Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.


      Zoho Campaigns Resources


        • Desk Community Learning Series


        • Digest


        • Functions


        • Meetups


        • Kbase


        • Resources


        • Glossary


        • Desk Marketplace


        • MVP Corner


        • Word of the Day


        • Ask the Experts


          • Sticky Posts

          • Deprecation of SMS-based multi-factor authentication (MFA) mode

            Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

          Zoho CRM Plus Resources

            Zoho Books Resources


              Zoho Subscriptions Resources

                Zoho Projects Resources


                  Zoho Sprints Resources


                    Zoho Orchestly Resources


                      Zoho Creator Resources


                        Zoho WorkDrive Resources



                          Zoho CRM Resources

                          • CRM Community Learning Series

                            CRM Community Learning Series


                          • Tips

                            Tips

                          • Functions

                            Functions

                          • Meetups

                            Meetups

                          • Kbase

                            Kbase

                          • Resources

                            Resources

                          • Digest

                            Digest

                          • CRM Marketplace

                            CRM Marketplace

                          • MVP Corner

                            MVP Corner




                            Zoho Writer Writer

                            Get Started. Write Away!

                            Writer is a powerful online word processor, designed for collaborative work.

                              Zoho CRM コンテンツ










                                ご検討中の方

                                  • Recent Topics

                                  • Having problem with MX records and SPF

                                    Hi there, I have been facing a problem that my zoho mail doesn't receive mail. See Error in below The MX Records of your domain(s) mydomain.com are not pointed to Zoho and you may not receive emails in Zoho SPF entries in your domains DNS are not configured
                                  • ZOHO Mail App Not working

                                    There seems to be an issue with Zoho Mail App today. It is not connecting to server, internet is working fine, tried uninstalling app and reinstalling, loading circle keeps spinning round. Is there an update on the way?
                                  • Account with own domain, IMAP vs IMAPPRO

                                    Hi, I have email account with my own domain. I use Em Client email plan and when I use IMAPPRO incoming host, email comes in Em Client only when I restart program. If I use IMAP incoming host everything is ok. Port is 993 both option. Why so? What´s different
                                  • Change default "Sort by"

                                    Is there a way to change the default "sort by" when searching across modules?" in Zoho CRM? Currently the default sort method is "Modified time" but i would like to utilize the second option of "relevance" as the sort by default and not have to change
                                  • Automatic Display the Price from CPQ

                                    Is it possible to display the discounted price from CPQ that I created for my customer? For example, when the customer selects Product A, instead of showing the default price, it should display the discounted CPQ price.
                                  • Enhancement - Financial Reports

                                    Hello Everyone, As part of enhancing reports in Zoho Books, we have added an option`Compare With` in Financial reports. Using this, you can compare the current period with Previous Year(s)/Previous Period(s) (Maximum 3 periods). This option is available in the following Financial Reports: * Profit and Loss * Cash Flow Statement * Balance Sheet Please feel free to share your feedback.  We are glad to hear from you. Regards, Nithya - Zoho Books Team.
                                  • Associating Multiple Work Orders with a Single Invoice in Zoho FSM

                                    Hello Everyone, Is it possible to associate multiple Work Orders with a single Invoice in Zoho FSM? Best Regards, Subhash Kumar
                                  • Turning off the new UI

                                    Tried the new 'enhanced' UI and actively dislike it. Anyone know how to revert back?
                                  • Sent emails not going and showing "Processing"

                                    Hello Team, Could you please assist with sent emails showing "processing" and not actually going through? Many thanks and regards, Cycology
                                  • Free Plan mail accounts details

                                    In the zoho mail pricing there's a free plan that includes: FREE PLAN Up to 25 Users 5GB* /User, 25MB Attachment Limit Webmail access only. Single domain hosting. I need to make sure that I'm able to create multiple email accounts in the form of: name@domain.com
                                  • Spf cannot verify

                                    Hello, Thank you for your service. I am not able to configure my SPF. I have follow several times your instructions but it does not work. I cannot verify. My domain is ptjpt.co.id Please help me
                                  • Custom Function : Copy multilookup field to text field

