Penn is phasing out SMS and phone call verification for Two-Step Verification by February 23, 2027, according to the Offices of Information Security, Information Systems & Computing and Audit, Compliance & Privacy. The shift aims to protect university accounts from growing cybersecurity risks tied to traditional text and voice methods.
Why SMS and Phone Call Verification Methods Are Being Phased Out
Text message verification has long served as a familiar default option for users logging into online accounts. However, security offices warn that SMS is vulnerable to attacks. Threat actors can execute phone number porting or SIM swapping to hijack a user’s mobile number on a separate device. Furthermore, hackers frequently steal verification codes through phishing and social engineering tactics. Network disruptions and cellular coverage issues can also delay or block text messages entirely, leaving users stranded.
Approved Alternatives for PennKey Two-Step Verification
Users can configure multiple alternative authentication methods to avoid account lockouts when a single option fails. The university supports Duo Push, passcodes generated directly through the Duo Mobile app, and Touch ID on compatible devices. Individuals can also utilize physical Duo hardware tokens or dedicated security keys. Security teams strongly recommend setting up multiple options before the final phase-out date.
Quick Security Check: Multiple Authentication Methods
Did you know? Having more than one verification method configured significantly reduces the likelihood of getting locked out of your PennKey account if your primary device is lost, stolen, or offline.
Frequently Asked Questions About the Verification Changes
When will SMS and phone call verification stop working at Penn?
SMS and phone call verification options will officially be phased out on February 23, 2027.
Which alternative verification methods are available for PennKey?
Penn offers several secure alternatives, including Duo Push, Duo Mobile app passcodes, Touch ID on supported hardware, Duo hardware tokens, and security keys.
What are the primary security risks of using text messages for account protection?
Attackers can intercept SMS verification codes via phishing or steal phone numbers through SIM swapping and porting attacks to compromise accounts.
Worth a look