Deprecation of SMS-based multi-factor authentication (MFA) mode

Deprecation of SMS-based multi-factor authentication (MFA) mode

Overview of SMS-based OTP MFA mode 

The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account.

SMS-based OTPs offer convenience due to their accessibility; nearly everyone possesses a mobile phone and SMS-based OTPs arrive quickly, allowing for easy and secure authentication.

However, there are some other considerations and security risks that make the SMS-based OTP one of the least preferable options for multi-factor authentication. Hence, we’ve decided to deprecate it as an MFA mode.

Reasons for deprecation 

SMS-based OTPs are susceptible to various attacks, including phishing, SIM swapping, and signaling system 7.

Phishing attack: Scammers send fake messages with links to websites that resemble our sign-in page. For example:
They trick you into entering your login details and OTPs. If you do, scammers can access your account, putting your personal information and security at risk.

SIM swapping: By knowing your phone number, a scammer can contact your telecom provider's customer service and request to transfer your phone number to a new SIM card, giving them access to your accounts and personal data without your consent.

Signaling system 7 attack: A hacker can spy on you via the cell phone signaling system, where they can listen to calls, intercept text messages, and track your phone's location, leading to serious security risks.

Considering the security threats in SMS-based OTPs and the guidelines on implementing phishing-resistant MFA given by the Cybersecurity & Infrastructure Security Agency (CISA) of the United States government, we deprecated the SMS-based OTP MFA mode.

➤ Current status
     Deprecation of SMS-based OTP MFA mode for all users who signed up after January 1, 2024.

➤ Upcoming plan
     Migration of existing users and organizations currently enforcing SMS-based OTP MFA to alternate MFA modes.  

Alternate MFA modes

If you’re an organization admin, you can set up a different MFA mode for your organization in the security policies. If you’re a personal user, you can go to the multi-factor authentication section at accounts.zoho.com and set up any of the MFA modes described below.
  • OneAuth (recommended)
    Zoho OneAuth is a multi-factor authentication app that you can use to secure your Zoho account as well as third-party accounts, including Google, Facebook, and Microsoft. With OneAuth, you can set up any of the three authentication modes: push notifications, time-based OTPs, and QR codes.

  • OTP authenticator
    OTP authenticators are apps you can use to set up MFA for your account. These apps generate new OTPs in duration you set, which you can use to sign in to your account.
    Learn how to set up an OTP authenticator.

  • Security key
    A security key is a hardware device that you link to your account to enable multi-factor authentication. Once linked, you'll need to use this key each time you sign in to verify your identity.
    Learn how to set up the security key.
If you have any questions, please write to us at support@zohoaccounts.com.


Update (December 26, 2025) - Announcement page to be shown for administrators

We’re adding a new announcement page during sign-in to help organization admins currently enforcing SMS-based OTP switch to more secure MFA modes. If you're an organization admin, you’ll be asked to update the organization's MFA method by selecting from alternatives such as OneAuth, OTP Authenticator, or Security Key. Please make sure to update your organization's security policy to stay protected and comply with the new MFA requirements.

This announcement will be in effect from 29th December, 2025 (Monday).


Info
Note: Other users who currently use SMS-based OTP will receive a corresponding announcement and guided flow soon. We will update in this post once it’s available. Users can also switch to a more secure MFA mode anytime from the Multi-factor Authentication section in the Accounts page (accounts.zoho.com).

If you have any questions, please write to us at support@zohoaccounts.com.



    • Sticky Posts

    • Deprecation of SMS-based multi-factor authentication (MFA) mode

      Overview of SMS-based OTP MFA mode The SMS-based OTP MFA method involves the delivery of a one-time password to a user's mobile phone via SMS. The user receives the OTP on their mobile phone and enters it to sign into their account. SMS-based OTPs offer

    • Recent Topics

    • Replace Zoho Invoice with QuickBooks

      We are implementing Zoho FSM for a cleaning business in the US with 50+ field workers. This business has been using Quickbooks for accounting for decades and will not migrate to Zoho Books. A major issue in the integration is the US sales tax calculation.

    • 2025 Highlights: A Year of Steady Progress and Significant Developments

      As we come to the end of 2025, let's take a moment to reflect on the significant progress and developments we've made to improve your travel and expense management. In the Spotlight Introducing Online Booking (US edition only - Early access) Enable online

    • Function #42: Show the actual rate of items on invoices

      Hello everyone, and welcome back to our series! In Zoho Books, you have the ability to create Price Lists, wherein you can mark up and mark down the item rates by a specific percentage or set custom rates. Generally, when you apply a price list to an

    • Ability to Set Text Direction for Individual Cells in Zoho Sheet

      Dear Zoho Sheet Team, We hope you are doing well. We would like to request an enhancement in Zoho Sheet that allows users to set the text direction (right-to-left or left-to-right) for individual cells, similar to what is available in Google Sheets. Use

    • Warehouse fast processing

      Hey guys, would anyone be interested in something like the attached image ? If there's any interest I'd be willing to develop it further for others to use, it's much faster than using Zohos native solutions, it can part pack, pack in full, part ship,

    • Can I create a CODE 128 custom field for my items in Zoho Inventory and then use it for generating Sales Orders?

