novauth
PricingDocsBlogStart free
Back to blog
Industry TrendsPasskeysSMS OTP

Microsoft Just Retired SMS Authentication. Here's What the Data Says Is Next

Novauth Team5 min read

On July 13, Microsoft announced that Entra ID — the identity platform behind sign-in for a huge share of enterprise software — is retiring SMS and voice-based multi-factor authentication. Not deprecating. Retiring. Passkeys become the default authentication method starting September 2026, and by February 1, 2027, Microsoft-provided SMS and voice MFA simply stops working for sign-in. Users still on it get auto-enrolled into passkeys; if SMS or voice is someone's only MFA method, they'll hit a hard prompt to register a passkey before they can log in at all.

That's not a vendor nudging customers toward a nicer option. That's one of the largest identity providers on earth setting a shutdown date for a 20-year-old authentication method. We went looking for the data behind that decision, and it's a bigger story than one company's roadmap.

The number Microsoft actually cited

Microsoft's stated rationale wasn't abstract. The company pointed to AI-enabled phishing campaigns reaching click-through rates as high as 54%, compared to roughly 12% for traditional phishing attempts. Phishable authentication factors — a code you can be tricked into reading out or forwarding, a text you can be socially engineered into forwarding — are the thing attackers are now beating at nearly 5x the old success rate. SMS OTP is squarely in that category: nothing about a text message stops a convincing enough fake login page from just asking you to paste the code in.

Passkeys aren't a niche bet anymore

The infrastructure to back up a retirement date like that already exists at real scale. FIDO Alliance's 2026 numbers, drawn from research across 11,000 consumers and 1,400 enterprise decision-makers in ten countries:

  • 5 billion passkeys now active worldwide
  • 90% consumer awareness of passkeys
  • 75% of consumers have activated a passkey on at least one account
  • 68% of organizations have deployed or are actively deploying passkeys for employee sign-in
  • 33% of consumers report experiencing an account compromise or breach notification in the past year — the underlying pain driving adoption

This isn't early-adopter territory anymore. It's the default path for a meaningful share of the internet's login flows, and Microsoft's move makes it the mandatory path for a large chunk of enterprise identity.

The fraud data backing up the "why"

Security researchers have been saying SMS OTP is the weak link for a while — the Verizon Data Breach Investigations Report explicitly recommends against SMS one-time passwords as an MFA factor, citing SIM-swap exposure. The fraud numbers back that up, unevenly but clearly:

  • The UK's Cifas Fraudscape report logged unauthorized SIM swaps jumping from 289 to almost 3,000 in a single year — a 1,055% surge.
  • Australia saw a 240% year-over-year increase in people seeking help for SIM-swap and phone-porting fraud (IDCARE).
  • US FBI IC3 data shows SIM-swap complaint counts actually falling — 2,026 in 2022 down to 982 in 2024 — but researchers caution this likely reflects victims reporting the downstream fraud (drained accounts, stolen crypto) under other categories rather than an actual drop in attacks, especially as carriers add friction that shifts tactics rather than eliminates them.
  • SS7 protocol interception — the network-level flaw that lets an attacker reroute or read SMS messages without touching the victim's phone — is still an active attack vector; UK's Metro Bank and multiple German banks have had 2FA codes intercepted this way, and reporting on live exploitation continues.

None of these attacks require breaking encryption or guessing a password. They exploit the fact that a phone number was never designed to be a secure credential — it's a routing address that can be redirected, socially engineered away from you, or read off a network layer that predates modern security assumptions.

What this doesn't fix — and why it matters for verification

Here's the part that gets lost in "SMS is dead" headlines: passkeys solve login, not phone verification, and those are different problems wearing the same "2FA" label.

A passkey proves you're the same device/account that registered before. It's excellent at that — phishing-resistant, no code to intercept, no SIM to swap. But it can't do the job SMS OTP, flash call, WhatsApp OTP, and Telegram OTP were actually built for in the first place: confirming that a brand-new phone number belongs to a real, reachable person during signup, before any account or passkey exists to check against. Passkeys have nothing to authenticate against on someone's very first interaction with your product.

So the realistic shift isn't "verification disappears." It's that verification splits into two jobs with two different tools:

  • Returning-user login → passkeys, increasingly by default, following exactly the path Microsoft just mandated.
  • First-contact phone verification → still needs a live channel to an unverified number, which means the channel choice — and its exposure to SIM-swap, SS7, and AIT fraud — still matters enormously. That's the whole argument for flash call verification over plain SMS: it inherits none of the SIM-swap or SS7 exposure described above, because there's no code transmitted as data to intercept in the first place.

Microsoft just proved the industry is serious about killing SMS as a login factor. The next question — which channel actually deserves the signup moment — is exactly where this gets interesting.

Sources