Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer
    • Recent Topics

    • Microsoft PowerPoint files Extremely slow to save

      I and others on my team have noticed that Microsoft PowerPoint documents are extremely slow to save when using WorkDrive. It always takes over 30 seconds to save a file. Word and Excel files seem to save in a typical length of time, but PowerPoint is
    • How can users unblock their blocked Zoho Mail accounts?

      After the reason for the account block (storage exceeded, spam detection etc.) has been rectified, the user can unblock the account from the UnBlock Me page. Account support@edu2review.com  Edu2Review is an education review platform, we rate the quality
    • Adding additional fields for batch information

      Hello, I am looking at adding additional information into our inventory module. we would like to be able to see up to 8 attributes that will be individual & different for each batch (i.e. batch specific information) but currently I seem to only be able
    • Dynamic Pickup List Values using Deluge and Client Script

      I would like to dynamically show Pickup List Values For example we need to fetch some data from an on premise application and display it so they can choose and pick This can be done in Creator but I didn't find anything for CRM
    • Validation Rule for Controlled Stage Movement in Deals Module (Deluge Script)

      For keeping a control over module stage or status, you can use the below deluge script. The below deluge script defines validation control over deals module stages: // Function to validate allowed stage transitions in the Deals module map validation_rule.LeadStatustValidation1(String
    • Pick List Issues

      I have created a pick list that looks at a table in a sheet, it selects the column I want fine. Various issues have come along. The option to sort the pick list is simplistic, only allows an ascending alphabetical sort. Bad luck if you want it descending.
    • Four types of task dependencies

      "Nothing is particularly hard if you divide it into small jobs."                                                                                                                  - Henry Ford Projects, small or large, are driven by simple work units called tasks. Monitoring standalone tasks might look simple but as the workflow becomes elaborate, tasks may start relying on one another. In project management, this relationship between tasks is termed as "Task Dependencies". Dependency between tasks arise
    • 1099 tracking

      Do zoho books offer feature of tracking for 1099's for contractors, etc? Quick books offers this feature and wondered when/if Zoho books will do same
    • VAT-type Taxes in US Edition?

      I'm located in the US, and I use the Zoho One US edition of Books. We are in the process of registering with Canadian authorities for their GST / HST, which is a VAT-type of scheme. It is not immediately obvious to me how one would deal with input tax
    • 2 users editing the same record - loose changes

      Hello, I'm very new to Zoho so apology if this has been addressed somewhere i can't find. I have noticed the following: If we have 2 users put an inventory item in edit mode at the same time: say user1 click on edit and user2 while user1 is still in edit,
    • Schedule sms to be sent later

      When will you make available an option to send sms's at a later time??? You finaly have this option available on emails, so it will be very useful to have it also with sms. Our sms provider, has already this available but we cannot use it because you
    • Ecommerce integration with prestashop

      Development of campaigns integration with prestahop. When???
    • How to create an article containing images and rich text via the api?

      Hi, I'm trying to migrate our kb articles from our previous helpdesk service, and import them to ZohoDesk. Is there any way to create an article that contains images?  Is it possible to add formatting to articles created via the API? Thanks, Adam.
    • Number of statement execution limit exceeded on deluge scheduled function

      I'm working on a send email functionality in creator that sends out crew work orders at the end of the day each day for the next day. I'm running into the issue that zoho is unable to handle the number of statements that I am doing to be able to successfully
    • Color of Text Box Changes

      Sometimes I find the color of text boxes changed to a different color. This seems to happen when I reopen the same slide deck later. In the image that I am attaching, you see that the colors of the whole "virus," the "irology" part of "virology," and
    • Zoho SignForm In Progress But Cannot Be Completed

      If a person starts signing a document (via SignForm), but closes the window before submitting, Zoho marks the document "in progress", but how do they finish signing it?
    • How to show Assemblies AND component items in a report

      Hi Is there any way in Analytics to create a report that shows the Composite Item AND the Component Items with mapped quantity? It seems that the component item is not exposed in any table that I can find. Also, the same question but for Stock on Hand.....this
    • Mandatory Messages for Specific Members in Zoho Cliq Channels

      Hello Zoho Cliq Team, We hope you're doing well. We would like to request a feature enhancement to Zoho Cliq that would allow marking certain messages in a channel as mandatory for specific members — with built-in tracking and reminders. 🎯 Use Case:
    • Admin Access to Message Read Statistics in Zoho Cliq

      Hello Zoho Cliq Team, We hope you're doing well. We would like to request a feature enhancement that would allow admins or channel owners to view read/unread statistics for messages, even if they were not the original sender. 🎯 Use Case: Currently, in
    • Online Member Visibility in Channels (Similar to WhatsApp Group Presence)

      Hello Zoho Cliq Team, We hope you're doing well. We’d like to request an enhancement to Zoho Cliq’s channel experience by introducing online presence indicators for channel members — similar to how WhatsApp shows how many people in a group are currently
    • Show ticket field in Zoho Desk only if that same field is not empty (API‑created records)