      Can anyone helps me, I don't want to use the SKU code for scanning my products.  ​Because all my products have a CODE-128 label attached.

    • Start/Stop Timmer in Chrome Extension

      The chrome extension is great and allows you to do allot however one of the most common things employees working on projects need to do is track their time. Having an easy start/stop timer to track time would be great.

    • Invalid collection string

      I haven't changed anything in one of my functions. I'm trying to run it manually and suddenly "Invalid collection string" appears. My code has 6 lines and the error says that the error is on 7th line. Why? What does this error mean? Nothing has been changed

    • Zoho Directory 2025: New Features | Security Enhancements | Enriched UI

      Hello everyone, Greetings from the Zoho Directory team! 2025 has been a highly successful year for Zoho Directory. We are delighted to introduce a fresh set of features, an enriched UI, and major product enhancements. These updates aim to deliver a smoother

    • zoho people 5 report

      How do I customize my report in Zoho People Report? I understand that I can get the results of multi-table queries through SQL join statements, but I don't know the relationship between each table. I tried to create a report using Attendance User Report

    • Leave Report Emailed Weekly

      I am wondering if someone knows how to have a report generated either weekly or monthly or both for department heads and ownership of upcoming employee leave. For instance, it would be nice to get an emailed report on Friday for the upcoming week of who

    • Zoho Flow Decision Continuing Despite Not Meeting Conditions

      I have a picklist field called Lead Status in the leads module, with the following lead Statuses: New Lead Attempted Contact - 1 Attempted Contact - 2 Attempted Contact - 3 Attempted Contact - 4 Attempted Contact - 5 Attempted Contact - 6 Attempted Contact

    • Tip #55- Accessibility Controls in Zoho Assist: Exploring Vision Settings- 'Insider Insights'

      As we approach the end of the year, it’s a good moment to reflect on how we can make our tools more inclusive and easier to use for everyone. Remote support often involves long hours in front of screens, varied lighting conditions, and users with different

    • Zoho Recruit Slow and Freezing on all screens

      We have had an issue with Zoho Recruit for weeks being extremely slow and at times freezing.  We have 100 mega internet, and I went into each computer and updated the virtual memory so there is more available.  Also restarted all computers daily.  Still having the issues.  Almost unable to work.

    • Credit Management: #2 Configuring Right Payment Terms for Credit Control

      Think about the last time you ordered something online and saw that little note at the checkout, "Pay on Delivery" or "Pay later". It's simple, but it actually sets the tone. As a business owner, you know exactly when payment is expected. Now, imagine

    • Dependent (Conditional) Fields in Zoho Bookings Forms

      Hello Zoho Bookings Team, Greetings, We would like to request the ability to create dependent (conditional) fields in Zoho Bookings registration forms. Current Limitation: There is currently no way to make one field’s available options depend on the value

    • Bug Report: Search fails to find existing notes after Evernote import

      Hello, I recently migrated from Evernote (~2600 notes across 23 notebooks), but the search functionality is currently broken. The Issue: I can manually browse to a specific note and see it exists. However, when I type the exact or partial title of that

    • Marketing Tip #13: Win repeat customers with post-purchase emails

      The relationship with your customer doesn’t end after the sale; that’s when it begins. A thoughtful post-purchase message shows customers you appreciate them, keeps your brand top of mind, and can even lead to another sale. You can thank them, ask for

    • Zoho Form

      I have problem with Zoho Form. One of form i don't received the PDF version. Others okay except this one. W904533

    • Create & Update Zoho Vault Passwords via Zoho Flow

      Hi Zoho Flow / Zoho Vault Team, We’d like to request an enhancement to the Zoho Vault integration in Zoho Flow. Current Limitation: At the moment, Zoho Flow supports only the following selected Zoho Vault actions, such as: Fetch passwords, Share passwords

    • Custom Related List Inside Zoho Books

      Hello, We can create the Related list inside the zoho books by the deluge code, I am sharing the reference code Please have a look may be it will help you. //..........Get Org Details organizationID = organization.get("organization_id"); Recordid = cm_g_a_data.get("module_record_id");

    • Migrate different zoho subscription to zoho one

      Dear We have different zoho subscription we need to migrate it to zoho one. Currently we are paying for zoho email, zoho expense, zoho payroll etc under different admin We need to move it too zoho one flexlible plan for all my employees

    • Features, Feedback and Votes

      We’re launching the Feedback Forum for our customers. This is 'THE' place where you can add everything you’d like to see in Zoho Books. If you don't find the specific feature you need, simply add it so others can also vote for it. While we cannot promise

    • There Might Be A Glitch in Determining If A String Represents A URL

      I suspect there might be a glitch in determining if a string represents a URL or not. For example, I cannot embed the following URL. Perhaps the exclamation mark or parentheses are the culprit? https://en.wikipedia.org/wiki/How_the_Grinch_Stole_Chri

