You know the routine. You try to log in to your email or bank account, and up pops a little box asking you to wait for a six-digit code to arrive by text. You find your phone. You wait. You type it in before it expires. Every single time.
Well, that process is changing, according to Reader’s Digest. Microsoft has announced it is phasing out those text-message codes (called SMS verification) for personal accounts. That includes Outlook, MSN, Hotmail, Xbox, Skype, and Windows products. The change is also coming for workplaces and schools that use Microsoft products, with a target date of July 2027 for organizations to fully make the switch.
OpenAI and Google are moving in the same direction. OpenAI announced earlier this year that users will have the option to switch to a different form of verification. Google still supports text codes but is actively encouraging users to move on to newer options.
Why Are Text Codes Being Dropped?
According to Microsoft, SMS verification is a major source of fraud. Phone and cellular networks were never built to keep plain-text messages private. That leaves the door open for criminals.
One of the most common tricks is called SIM-card swapping. Fraudsters contact your mobile carrier, convince them to transfer your phone number to a new SIM card they control, and then intercept the login code that gets sent to what they now pretend is your phone. The FBI reported that this type of fraud cost consumers $26 million in 2024.
Courts have been busy with these cases. A Texas man was convicted of SIM-card swapping fraud, sentenced to 70 months in federal prison, and ordered to pay $1.7 million in restitution to victims. A Florida man received a 10-year sentence for similar crimes involving 59 separate victims.
Text messages also make phishing scams easier. A scammer sets up a fake page that looks exactly like your bank or email provider, sends you a text to lure you in, and captures both your password and your verification code when you enter them on the fake site. The Federal Trade Commission reported that text-message fraud cost consumers $470 million in 2024.
What Replaces the Text Code?
Microsoft is moving to something called a passkey. Instead of sending a code through a text message, a passkey uses your device itself to prove it is really you. That might mean your fingerprint, your face, a PIN, or a physical security key.
Here is how it works. A private key is stored on your device, like your fingerprint or Face ID. A public key lives on the website you are trying to reach. When you log in, those two keys check each other. If they match, you are in. Nothing sensitive travels over the air. Passkeys cannot be faked by outside criminals the way a text code can.
How Do You Set One Up on a Microsoft Account?
It is simpler than it sounds. When you log in to your Microsoft account, you will see a prompt to create a passkey. For personal accounts, it is currently optional, so you can skip it for now if you prefer.
If you want to set one up, here is what to do:
- Click Sign in faster when the prompt appears or go to Advanced Security Options if you are already logged in.
- Select Add a new way to sign in or verify.
- Choose from Face, Fingerprint, PIN, or Security Key.
- Follow the on-screen steps to create your passkey.
- Select Save to store it where suggested, or Change to pick a different location.
The next time you log in, no waiting for a text code. Your device will simply ask you to confirm with whichever passkey you chose: your face, fingerprint, or PIN.
When Does the Old Way Disappear?
Microsoft has set July 2027 as the deadline for organizations to complete the move. For personal accounts, the company has not announced a specific end date yet. Text codes are still working for now.
So you have some time. But given how much fraud those simple text codes have made possible, setting up a passkey sooner rather than later is not a bad idea. It takes just a few minutes and makes your accounts a good deal harder to crack.
