Microsoft will retire SMS (text messages) next February as a means of authentication for access to its accounts. I can imagine someone standing up in a meeting and saying: “We’re doing this for your own good.” It’s time to cut the phishing line.

Text messages can work as an authentication method, but the concept has vulnerabilities. It’s based on the assumption that when you get a verification code to authenticate your access, you have your cell phone in your physical possession. That’s true virtually all of the time. However, text messages are subject to SIM swapping, a technique hackers use to temporarily take over your phone number, and they can do it long enough to intercept the text without you ever knowing about it until something goes wrong.

There are also some locations in various cellular networks that are vulnerable to breaches, and it’s possible that a hacker can get access to the cellular network right as the text message is being sent to you.

If a hacker can gain access to a user’s Microsoft account while they’re logging in, they can gain access to contact lists and use them to launch phishing campaigns by email and text.

Authenticator apps bypass the cellular network. They generate a code from your phone, making them impossible to intercept. Many authenticator apps include additional security measures such as passcodes, passwords, or biometric authentication (like fingerprints or facial recognition), making it more difficult for unauthorized users to access your accounts even if they have your password.

This does force an issue, especially for businesses or other organizations that require employees to use their personal cell phones for business. Some employees fear their employers will be able to access their personal phones. That does NOT happen with an authenticator app. Instead, it will provide stronger security for remote logins.

If an employee leaves an organization, the authenticator app for that phone can be blocked by the employer.

To comply, we highly recommend that users have a fairly recent smartphone. Older devices may have problems running the app or require a time-consuming process to get them set up or install a backup process.

We can help any user set up an authenticator app on their phone. In most cases, it’s just a matter of walking someone through the process. Once it’s installed, it can be used independently of the employer for access to any website that offers it as an option to SMS authentication.

Call us – 973-433-6676 – or email us if you have any questions or need help setting up the app.