Penn to end texts, phone calls as two-step authentication options

Amid growing cybersecurity concerns, Penn is phasing out text messages and phone calls as two-step authentication methods for PennKey holders.

Beginning in February 2027, logging in will require alternatives such as Duo Mobile with Verified Push or biometric identification. The change is a part of a multi-phase Information Systems and Computing overhaul of PennKey.

ISC Executive Director of Technology Services and Chief Technology Officer Tiffany Hanulec wrote in a statement that the “information security industry is moving away from calls and texts for second-factor authentication to more secure processes.”

“Penn continues to strengthen PennKey authentication and access controls across the University to keep our data and systems secure,” Hanulec added.

PennKey stopped allowing new users to select text message or phone call as their method of two-step authentication on Oct. 13. Beginning on Nov. 10, affected users will see a weekly reminder when logging in to set up a new method of authentication by Feb. 23, 2027.

Users can check the Duo Device Management Portal to review their current two-step verification methods and set up alternatives. PennKey holders who do not set up another method before the February deadline will be unable to complete two-step verification and will have to IT support for assistance.

According to ISC’s website, approximately 25% of PennKey users currently authenticate with text message or phone call. For users without mobile devices, the website recommends purchasing a physical security key such as YubiKey.

The second phase of the PennKey overhaul will be an update to the two-step authentication process for Microsoft services, slated for March 31, 2027.

Penn targeted by ‘advanced social engineering attacks,’ Annenberg School says

Penn data leaked after University refused to pay $1 million ransom, hacker group says

ISC is also working on a passwordless login for PennKey — which involves biometric authentication or physical security keys — and stronger protections for certain high-risk apps. The timeline for both changes has not yet been released.

An FAQ page lists the risks caused by cyberattacks and “attempts to compromise user accounts” as the reason for the changes. According to ISC, text message and phone call authentication “are among the least secure Two-Step methods.”

“SMS messages, for example, are unencrypted and vulnerable to interception,” the page read. “Retiring these methods will help reduce risks and better protect Penn accounts and University data.”

Penn experienced a major cyberattack last October when the hacker group ShinyHunters sent mass emails to Penn students, faculty, alumni, and parents using accounts linked to the Graduate School of Education.

The emails — which contained profanity and a slur — criticized Penn’s security and hiring practices. The day, ShinyHunters released thousands of pages of internal University files. In a message accompanying the release, ShinyHunters claimed to have gained “full access” to a University employee’s PennKey account.

In February, ShinyHunters claimed responsibility for the attack and released additional documents after Penn did not pay a $1 million ransom .

The Annenberg School of Communication was targeted by “advanced social engineering attacks” in April. The attacks included calls and texts from individuals impersonating the University and prompting users to visit a website to “maintain access” to their accounts.

Penn targeted by ‘advanced social engineering attacks,’ Annenberg School says

Penn data leaked after University refused to pay $1 million ransom, hacker group says

Senior reporter Alex Dash covers administration and can be reached at [email protected] . At Penn, he studies history and political science. Follow him on X @AlexBDash .