd like to simulate or add customer portal users in the development environment/database. Is there

      • Mapping a custom picklist to another picklist when creating a connected record with a workflow

        Hi, I have some workflows that move records between pipelines, the issue is that when setting up the workflow that creates the connected record, there is no option to map the value from a picklist in one pipeline to another. Please watch: https://www.loom.com/share/4e5fa969b21043748414154c036cdd47?sid=dca0fd16-73f2-4fe6-a9d3-7a4c0c40c2e6

      • Initiate data import using Deluge script

        Is it possible to open the screen to begin the importing of new records using Deluge? So for example, my users would click a button on a form that starts a workflow action. This action would then open the screen to "Import Data for Current User Projects".

      • Whats App Automation

        It would be nice to be able to send out an automated whats app message template on moving stages or creation of a ticket (same as you can do for automated emails). Currently only automated emails can be sent. Also, if whats app could be used more effectively

      • Unable to add organization consultants and contractors in Zoho People

        Hello Team: I am unable to add my few consultants and contractors in Zoho People. How to add these people as Users?

      • Lookup field - Can I avoid using advanced search?

        I have a lookup field in my app that has surpassed 500,000 records, now basic search is disabled and I'm forced to use advanced search. That adds multiple steps to what used to be very simple. Before: Select field > Type last digits of product code and

      • Forced Tooltip on Maps View

        Please remove the forced tool tip data points and ONLY include those listed in the "Include Columns for Tooltip" area. Also, disable the tool tip if no fields in there. With a lat/lng map, it forces showing those (and color field, lat count) and will

      • Last sync date/time as a widget

        Is there any way to get the last date/time that the data shown (reports and dashboard) was last updated. For example, If I have our data being synced every 3 hours and the last was done 2 hrs ago, I would like to show date/time of update OR updated #{hrs}

      • Function #19: Associate invoice templates automatically based on branch

        Much like the custom function we shared last week, today's function also aims to facilitate the automatic association of invoice templates. When you're managing business operations across various branches, there may be a need to create and send invoices

      • how to create view in leads module to that will show all leads + converted leads?

        is it possible to make custom view that combine all leads + converted leads? how to do that

      • Milestone

        New to Zoho and trying to get acquainted. According to PMI a milestone "anticipates what the project is supposed to achieve at a pre-set date. It should describe a desired state of affairs, a desired future situation. There are two important aspects to this. First, the concept refers to a point in time, not a period of time. Second, it looks forward to what we want to create, not how we create it." Why are Zoho milestones defined between two dates and as bins for tasks? Why would you even consider

      • How to send mail with js SDK

        Hell o I'm using https://live.zwidgets.com/js-sdk/1.2/ZohoEmbededAppSDK.min.js, for my widget in CRM (built with sigma) Is it possible to send email from js file, I try ti use that ZOHO.CRM.API.sendMail({ "Entity": "Accounts", "RecordID": sharedVariableEntityId,

      • Report to see committed stock vs quantities on order with suppliers

        Hello Zoho Community, I am looking for a report in Zoho Books / Inventory that will show the committed stock from sales orders, and show what quantities of the same part are on order from purchase orders. I have found the committed stock details report,

      • Next Page