SMS codes are on the way out for Microsoft

Microsoft has confirmed that text-message security codes are being phased out for personal Microsoft accounts, partly because SMS can be vulnerable to phishing and SIM-swap scams.

Instead, Microsoft is moving users towards safer options such as passkeys, passwordless sign-in, authenticator apps, and verified email. These methods are generally harder for criminals to intercept or trick people into handing over.

If you still rely on text messages for login codes, it’s worth reviewing your security settings. SMS codes are certainly better than having no extra protection at all, but they’re no longer considered the gold standard.

For most people, an authenticator app or passkey is now a better option, especially for important accounts such as email, banking, cloud storage, and Microsoft or Google accounts.

The humble text message has had a good run — but for account security, better options now exist.