                                    Hi, I'm a newbie on function programming, I try to copy text from a multi lookup field named "societe" to a text field named "societe2". I've used this code. In deluge script it seems to work, but when I trigger this function it doesn't work (Societe2
                                  • Introducing Global Sets for easy management of similar picklists in CRM

                                    [Update | Sep 2024] We've increased the maximum count limit for global sets. These new limits are now live for AU and JP data centers and will be gradually opened to all. Please check this link for the updated limits. Hello folks, As administrators who
                                  • TikTok (and other social platform) Messages and comments of the past

                                    When I link a social channel, Zoho will show in "Inbox", "Messages" and "Contact" sections the interaction done in the past? (comment, messages...)
                                  • Announcing Zoho Community Developer Bootcamps in India – Extensions

                                    Hey everyone! We're back with another line-up of Zoho Community Developer Bootcamps in India! Following the success of the first leg of bootcamps on Extensions, we're now ready with the second leg. These bootcamps focus on empowering developers of all
                                  • Unable to send message:mail rate exceeded limit

                                    Hi Admin I just got an email that outgoing has been blocked, I know why is the reason said " Mail rate exceeded limit", but I don't know the rule of Mail rate , so please tell me how to avoid the situation and fix this issue , my email id is morgan@homemesh.com.tw.
                                  • Error when using fetchById in Client Script

                                    When using client script when creating page (onLoad), I suddenly getting error "Cannot read properties of undefined (reading 'Accounts')" when using: var account_details = ZDK.Apps.CRM.Accounts.fetchById(account_id); I'm getting this error whenever trying
                                  • Los correos que envio, llegan como spam (Bandeja de correos no deseados)

                                    Estimados, Buenas tardes, necesito su soporte, los correos que envío desde mi cuenta llegan como spam. (no deseados). ya sea hacia cuentas de hotmail, gmail... etc.. El dominio lo tengo alojado en nic.ar (argentina). Por favor, necesito resolver esto
                                  • Zoho say my domain seems to be already associated with another account

                                    I created a website on zoho and associated my domain (bompescado.com) on it. You can see the A record and CNAME are working to it. Now I need to associate the same domain as webmail, but when I try it return with: " This domain name seems to be already associated with another account. If you own this domain, please contact us for assistance." Im following the advice and conctacting you to say I've not been associated this domain on zoho before.  What do I need? Well, I need you manually remove it
                                  • Seriously - Create multiple contacts for leads, (With Company as lead) Zoho CRM

                                    In Zoho CRM, considering a comapny as a lead, you need us to allow addition of more than one contact. Currently the Lead Section is missing "Add contact" feature which is available in "Accounts". When you know that a particular lead can have multiple contacts, why was this feature not included. Now we have to miss out other contacts or enter them somewhere in the description.!!! this is bad.
                                  • Zoho Mail Not Receiving or Sending Email

                                    My zoho mail is not sending or receiving mail. What's the fix for this?
                                  • Cannot add new mail client

                                    Hi Guys, I've just got a new laptop and am trying to set up Outlook to connect to my Zoho account. No matter what I do, I cannot connect I'm using IMAP for incoming mail, it's enabled in my account settings, and I'm using the setting shown on the account
                                  • How to mass update member status in a CRM Campaign?

                                    Does anybody knows how to mass update member status of the contacts (or leads) associated to a campaign. I can click on a campaign record and go to the Contacts in the Related List fields but then it shows only 10 contacts per page at once. It is hard
                                  • Zoho Payroll: Product Updates | April 2025

                                    At Zoho Payroll, we’re always working to make every payday feel effortless. And sometimes, that means listening closely to your unique needs. This month, we’ve focused on adding features that give you the flexibility to pay your employees based on your
                                  • Zoho CRM to Zoho Projects Workflow {"error":{"code":6831,"message":"Input Parameter Missing"}} connecting

                                    void automation.Untitled_Function(String ProjName) { resp = invokeurl [ url :"https://projectsapi.zoho.com/restapi/portals/" type :GET connection:"zohoprojects" ]; info "Portal API Response: " + resp; portalId = null; if(resp != null) { if (resp.containsKey("portals"))
                                  • Button on Deal screen to automate changing deal dates?

