Microsoft is officially in the process of removing SMS verification and account recovery as an option for personal Microsoft accounts, which means that Xbox accounts will also be affected by this change.
In fact, instead of sending documents where you can prove your identity with a six-digit code when trying to sign in, Microsoft is now pushing everyone to other methods such as passkey where you can use Face ID, fingerprints and pin numbers to sign in more securely. Many people already use Microsoft Authenticator for their Xbox accounts, and this will continue to work as usual – it’s just an SMS option that will be phased out soon.
“Microsoft is committed to improving security standards and as a result, we will begin to disable SMS as a method of authentication and account discovery for personal Microsoft accounts.”
“Microsoft believes the future of authentication is passwordless, secure, and easy to use. SMS-based authentication is now a leading source of fraud, and by moving to passwordless accounts, passkeys, and verified emails, we’re helping you stay ahead of emerging threats while making account access easy and seamless.”
This image from Windows Latest shows an example of how SMS verification currently works:
The official Microsoft Support website explains in detail how you can secure your Microsoft account if you wish, and it’s worth checking the Security section of your Microsoft account dashboard to see what’s already set up there. I have a passwordless account with two-factor authentication turned on, for example, and my Microsoft Authenticator app (on Android) always sends me a notification whenever I want to sign in to my account.
Sometimes we come across stories of Xbox owners who have sadly been hacked and lost access to their digital game libraries in the process, so it’s worth taking security seriously. Go read the “How to help keep your Microsoft account safe” page on the Microsoft website, see if there’s anything you can do to improve your settings, and hopefully you’ll never have to worry about any kind of fraud in the future.
We’ll leave you with a little more on why Microsoft is making this change:
“SMS verification is vulnerable to phishing and SIM-swap attacks. We replace it with passkeys and verified email for better security and convenience.
Passkeys are a modern, phishing-proof solution using your device’s built-in authentication (such as Face ID, fingerprint, or PIN). They are faster and more secure than passwords or SMS codes. The latest updates to Microsoft account sign-in now support passkeys with device biometric authentication, making phishing almost impossible.”