A major shift away from SMS-based authentication is underway, changing how Americans protect digital accounts as cyberattacks become faster and more automated.
For years, receiving a six-digit code by text message has been one of the most familiar ways for Americans to add a second layer of protection to online accounts. That model is now beginning to change as technology companies and cybersecurity agencies push users toward passkeys and other phishing-resistant authentication methods. The shift matters because digital accounts increasingly connect email, cloud storage, financial information, workplace systems and personal data, making account security a much broader issue than simply remembering a password.
The change became especially relevant this month after the National Institute of Standards and Technology (NIST) finalized new guidance on protecting digital identity tokens, while Microsoft began rolling out passkeys as the default authentication experience for Microsoft Entra ID users. NIST said its guidance addresses the protection of tokens widely used when people access online applications. Together, these developments illustrate a broader transformation in digital security: companies are trying to make authentication harder for attackers without making it harder for legitimate users.
Why are passkeys replacing familiar SMS security methods?
Passkeys are designed to authenticate users without relying on a password or a code sent through a text message. Instead, they use public-key cryptography, with credentials stored through supported devices or credential managers. The approach is intended to make phishing considerably more difficult because there is no ordinary password or one-time SMS code for an attacker to trick a person into revealing.
Microsoft began rolling out passkeys as the default authentication experience in Entra ID on September 1, 2026. Users who had previously been enabled for SMS or voice authentication can be prompted to register a passkey when completing multifactor authentication. Microsoft has also announced that its own SMS and voice authentication service will be retired beginning February 1, 2027, although organizations with specific requirements can use customer-managed telecommunications providers.
The change reflects an important problem with traditional authentication: attackers no longer need to defeat sophisticated encryption if they can persuade a person to disclose a legitimate credential. Phishing, impersonation and social engineering can exploit the human side of security, while automated tools can help attackers conduct campaigns at greater speed. Microsoft Security Research recently described an active campaign in which compromised cloud identities were followed by unauthorized authentication methods, account reconnaissance and attempts to access information stored in services such as SharePoint and OneDrive.
For consumers, the practical lesson is that an authentication method can be convenient without being equally resistant to every type of attack. A text message may still provide more protection than having no multifactor authentication at all, but the technology industry is increasingly treating phishing-resistant methods as the next stage of account security.
What does the new digital identity approach mean for Americans?
The significance extends beyond Microsoft accounts because the same underlying identity infrastructure supports many modern online services. When someone signs into webmail, a cloud application or a business platform, the system can issue a digital token that tells the service who the user is and what resources that person can access. NIST’s new guidance specifically addresses the protection of these tokens and assertions against forgery, theft and misuse.
That matters because stealing an access token can potentially allow an attacker to bypass some of the normal steps involved in logging into an account. NIST explained that tokens are widely used to access online applications and said its recommendations can be useful not only to federal agencies but also to commercial organizations that rely on identity and access-management infrastructure. The guidance therefore reflects a broader shift in cybersecurity from protecting only passwords toward protecting the entire chain of digital identity.
For workers, the consequences could be particularly noticeable as companies rely more heavily on cloud platforms and artificial intelligence. Employees increasingly move between email, collaboration software, document repositories, development environments and AI services, often while working across multiple devices. Every additional connection creates another opportunity for unauthorized access, so stronger authentication and better control over digital tokens become increasingly important.
There is also a usability component. Passkeys can be stored on devices or supported password-management systems, allowing authentication through familiar device security such as biometrics or a local PIN. That can reduce the number of passwords people need to remember while also reducing opportunities for attackers to steal credentials through deceptive login pages. The challenge will be ensuring that recovery procedures, account transfers and access from unfamiliar devices remain secure and understandable.
What should users and businesses expect next?
The next phase will likely involve authentication becoming increasingly invisible to users. Instead of repeatedly typing passwords and waiting for text messages, people may authenticate through a trusted device, credential manager or security key. Microsoft already supports multiple forms of passkeys, including synced credentials and device-bound options, while its current transition is designed to move organizations away from methods that can be more easily phished.
Businesses will face a more complicated transition because authentication systems are deeply connected to employee access, customer accounts, compliance requirements and technical infrastructure. Organizations need to identify which users still depend on SMS or voice authentication, determine which passkey options work with their devices and establish reliable recovery processes. Microsoft has set October 30, 2026, as the date when customers that need SMS or voice for specific operational requirements can begin configuring supported telecommunications providers through its Security Store.
The cybersecurity challenge will not disappear simply because passkeys become more common. Attackers can continue targeting people through impersonation, fraudulent support requests, compromised devices and manipulation of account-recovery processes. Microsoft Security Research’s recent findings demonstrate why protecting the identity layer requires monitoring authentication activity and cloud services together rather than treating login credentials as an isolated security problem.
What happens next will depend on how quickly organizations adopt phishing-resistant authentication and how effectively the industry improves recovery and identity-management systems. NIST’s September guidance suggests that protecting digital identity tokens is becoming a central security priority, while Microsoft’s passkey transition shows how those principles are moving into everyday products. For Americans, the result could be a gradual change in what “logging in” means: fewer passwords and text codes, more device-based authentication, and a greater emphasis on protecting the digital identity behind every account.
