Overview of SMS-based OTP MFA mode
The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.
SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.
However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.
Reasons for deprecation
SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.
Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.
SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.
Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.
Considering the security threats in SMS-based OTPs and the guidelines on
implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.
➤ Current status
Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.
➤ Upcoming plan
Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.
Alternate MFA modes
If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at
accounts.zoho.com and set up any of the MFA modes described below.
OneAuth (recommended)
Zoho OneAuth is a multi-factor authentication app that you can use
to secure your Zoho account as well as third-party accounts, including
Google, Facebook, and Microsoft. With OneAuth, you can set up any of the
three authentication modes: push notifications, time-based OTPs, and QR
codes.
- OTP authenticator
OTP authenticators are apps you can use to set up MFA for your
account. These apps generate new OTPs in duration you set, which you can
use to sign in to your account.
Learn how to set up an OTP authenticator.
- Security key
A security key is a hardware device that you link to your account
to enable multi-factor authentication. Once linked, you'll need to use
this key each time you sign in to verify your identity.
Learn how to set up the security key.
Recent Topics
No feedback from Zoho Books regarding Yodlee feeds for Investec
I reported on 6 Feb 2025 that the Bank Feeds for Investec bank via Yodlee are not working. To date there has been no resolution. You are charging us for a suite of products where the functionality does not work. Please advise how you will refund me for
Inappropriate Removal of Features
It's the first with any software where I am experiencing that an existing customer has some of his exiting features removed. Moreover, new Zoho One users are paying less than us. Is this going to be Zoho's "normal behaviour". If so, it is going to be
Cliq iOS can't see shared screen
Hello, I had this morning a video call with a colleague. She is using Cliq Desktop MacOS and wanted to share her screen with me. I'm on iPad. I noticed, while she shared her screen, I could only see her video, but not the shared screen... Does Cliq iOS is able to display shared screen, or is it somewhere else to be found ? Regards
Filtering report embeded in page
Right now we are using a page variable to filter a report on a page. However, it being a page variable makes it reset if you go to another report/form, we want the filter to be kept the same. I tried using an application variable according to zoho you
Browser and address bar hide
Hi, How i can do hide the address bar with browser headline when i am working on the sheet, because i am using (freeze panes) which i want visible for full work. For your reference here i am attached the screen shot and marked yellow lines which really
In arattai received message can't be deleted
The issue has been noticed in following: arattai app (Android) arattai app (Window) arattai web While the message posted by me may be deleted, the ones received from others can't be. The item <Delete> change to <Report> when the message is a received
Export Invoices to XML file
Namaste! ZOHO suite of Apps is awesome and we as Partner, would like to use and implement the app´s from the Financial suite like ZOHO Invoice, but, in Portugal, we can only use certified Invoice Software and for this reason, we need to develop/customize on top of ZOHO Invoice to create an XML file with specific information and after this, go to the government and certified the software. As soon as we have for example, ZOHO CRM integrated with ZOHO Invoice up and running, our business opportunities
Add "Reset MFA" Option for Zoho Creator Client Portal Users
Hello Zoho Creator Team, We hope you are doing well. We would like to request an important enhancement related to Multi-Factor Authentication (MFA) for client portal users in Zoho Creator. Currently, Creator allows us to enforce MFA for portal users,
Zia summarizes your IM bot chats in real time
Hello everyone! Let's say you’re an agent taking over a chat where a customer was booking a flight through a bot on WhatsApp. They've already shared key details, like their destination, travel date, and number of passengers. You need to understand the
Megamenu
Finally! Megamenu's are now available in Zoho-Sites, after waiting for it and requesting it for years! BUT ... why am I asked to upgrade in order to use a megamenu? First: Zoho promised to always provide premium versions and options for all included Zoho-applications
Zoho Projects - Q3 Updates | 2025
Zoho Projects - Q3 Updates | 2025 Hello Users, The final quarter of the year 2025 has begun, and we at Zoho Projects are all set with a plan. New targets to achieve and new milestones to reach, influenced by the lasting imprint of the past quarter. 2025's
Cancel and refund
Hi, Yesterday I paid for the Zoho email subscription. Within a few minutes, I realized that the subscription counts one email ID as one user. To make another email ID for the same domain name, I'd have to pay for another user. I emailed right away to
One Contact with Multiple Accounts with Portal enabled
I have a contact that manages different accounts, so he needs to see the invoices of all the companies he manage in Portal but I found it not possible.. any idea? I tried to set different customers with the same email contact with the portal enabled and
Kaizen# 209 - Answering Your Questions | All About Client Script
Hello everyone! Welcome back to another exciting Kaizen post! Thanks for all your feedback and questions. In this post, let's see the answers to your questions related to Client Script. We took the time to discuss with our development team, carefully
Unable to copy into a new document
Whe I create a new Writer doc and attemp to copy and past I get this message. The only way to copy into a document is I duplicate an existing document, erase the text and save it under a different name and then paste the information. Not ideal. Can you
To Do: shareable task links without login
Hi! I’m using Zoho Mail and ToDo in my daily work, and I’ve run into one limitation that’s a real blocker for me. Right now, to share tasks with managers or directors, they need to have a Zoho account and be added to a group. In practice, many of them
Ability to turn off "Would you like this amount to be reflected in the Payment field?" message
Team, Is there any way to turn off the message" Would you like this amount to be reflected in the Payment field?" when I make a payment? This is so annoying. This happens EVERY TIME I put an amount in the Payment Made field.
