Microsoft wants you to ditch SMS passwords as AI makes phishing harder to stop

Microsoft has issued a stern warning to IT administrators, urging a complete abandonment of SMS and voice-based authentication methods due to the rise of AI-powered phishing attacks. In an email obtained by Windows Latest, Microsoft emphasized the need for more robust, phishing-resistant authentication measures in the AI era. The tech giant explained that AI has significantly facilitated the manipulation of SMS and voice channels, making it easier for attackers to execute SIM swapping and gain unauthorized access to users' accounts.

Microsoft cites a sharp increase in AI-driven attacks aimed at stealing passwords and multi-factor authentication (MFA) codes, with these attacks exhibiting a much higher success rate compared to traditional phishing attempts.

As part of a two-step timeline, Microsoft will begin mandating the use of passkeys starting from September 1, 2023, for Entra users who rely on SMS or voice authentication. Users who fail to comply by this deadline will be forced to transition away from SMS or voice authentication before the rollout commences. On February 1, 2027, Microsoft plans to retire SMS and voice authentication altogether, making passkeys the mandatory authentication method for all Entra ID tenants. There are no opt-out options, and every tenant will be affected.

The transition from SMS and voice authentication to passkeys applies to both corporate and personal Microsoft accounts. Microsoft is already phasing out SMS authentication for personal accounts used with services like Outlook, Xbox, and Windows 11. While a confirmed deadline for regular users remains unconfirmed, it is advisable to proactively adopt passkeys or alternative methods such as the Microsoft Authenticator app to stay ahead of the impending changes.

Microsoft's move underscores the growing threat of AI-enhanced phishing and highlights the importance of adopting stronger authentication measures to safeguard personal and business data.