Faqs Textsms Phone Call Ending

On February 23, 2027 , Text/SMS and Phone Call login methods for PennKey Two-Step Verification (Duo) will end as part of Penn’s ongoing efforts to strengthen account security. See below for details.

A: On February 23, 2027 , Text/SMS and Phone Call login methods for PennKey Two-Step Verification (Duo) will end. If you currently rely on either method, you will need to set up another login method before the rollout deadline.

A: The change affects PennKey Two-Step Verification users who currently use Text/SMS or Phone Call. Approximately 25% of users currently authenticate using one of these methods.

Q: Does this change apply to PennO365 Two-Step?

A: Yes. The change also applies to PennO365 Two-Step.

Q: Why are these methods being retired?

A: Penn is retiring these methods as part of ongoing efforts to strengthen account security. Cyberattacks and attempts to compromise user accounts continue to pose significant security risks, and stronger authentication methods are increasingly important.

Q: Why are Text/SMS and Phone Call considered less secure?

A: Text/SMS and Phone Call are among the least secure Two-Step methods. SMS messages, for example, are unencrypted and vulnerable to interception. Retiring these methods will help reduce risks and better protect Penn accounts and University data.

Q: When will I start seeing reminders if I am affected?

A: Beginning November 10, 2026 , affected users will see a weekly intercept screen during PennKey login reminding them to set up another login method. The reminder will continue until they stop using Text/SMS or Phone Call. Users may also receive additional information from their School/Center IT support providers.

Updating Your Login Method

Q: How do I know if I currently use Text/SMS or Phone Call for Two-Step?

Visit the Duo Device Management Portal to review the login methods currently associated with your Penn Two-Step account.

Q: What should I do if I currently use Text/SMS or Phone Call?

A: Set up an alternate login method before the February 23, 2027 deadline. Go to the Duo Device Management Portal , select “Add a device,” and follow the prompts. Details are available on the Two-Step Verification: Enrollment Instructions page. Penn recommends setting up multiple login options so you have another way to complete Two-Step if your primary method is unavailable.

Q: What alternate login methods are recommended?

A: Penn strongly recommends more secure options, including:

Duo Mobile with Verified Push – can be used across devices.

Biometric authentication such as Face ID, Touch ID, or Windows Hello – only works on the device where it is set up; you’ll need another login method to sign in from a different device.

Security keys such as YubiKey – users or their Schools/Centers must purchase and provide the security keys.

Q: Can I have more than one login method set up for Penn Two-Step?

A: Yes. Penn recommends setting up multiple login options so you have another way to complete Two-Step if your primary method is unavailable.

Q: I already have another login method set up. Do I still need to do anything?

A: If you already have another login method set up, you will be able to use it instead of Text/SMS or Phone Call. Penn recommends that you begin using an alternate method as soon as possible rather than waiting until the deadline.

Q: Do I need to remove Text/SMS or Phone Call after I add another login method?

A: No. If you previously enrolled Text/SMS or Phone Call, you may continue using those methods until the February 23, 2027 deadline. Penn recommends beginning to use one of the more secure alternatives before then.

Q: Will this change affect how I sign in with Duo Mobile?

A: No. This change is specifically ending Text/SMS and Phone Call login methods. Duo Mobile with Verified Push remains an available and recommended Penn Two-Step login method.

Q: Does this mean I need a smartphone to use Penn Two-Step?

A: No. If you do not have a mobile device, you can use:

A security key such as YubiKey (recommended) – Users or their Schools/Centers must purchase and provide the security keys. your IT Support Provider for information security key options.

A fob – Fobs are also an option but are not phishing-resistant and may be retired in the future. To request a fob at no charge, users should submit a support ticket through the Tech Center .

Q: How do I set up a security key such as YubiKey?

A: Follow the security key Enrollment Instructions and see the security key (YubiKey) FAQs for additional information.

Timeline & What to Expect

Q: Can I add Text/SMS or Phone Call as a new login method after October 13, 2026?

A: No. Beginning October 13, 2026 , Text/SMS and Phone Call will no longer be available for new enrollments or enrollment changes. If you previously added one of these methods, you may continue using it until the February 23, 2027 deadline.

Q: Can I continue using Text/SMS or Phone Call until the February 23, 2027 retirement deadline?

A: Yes. If you already have Text/SMS or Phone Call set up, you may continue using it until the February 23, 2027 deadline. However, beginning October 13, 2026 , these methods will no longer be available for new enrollments or enrollment changes.

Q: Can I wait until February 23, 2027 to set up another login method?

A: If you already have Text/SMS or Phone Call set up, you may continue using it until the February 23, 2027 deadline. However, Penn recommends setting up and beginning to use another login method before then. Beginning October 13, 2026 , Text/SMS and Phone Call will no longer be available for new enrollments or enrollment changes.

Q: What happens if I do not set up another login method before the deadline?

A: After the February 23, 2027 rollout, Text/SMS and Phone Call will no longer be available for Two-Step Verification. If you do not have another login method configured by the deadline, you will be unable to complete Two-Step and will not be able to access PennKey-protected resources. You will need to your IT Support Provider or PennKey Support for assistance.

Q: What happens to my existing "Trust this browser" sessions after the rollout?

A: Existing “Trust this browser” sessions will expire after the rollout. The time you log in, you will need to complete Two-Step Verification and re-enable browser trust if you want to use that feature.

Additional Information & Resources

See the Project webpage for additional information.

To add another login method, visit the Duo Device Management Portal , select "Add a device," and follow the prompts; see the Two-Step Verification: Enrollment Instructions page for details.

See the Two-Step: Login Options webpage for information available login methods.

your IT Support Provider for help.

For other PennKey security improvement projects, see the Protect Your PennKey website.