Two currencies
More and more I am finding that internattional payments' fees are unpredictable. I would like, on my invoices that are in a foreign currency (eg. USD$ or EUR€) for there to be a GBP£ TOTAL display alongside the invoice's currency total. This would make
Massive spam pretending to come from our address – is this a Zoho security issue?
Hi, We’ve been receiving more and more suspicious emails lately — many of them clearly look like scams. But yesterday, we got an email that appeared to be sent from our own address, which was very concerning. We're starting to wonder if this might be
Unlock agreement intelligence with Zoho Sign's latest AI updates
Hello! If you've been struggling with long, complex agreements and spending way too much time on them, here's exactly what you'll want to hear: Zoho Sign now integrates with OpenAI's ChatGPT to make agreement management smarter and simpler. Acting like
Currency abbreviations
Hello, Im stuck, and need help. I need the currency fields for example, opportunity value, or total revenue, to be abbreviated, lets say for 1,000 - 1K, 1,000,000 - 1M, and so on, how should I do this?
Embed Sign Document
Has anyone tried embedding a document in a webpage? I'm building a webpage (using PowerPage) and I'm trying to embed it using an iframe then I got this error: Refused to display 'https://sign.zoho.com/' in a frame because it set 'X-Frame-Options' to
Zeptomail API error 500 internal server error
Hi Everyone, getting this eror continuously! Can anyone please guide around the same! Zeptomail API error 500 internal server error Best Regards
Emails Are Not Being Delivered to My Inbox
Hello Zoho Support Team, I am experiencing an issue with my Zoho Mail account. The most important problem is that emails are not being delivered to my inbox. Details: My Zoho Mail address: info@coreforcelife.com What happens: I am not receiving any incoming
Upload my theme.
Hello. I would like to upload my own theme, this one: https://themeforest.net/item/panagea-travel-and-tours-listings-template/21957086 Is it compatible and where I upload it? If not I will hire a developer, what do I have to ask when I search for one?
Radar In Focus: Track customer support metrics using Radar's static reports
Hello everyone, Welcome back to the Radar In Focus series, where we explore how Radar features can add value to your business. In this episode, we're looking at Radar static reports. The help desk is filled with vast amounts of data that can be analyzed
Help with Filtering Records, HTML Pages, and Automatic File Uploads in Zoho Creator
Hi Zoho Creator Community, I’m building a Zoho Creator application and need guidance on a few features I’ve been struggling with. I want to implement them safely and efficiently, and I’d appreciate any examples, tips, or best practices. I want users to
Issue with Trident exe file
Hello Team, Exe Setup file It's showing harmful for user pc please check and do needful. this message for developer team. Thanks Bhargav Purohit
Mail ToDo & Tasks Webhooks
Our company uses Zoho ToDo inside Mail to manage our tasks. When I create a task and assign it to a team member it does not notify them unless I add a reminder via mail. I'm trying to create a webhook for when a task is created to send a cliq message
Allocating inventory to specific SO's
Is there a way that allocate inventory to a specific sales order? For example, let's say we have 90 items in stock. Customer 1 orders 100 items. This allocates all 90 items to their order, and they have a back order for the remaining 10 items which could
Improved UI for a Seamless User Experience - Calls, Tasks, and Meetings
Hello all, We are making UI unification across CRM so that the UI experience is seamless across the product. As part of that effort, we have made changes to the details page of activity-based module records—Meetings, Calls, and Tasks. Let's look at these
Where can I find rejected inbound mails and their reason for rejection
Hi, I was recently made aware by a mailing list which I am subscribed to (ffmpeg-devel@ffmpeg.org) that my Zoho mail Mail account is rejecting some emails. If I look under Admin Panel > Security & Compliance > Quarantine > Incoming, the list there is
Refund
Hi There, Please refund me asap possible, because of no support given. Thank you
Empowered Custom Views: Cross-Module Criteria Now Supported in Zoho CRM
Hello everyone, We’re excited to introduce cross-module criteria support in custom views! Custom views provide personalized perspectives on your data and that you can save for future use. You can share these views with all users or specific individuals
تغيير عمله الدفع"Change payment currency"
ما هى طريقه تغيير عمله الدفع "ما هي طريقة تغيير عملة الدفع؟"
How do I fix this? Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked.
How do I fix this? Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked.
Attention API Users: Upcoming Support for Renaming System Fields
Hello all! We are excited to announce an upcoming enhancement in Zoho CRM: support for renaming system-defined fields! Current Behavior Currently, system-defined fields returned by the GET - Fields Metadata API have display_label and field_label properties
MS Teams Meeting to Zoho CRM
Has anyone figured out a good way to push MS Teams meeting info on a trigger of "meeting end" to Zoho CRM? We're looking for a way to take attendees of a meeting and meeting duration and push it into Zoho CRM after the meeting has ended. If I can just
Zia's ability to generate and improve content extended to Desk mobile app (iOS and Android)
In support, agents will have to understand customers' pain points completely to provide empathetic personalized solutions and a positive experience. However, at times, agents might find it challenging to comprehend the customer issues and connect with
Introducing Zoho Creator's 2025 Release Projection 2
Hello Creators! I'm Prakash, from the Creator product management team, and today I'm delighted to unveil our next set of features as part of Release Projection 2 for 2025. With thoughtful analysis and planning, we've curated powerful new capabilities
Next Page