Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Deprecation of SMS-based multi-factor authentication (MFA) mode - Zoho Security

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.

    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer
    • Recent Topics

    • Error when trying to categorize bank transactions

      I am trying to categorize my bank transactions. It was going fine, I categorized 50 or so transaction and suddenly I started getting an error that reads: "Transactions cannot be matched as the account you are trying to match it to, is different.". I select
    • importing invoices from woocommerce to Zoho Books

      Hi, I am using Zoho Books as part of Zoho One and am struggling enormously. I have been trying for months to migrate/add all my WooCommerce invoices to Zoho Books without success. I tried the CRMPerks plugin, but it never worked, and the customer service
    • CERTIFICADO DIGITAL - BRASIL

      Olá, Temos o ZOHO ONE e no Sign vemos de forma simples a assinatura digital, temos nos BRASIL certificado digital, de no CERTISIGN homologado pelo GOVERNO do BRASIL, há possibilidade de gerar a assinatura diante deste certificado?
    • Embed Props data value not available in the Search across team folder API call response data

      Issue I used the "Search across team folder" API to get a specific folder's data in a team folder even though the folder is shared. However, the response data from the search call does not contain "embed props" value for the folder whereas when I used
    • Write off bad debt

      Anyone know how to write-off bad debt in Zoho Books? I keep reading that there's a write-off option, but I don't see that option. Is there any other way to do this?
    • High cpu load on client side by process sessionaudit.exe

      Hi, as stated above. This happens every time with different clients. Now, the first thing I have to do after making the connection is to go to taskmanager on client computer and kill the process 'sessionaudit.exe' If I don't their cpu is very high and
    • How to merge data from Zoho CRM to Zoho Sheet

      Hello! A few months ago, I made a Zoho sheet with the ability to bring in data from Zoho CRM. It worked by adding the email of a Contact to the sheet, and then it would fill in the rest of the information in the row with information that was stored in
    • Radar In Focus: Using Siri For Customer Support

      Hello dear users, Welcome to the 6th installment of the Radar In Focus series. In today's issue, we'll explore a Radar IOS exclusive that is a must-have to provide support on-the-go. Just say the magic word 🪄 Computers make our lives easier by automating
    • Solution for setting up header and footer in a template

      Hi all, Emon need for business, I have long searched the forum and also how to put in my quote and my bills a header and a footer. And finally, I have an other working stream elements allowing me to meet my needs ... Given the number of people seeking the same thing as me, I say it might be good to share my discovery. It's simple and easy to implement First, start by adding the beginning of your HTML the following: <style> html {margin: 0;}  body {margin: 0;}  div # printhead { display: block;  position:
    • disable auto-save

      While testing a new sheet I often want to quit without saving if a new idea does not work out, but with autosave, I keep getting stuck with mods I don't want. Can I disable autosave?
    • Creating Email template that attaches file uploaded in specific field.

      If there's a way to do this using Zoho CRM's built-in features, then this has eluded me! I'm looking to create a workflow that automatically sends an email upon execution, and that email includes an attachment uploaded in a specific field. Email templates
    • Mapping custom fields from one module to another

      I have a custom field, "Subscription Period" that appears as a required field in every Opportunity (Potential). I want that field to appear on any Quotes derived from that Opportunity (and have created a custom field of the same name in Quotes for that
    • Python Code: Calling "Deals" API results in 404 Error.

      Good evening, I wrote a small python code to scrape the data from a selected record and then copy the information I need into another website. We have renamed the "Deals" module to "Opportunities", however the API name remains as "Deals" which is fine.
    • Introducing Zia LLM: Zoho’s in-house Generative AI solution for CRM's AI capabilities

      Hello everyone, We're excited to announce the launch of our in-house Large Language Model (LLM) by Zia to power our AI offerings. What is LLM? LLM stands for Large Language Model, a powerful AI technology that processes and generates human-like text based
    • Client Script | Update - Introducing Subform Events and Actions

      Are you making the most of your subforms in Zoho CRM? Do you wish you could automate subform interactions and enhance user experience effortlessly? What if you had Client APIs and events specifically designed for subforms? We are thrilled to introduce
    • Related Record Bug

      Hi, Report a bug. Related record amount currency will display default currency (AUD) not the actual one (CNY). While if we click into the record and back, the currency will change to CNY (Correct). Then If we refresh browser, currency still show AUD
    • Introducing Bot Filtering for Accurate Email Campaign Analytics

      Dear Marketers, We're excited to announce a new feature designed to enhance the accuracy of your email campaign analytics: bot filtering. This feature helps you filter out bot-generated opens and clicks, ensuring your campaign reports reflect genuine
    • CASE Module - email function

      HI there, I dont know if this has been asked or answered before as i couldnt find it on the forums. Issue: when a new case is raised, it goes under case tab and everything is captured. Then how do i send emails to the client who raised case with the details
    • Function #34: Automatically add a free item to the invoice based on the purchase amount

      Hello, everyone! Welcome back to our series. It's the holiday season, marking a time when businesses witness increased demand for products and services, leading to a significant boost in sales. This also presents an opportunity for businesses to engage
    • Disabling OneAuth