    • Customer Management: #4 Enhance Customer Journey

      When Neha started DefineOps, a growing IT support and consulting firm, most of her work was straightforward. A client would sign up for a free version, decide whether the service works for them, and then either continue or discontinue. Billing was simple,

    • Android app sync problem - multiple devices have same problem

      Hello, I am having a problem with synchronization in the Android app. When I create a drawing, the data does not sync correctly—only a blank note is created without the drawing. I tested this on multiple devices, including phones and tablets, and the

    • Marketing Tip #1: Optimize item titles for SEO

      Your item title is the first thing both Google and shoppers notice. Instead of a generic “Leather Bag,” go for something detailed like “Handcrafted Leather Laptop Bag – Durable & Stylish.” This helps your items rank better in search results and instantly

    • Territory Assignment Issues (Lead to Account + Contact)

      1. Lead → Account & Contact Territory Assignment on Conversion A Lead is automatically assigned one or more territories using a workflow and Lead Assignment Rules. This works as expected, and we are able to assign multiple territories to a Lead automatically.

    • Marketer's Space: Proven tips to improve open rates – Part II

      Hello Marketers! Welcome back to another post in Marketer's Space! We're continuing from where we left off a fortnight ago. We ended the previous post discussing the subject line, and we'll continue from there. Let's dive right in. Pre-header Pre-header

    • SQL Table slowed to a crawl

      Hi all - I seem to have noticed an update. Now whenever I am typing in the script field for the SQL tables there is a huge delay and it is all very slow. This has never been the case for me in over 5 years of using Analytics - I really hope it's fixed

    • Deluge Events/search API works in user environment but not in sandbox – why?

      I am creating an Extension for Zoho CRM using Zoho Sigma Platform I’m using the following Deluge code to search Events in Zoho CRM based on Start_DateTime: criteria = "(Start_DateTime:greater_than:2025-12-20T00:00:00+00:00)"; url = "crm/v8/Events/search?criteria="

    • What are Zoho Meeting capabilities included in Zoho Workplace Standard?

      I am evaluating using Zoho Meeting for my organization, but it is not clear what Zoho Meeting capabilities are already included in Zoho Workplace Standard. - Are meeting recordings included in Workplace Standard? - Can we invite external meeting participants

    • How can I get the participant list of a reoccurring meeting afterwards?

      I'm trying to use the Meeting Participant Report from the API docs but when I call it on a reoccurring meeting it returns that there are no participants because it thinks I'm talking about the meeting in the future. Is there a way to use webhooks or some

    • Function #50: Send Mass emails to your customers

      Hello everyone, and welcome back to our series! We have reached a milestone of 50 Functions, which means that we have automated 50 different tasks in Zoho Books. Every Friday, we have shared a nifty function aimed at either automating a task or streamlining

    • Full Hebrew Language Support for Client-Side Zoho Assist Interface

      Dear Zoho Assist Team, We would like to request an enhancement to Zoho Assist's client-side interface to support full Hebrew language customization, including all popups, notifications, and session-related messages. Current Limitation The Join page allows

    • Add Hebrew & RTL Support to Feedback Widget

      Hello Zoho Desk Team, How are you? We are using Zoho Desk and would like to utilize the Feedback Widget. While Zoho Desk itself supports Hebrew and RTL, the Feedback Widget unfortunately does not. We kindly request that Hebrew and full RTL support be

    • Merge Tickets Directly from Contact Page in Zoho Desk

      Dear Zoho Desk Support Team, We are writing to request a new feature that would allow users to easily merge tickets directly from the contact page in Zoho Desk. Currently, the only option to merge tickets is from the Tickets list view page, which can

    • Different languages for users

      Hello, Do you plan to enable individual users to select their languages for interface? Currently language can be changed for everyone - it looks like a settings for a whole portal, which is not good when you are working internationally. Best regards,

    • Kaizen #222 - Client Script Support for Notes Related List

      Hello everyone! Welcome to another week of Kaizen. The final Kaizen post of the year 2025 is here! With the new Client Script support for the Notes Related List, you can validate, enrich, and manage notes across modules. In this post, we’ll explore how

    • 2025年 Zoho コミュニティ 活動の振り返り 🎉

      ユーザーの皆さん、こんにちは！コミュニティチームの中野です。 2025年も多くの学びと出会いがあったZoho コミュニティ。 本記事では今年の活動を振り返りながら、フォーラムの投稿・参加者の皆さん・イベントのハイライトをご紹介していきます。 目次 フォーラム：注目の投稿 フォーラム：多くの貢献をしてくださった方々 ユーザー交流会振り返り ワークアウト振り返り その他のトピックス 1. フォーラム：注目の投稿 本フォーラムでは様々な議論と知識の共有が行われました。 ユーザーの皆さんが日々の業務で直面する課題を投稿し、経験豊富なユーザーさん達が実践的な解決策を提供してくださいました。

    • Next Page