Passwords and SMS Are Dead: Microsoft Begins Sunsetting Text Message Verification for Consumer Accounts

Microsoft announces the phased deprecation of SMS verification for consumer accounts and urges users to adopt passkeys, biometrics, or verified email one‑time passwords. The advisory explains that SMS-based tokens are susceptible to interception and SIM‑swap attacks, describes how passkeys provide non-exportable, origin‑bound cryptographic authentication, and recommends registering multiple passkeys or revoking passwords to achieve a passwordless account posture.