      Zoho Team , We have a ticket workflow where every ticket is created via API based on dynamic logic from an external form. That form has complex logic and already decides what’s relevant to ask, and the API only populates fields in Zoho Desk based on that
    • Multiple Products on Ticket

      Good morning. We will classify all tickets based on the product. Users sometimes send different requests on the same ticket, so we are facing some challenges. Is there a way to add more than one product to the ticket, or is there a way to tie the product
    • Não recebo Email de confirmação e validação de cadastro do PagSeguro

      Olá, utilizei uma das minhas contas de email Zoho para criar um cadastro no PagSeguro, contigo o email com o link de confirmação da conta não chega no meu email Zoho (nem.ma caixa de spam, nem na lixeira, e nem em outras pastas). Outros emails do PagSeguro
    • Does Thrive work with Zoho Billing (Subscriptions)?

      I would like to use Thrive with Zoho Billing Subscriptions but don't see a way to do so. Can someone point me in the right direction? Thank you
    • accounts payable and receivable subaccounts

      How to create accounts payable and receivable subaccounts? Being that I have several clients and in my balance sheet have to specify the accounts of each client and not only appear "accounts receivable or accounts payable" ??
    • DUPLICATING WORKFLOWS IN CREATOR

      Hi all, I want to duplicate and slightly amend 3 workflows in Creator so that I don't have to keep typing in all the rules and properties each time. I can see lots of videos on CRM with the 3 dots at the top of the workflow, but nothing like that in Creator.
    • Add SKU to query options in `items` API endpoint

      It would be very useful to be able to pull items by SKU in the API as this is a commonly used unique ID that tends to be consistent across systems.
    • Estimates and invoices being sent from company-wide address, rather than individual

      In our organization, team members send estimates and invoices through Zoho Books by using the "Send Email" function. However, for certain users, the system defaults to sending estimates and invoices from a shared organizational email address (e.g., company@example.com)
    • Need profit margins for books in estimates & invoice

      https://help.zoho.com/portal/en/community/topic/show-my-cost-or-profit-while-creating-estimate
    • Decimal places settings for exchange rates

      Hello, We are facing issues while matching vendor payments with banking feeds. As we often import products/services exchange rate comes into play. Currently, ZOHO allows only six digits for decimal places. We feel that conversions like JPY to INR require
    • Item Level Notifications

      I need to create a custom workflow based on the creation of an estimate that has a SKU/Item name that matches certain criteria. I can have it generated based on a total amount, but not at the item level. Is this possible?
    • Cannot categorize a bank deposit to an income sub-account

      When I go to categorize a bank deposit, I am not able to see any income sub-accounts. If I set up an income account without a parent, then I am able to categorize a transaction into that account, but as soon as I make it a child account, it disappears
    • ZV Extension passkey changes in v5.7.0

      Has there any changes to the how passkeys are managed in ZV - Chrome extensions v5.7.0? Namely, if the passkeys were already implemented/enforced as 2FA on a certain webpage, but ZV does not track them yet. Would that be the issue for my use case?
    • What's New in Zoho Billing - August 2025

      Hello everyone, We are excited to share the latest updates and enhancements made to Zoho Billing in August 2025 to improve your overall billing management experience. Keep reading to learn more. Notify Customers About Subscriptions via WhatsApp Business
    • How do I get my account id?

      Hello, I followed the instructions to get a list of accounts of the currently authenticated user (which is me, and I am logged in). But when I follow the below instructions I get the following error: ERROR: {"data":{"errorCode":"INVALID_TICKET","moreInfo":"Invalid ticket"},"status":{"code":400,"description":"Invalid Input"}} Instructions that I am following: GET - User account details Purpose The API retrieves the list of accounts of the currently authenticated user.  Request URL  http://mail.zoho.com/api/accounts
    • Why are tasks not showing in Zoho Calendar?

      Hi there, I updated the Zoho calendar preferences for Task records to show on the calendar together with Meetings and Calls - see attached screenshot. Despite of that, Task records still won't show on the calendar. Is there a specific reason why this
    • Zoho Payroll: Product Updates - July 2025

      Over the past month, we've focused on making Zoho Payroll more flexible, compliant, and easier to use—whether you're processing complex payouts, ensuring accurate calculations, or meeting local tax regulations. Here's what's new: One-Time Payments and
    • Discussion for “sub product”, “sub item” or “child products”

      Hello everyone, In some CRM systems, there is the ability to associate products in a hierarchical manner within a quote. For example: Product A: Gold Plan Product B: Setup Product C: Connector Product D: Silver Plan Product B: Setup Product C: Connector
    • Retrieve Accidental Deleted User

      Is there a way to undelete a user who accidentally deleted themselves?
    • Request for Support - CRM Integration Issues

      I’m reaching out to request assistance with the following items: 1. Zoho Forms Integration with Zoho CRM We are currently using Zoho Forms to send the Global Credit Application form to our customers. The intended workflow is for the form submissions to
    • Next Page