Textsms Phone Call Two Step Ending

On February 23, 2027 , Text/SMS and Phone Call login methods for PennKey Two-Step Verification (Duo) will end as part of Penn’s ongoing efforts to strengthen account security. If you currently rely on these methods, you will need to set up another login method before the retirement deadline.

Text/SMS and Phone Call are among the least secure Two-Step methods. SMS messages, for example, are unencrypted and vulnerable to interception. Retiring these methods will reduce risks and better protect Penn accounts and University data. This project is one of several PennKey security improvement projects underway.

Beginning October 13, 2026: Text/SMS and Phone Call will no longer be available for new enrollments or enrollment changes. Those who previously added these methods may continue using them until the February 23, 2027 retirement deadline.

Beginning November 10, 2026: Affected users will see a weekly intercept screen during PennKey login reminding them to set up another login method. The reminder will continue until they stop using Text/SMS or Phone Call.

February 23, 2027: Text/SMS and Phone Call login methods will end. Existing “Trust this browser” sessions will expire.

If you currently use Text/SMS or Phone Call for Two-Step, set up an alternate login method before February 23, 2027 using the Duo Device Management Portal (select "Add a device" and follow the prompts). Details are available on the Two-Step Verification: Enrollment Instructions page.

Penn strongly recommends the more secure options below. Set up multiple login options so you have another way to complete Two-Step if your primary method is unavailable.

Duo Mobile with Verified Push – can be used across devices.

Biometric authentication such as Face ID, Touch ID, or Windows Hello – only works on the device where it is set up; you’ll need another login method to sign in from a different device.

Security keys such as YubiKey – users or their Schools/Centers must purchase and provide the security keys.

No mobile device? Use a security key such as a YubiKey. Fobs are also an option but are not phishing-resistant and may be retired in the future. To request a fob at no charge, submit a support ticket through the Tech Center .

Visit the FAQs page for answers to common questions.

Login methods can be added via the Duo Device Management Portal ; see the Two-Step Verification: Enrollment Instructions page for details.

For available login methods, see the Two-Step: Login Options webpage.

your IT Support Provider for help.

For other PennKey security improvement projects, see the Protect Your PennKey website.

Support Providers – Information & Actions Needed

The following information and actions are for School/Center LSPs:

Identify your affected users: Approximately 25% of users currently authenticate with Text/SMS or Phone Call. Designated School/Center LSPs will have access to reports identifying the affected users in their areas.

Communicate with your users: Please distribute the ready-to-send communication below to users in your School/Center before October 13, 2026 (when new Text/SMS and Phone Call enrollments end and before the intercept screen goes live), so they are aware of the upcoming changes. Follow up directly and often with affected users identified in your reports as the February 23, 2027 retirement deadline approaches. Download user communication

Download user communication

Help users transition to another login method: Users can add additional login methods through the Duo Device Management Portal by selecting “Add a device” and following the prompts. Details are available on the Two-Step Verification: Enrollment Instructions page. Recommended options are noted above. You can also consult the Choosing a Login Method guide to help you identify the login methods that best meet each user’s needs and circumstances.

Plan for users without mobile devices: If you have users without mobile devices, they can authenticate with: Security keys (recommended) – Users or their Schools/Centers must purchase and provide the security keys. A fob – Fobs are also an option but are not phishing-resistant and may be retired in the future. To request a fob at no charge, users should submit a support ticket through the Tech Center .

Security keys (recommended) – Users or their Schools/Centers must purchase and provide the security keys.

A fob – Fobs are also an option but are not phishing-resistant and may be retired in the future. To request a fob at no charge, users should submit a support ticket through the Tech Center .

Support users who are locked out: Beginning February 23, 2027, users who only have Text/SMS or Phone Call registered for Two-Step will be locked out and will need an MFA reset from their LSP or PennKey Support .

Communicate with retirees where possible: If you have access to retiree lists for your area, please the information with them. Affected retirees will also see the intercept screen at PennKey login.

Note populations that are not affected: UPHS users and alumni whose PennKey accounts predate the implementation of Duo do not currently use PennKey Two-Step Verification and are not affected by this change.

LSP information sessions: Sessions are held every other Tuesday for LSPs from noon-1 p.m. To be added to the Teams invitation, Jeremy Gatens at [email protected] .

For issues: LSPs may ISC Client Care .