      Hi. I want my users to only use the option OTP-Authenticator. However, I am not able to disable the option OneAuth. How can I do this?
    • Show my cost or profit while creating estimate

      Hi, While creating estimate it becomes very important to know exact profit or purchased price of the products at one side just for our reference so we can decide whether we can offer better disc or not .
    • Waterfall Chart

      Hello, I would like to create a waterfall chart on Zoho analytics which shows the movement in changes of budget throughout a few months, on a weekly basis. Should look something like the picture below. Does anyone know how to?
    • Add tasklist from a template to Zoho Project using Deluge

      I have some tasklist templates that I want to be able to add to a project under certain circumstances. So if a project meets Condition A, add the tasklist from Template B to that project. If it meets condition C, add tasklist from Template D, and so on.
    • Preview an upload PDF or File

      I have a form where the customer has to upload a file (normally PDF - never jpeg)  When in report view I want to be able to preview the uploaded file without having to download it.  If I click on the upload it downloads to my computer, I want to be able
    • Cross-Posting to a Telegram Channel

      We don't have a native way to cross-post to Telegram channels. Did anyone find a way around it? I checked Zoho Flow - but Telegram isn't there. Maybe some 3rd party integrations connecting Facebook, IG, etc., bypassing SalesIQ altogether?
    • SalesIQ Chatbots are now available for Telegram!

      Hi everyone! We are expanding our Chatbot's support on IM Channels. Happy to launch SalesIQ's chatbot support on the Telegram channel. Our chatbots are already supported on Facebook, whatsapp, instagram and now Telegram joins the party! This means that
    • Zoho Projects Android app update - Access subtasks on the task listing screen

      Hello everyone! In the latest Android version(v3.9.22) of the Zoho Projects app, we have brought in support to display the subtasks on the List view of tasks, within the Projects and Home module as well. Please update the app to the latest version directly
    • Enhancing Data Accuracy: Bot Filtering & Apple Mail Privacy Protection Compliance

      Dear Marketers, The wait is over! We’re thrilled to share that the enhanced bot filtering feature is now live in Zoho Marketing Automation. Thank you for your patience as we refined this tool to deliver deeper insights into your campaign performance.
    • Exit Sub

      Hi Everyone, I have some script that evaluates multiple conditions, using some nested if statements.  If any of the conditions evaluates to true, there is no reason to continue the running through the other conditions. Is there an Exit Sub command in Deluge? Thanks, Leo
    • How to Retrieve Serial Numbers of Items in Zoho Inventory via API?

      Hello, I am currently working with the Zoho Inventory API and need to retrieve the serial numbers associated with specific items in our inventory. After reviewing the documentation, I couldn’t find an endpoint dedicated to fetching serial numbers for
    • Why can't I see the delivered Zoho Campaign automation email on Zoho CRM lead record?

      I recently did update the field mapping on our Leads sync services between Zoho CRM and Zoho Campaigns. The end goal is to create tailored email drip campaigns with the use of segments and automation. I understand you can build cadences, email templates,
    • Zoho one CRM - linking xero

      Hi Guys, new to Zoho but not having luck with premium support so thought I'd reach out here - I cant find the xero app on marketplace and needing some guidance how to link xero to our zoho one CRM. Also we have 3 users, one of which emails arnt linking
    • Zoho Books API Documentation shows the returned Expense ID as numeric, but the API actually returns a string.

      Screenshot of ZB API Documentation. Expense ID (marked in red) is numeric. Screenshot of Zoho Creator execution result of making a request to ZB API POST /expenses endpoint. Expense ID (marked in red) is a string.
    • When Zoho Tables Beta will be open to EU data center

      Hello all, We in EU are looking at you all using and testing and are getting jealous :) When we will be able to get into the beta also? We don't mind testing and playing with beta software. Thank you!
    • Use of Multi Lookup fields

      Hi, I wondered if anyone could help. I am trying to develop an automation that would send an email to a list of preferred suppliers associated to an account when a booking is created. I assumed this would be done using the multi lookup field, but I can't
    • 一括メール送信について

      すべての連絡先 を設定し一括送信を行ったのですが250件しか送信できていないようです。 なぜでしょうか?プランの問題ですか?設定の問題ですか?
    • Cliq Channels - Permissions

      Hello All, As said in my previous post, I'm going to detail Permissions - set of actions one can perform in the channel. In more simple words it is the power that one wields in a channel to perform certain actions. You can go to Permissions through Channel Preview i.e. hover over the channel in LHS and click on info icon. There are total of 8 actions that constitute the Permissions. They are: Edit Channel info: Permission to edit the Channel title and description This info will be displayed in Channel
    • 5 powerful ways to boost e-commerce customer engagement with Zobot

      E-commerce has been a game changer for the past decade. It has drastically influenced the way people purchase. This pandemic broke all the existing rules by embracing automation and making the customer experience more personalized. Chatbots play a crucial
    • not letting add

      im trying to add people with the add user + or whatever on my cliq little conversation chats for some reason when i add my fellows, or they add me it is not goin through and we are not able to add eachother i was only able to add two people
    • Help upgrading from Zoho Workplace

      Is anyone able to assist with upgrading from Zoho Workplace to Zoho One? There appears to be no clear upgrade path. Thanks.
    • Next Page