                                    Hi I spend a lot of time working with our accounts managers here moving deals around the calendar, qualifying things etc. I'd like to have an easy way to change the closing date on a deal, from the deal screen table, rather than either click in to the
                                  • Zoho mail Virus Scan Virus Detected (but I checked it with VirusTotal)

                                    Dear all, since this morning we can;t send any attachments out. Zoho says there is a virus in it, but clearly there is not when I checked the file on VirusTotal.com. Please help us out!
                                  • Cant receive emails

                                    Hi, I just created an account and went through all steps. Everything has been set up from my end, but Ive sent a test mail to the newly created email address, but it never arrived. Can somebody please help me? Thanks!
                                  • How do I fix this? Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked.

                                    How do I fix this? Unable to send message; Reason:554 5.1.8 Email Outgoing Blocked.
                                  • Multi-column sorting

                                    Is multi-column sorting a planned feature for CRM? We are needing to sort by one column and then subsort by another column. I am just wondering if there is a planned feature that will allow this?
                                  •  【Zoho CRM】サブフォーム内にあとから追加した数式項目を一括して計算させる方法

                                    皆様のお知恵を拝借いたしたくご相談させてください。 【状況】 任意のタブにすでにサブフォームが設定されており、そのサブフォームを含め、既に数千件のデータが存在している。 【実施したいこと】 新たに数式項目をそのサブフォームに追加して、入力済データのレコードも含めて、その数式項目の計算結果を反映させたい。項目の更新で数式項目をサブフォームに追加しただけでは計算されません。 【わかっていること】 任意のタブのサブフォーム外にあとから数式項目を追加した場合、数式項目を追加しただけでは当然数式項目の計算結果は反映されませんが、以下の方法を実施すると数式項目が計算されます。
                                  • My Zoho Mail Account Has Been Blocked for Sending Email - Block Type: Mail Outgoing blocked

                                    Hi everyone... My Zoho Mail account has been blocked for long time... Until now, I cannot sending outgoing email. I was already try to contact Zoho customer support, but there is no reply from them. This is notification which appear on my zoho mail account...
                                  • Task reminder with custom function

                                    Hello! I am trying to create a custom function to add a task. With you guys helping, I could create a function but I could not set the reminder. Anyone knows how to add a reminder?  Thank you for your tips!
                                  • Announcing new features in Trident for macOS (v.1.18.0)

                                    Hello everyone! Trident for macOS is here with interesting features and enhancements to elevate your workplace communication and productivity. Let's take a quick look at them. Retract sent emails. Whether you've missed adding an important attachment or
                                  • Zoho Books GST enabling issue.

                                    Without knowing I have created a Branch in Zoho Books, Now I am trying to enable GST option but is disable? Is there anyway to enable the GST Button?
                                  • Change rate after xxxx kilometers

                                    Is there a way to change the miileage rate after a certain mileage. After 5000 kilometers, we want the rate to automaticly change. Thank !
                                  • Add a Calender view in Zoho CRM

                                    I would like to ask if it's possible to add a calendar view to a custom module in Zoho CRM. Is this feature planned for future development? It would be extremely helpful for us. I’d like to allow my users to view the data visually in a calendar layout,
                                  • Make the edit fields hover in Canvas View look the same as the Detail Page

                                    The edit field UI in the Canvas View is not consistent with the standard detail page UI. For some modules we have Canvas views, for some we don't. We don't want it to look differently. We want it to look like one system.
                                  • Validating an order by a superior

                                    Hi, I have a very specific use case for Backstage. Let me know if this is possible or how I could get around this (or if there are no workaround). One of my client uses Backstage to manage internal (on site) events. Participants from different departments
                                  • iOS App Version 3.0 - Customer list gone?

                                    Not sure when this changed, but I seem to have been updated to 3.0 for the phone app (on iOS). I'm pretty sure that I used to have a Customers button that allowed me, for example, to see what appointments a customer has. Has this disappeared or am I just
                                  • Next Page