How to Switch From SMS 2FA to a Passkey on Any Account

Why switch from SMS 2FA to a passkey now?

SMS codes can be intercepted inside phone networks, while a passkey is designed to resist phishing, and big providers are now moving away from SMS: Microsoft retires its own SMS and voice codes for most work and school accounts from 1 February 2027 ^[1][8].

The risk is not theoretical. On 11 November 2026 the mobile security firm Enea reported that a newly identified actor it calls SilentAir used malicious location-update requests on mobile networks to intercept SMS messages and calls, with SilentAir-related network elements found in at least six Asian countries, and that some targets received 2FA codes immediately after interception ^[11]. The full story is in the Pouyam guide Is SMS 2FA Safe? What the SilentAir Attacks Show.

Official guidance points the same way. The US Cybersecurity and Infrastructure Security Agency (CISA) told highly targeted individuals in December 2024: "Do not use SMS as a second factor", ranking FIDO security keys and passkeys above authenticator apps ^[9]. The US standards body NIST classes SMS and voice codes as a "restricted" authenticator that services must offer an alternative to ^[10].

A passkey works differently. It is a cryptographic key pair stored on your phone, computer or security key, unlocked with your face, fingerprint or screen PIN, and FIDO Alliance describes it as phishing-resistant ^[8]. There is no code to read out or forward, and Google says passkeys are "more secure against phishing" than passwords ^[2]. To compare all methods side by side, see Two-Factor Authentication Explained: Which 2FA Method Is Safest?

How do I switch any account from SMS 2FA to a passkey?

On any account, the safe order is: check that passkeys are supported, create a passkey, add a second way in, save backup codes, then remove the phone number as a second step and test ^[2][3][12]. Skipping the backup step is the most common way people lock themselves out.

1. Check support. Open the account's security or sign-in settings and look for "Passkeys". The community index passkeys.directory, run by 1Password, lists sites that offer passkeys for sign-in or as a second factor ^[12].
2. Create the passkey on the device you use most, and confirm with your face, fingerprint or screen lock ^[2][4].
3. Add a backup. Create a second passkey on another device or a hardware security key, or set up an authenticator app. Passkeys can be synced securely across your devices or bound to one device ^[8].
4. Save recovery codes if the service offers them, and keep them offline. Google, for example, offers printable backup codes for when you lose your phone ^[3].
5. Remove SMS as a second step. CISA advises disabling SMS once a stronger method is enrolled, because a weak fallback undoes the benefit ^[9].
6. Test: sign out and back in with the passkey before you close the settings page.

Some services keep your phone number for account recovery even after SMS sign-in codes are switched off ^[9]. That is not a reason to skip the switch, but it is a reason to protect your mobile account with your carrier's PIN or port-out lock where available. For background on how passkeys work, see What Are Passkeys? How Passwordless Sign-In Works and Why It Is Safer.

How do I switch my Google Account to a passkey?

Create a passkey in your Google Account's security settings, then open 2-Step Verification and remove the phone number yourself, because adding a passkey does not change or remove any existing sign-in or recovery method ^[2]. Google says that on accounts with 2-Step Verification, signing in with a passkey skips the second step, since the passkey confirms you control the device ^[2].

1. Go to your Google Account, tap Security & sign-in, and under How you sign in to Google, open Passkeys and security keys to create a passkey ^[2].
2. Confirm with your fingerprint, face scan or screen lock. Google lists passkey support on Windows 10, macOS Ventura and ChromeOS 109 or later, Android 9 and iOS 16 or later, and on FIDO2 hardware security keys ^[2].
3. Create a second passkey on another device, or add a security key, so you are not relying on one phone.
4. In Security, open 2-Step Verification. Download or print your backup codes; Google describes them as 8-digit codes for when you lose your phone ^[3].
5. Remove the phone number listed as a 2-Step Verification method, or switch it to a Google prompt or an authenticator app.

Two details matter. First, Google may take up to seven days to trust a new phone number added for 2-Step Verification, and having a trusted passkey or security key can speed that up ^[3]. Google also warns to create passkeys only on devices you personally own, because anyone who can unlock the device can then sign in ^[2]. Second, with a Google Workspace account from work or school, your administrator decides whether you can sign in with just a passkey; you can still create passkeys as a second factor and a recovery option ^[2].

How do I add a passkey to a Microsoft account?

Sign in to your Microsoft account's Advanced Security Options at account.live.com/proofs/manage, choose Add a new way to sign in or verify, then select Face, Fingerprint, PIN, or Security Key ^[4]. This page covers personal Microsoft accounts ^[4].

1. On the device where you want the passkey, open account.live.com/proofs/manage and sign in ^[4].
2. Choose Add a new way to sign in or verify ^[4].
3. Select Face, Fingerprint, PIN, or Security Key and follow the prompts ^[4].
4. Choose Continue or Create to store the passkey in the suggested place, or Save another way to pick a phone or security key ^[4].
5. Set up an authenticator app, which Microsoft's passwordless steps rely on, before removing anything ^[5].

Microsoft lets personal accounts go further and remove the password. Under Additional security options, select Turn on next to Passwordless account, then approve the request in your authenticator app ^[5]. Microsoft notes that with two-step verification turned on, you need access to two recovery methods ^[5].

To stop SMS codes, review the list of ways to prove who you are in the same security area and remove the phone number as a sign-in method once the passkey and app work. If you replace a phone, Microsoft says to remove the methods tied to the old device ^[5].

Is Microsoft ending SMS codes for work accounts?

Yes, for codes Microsoft sends itself: from 1 February 2027, Microsoft-provided SMS and voice authentication in Microsoft Entra ID, Microsoft's sign-in service for organisations, is retired for all users except Global Administrators and external users ^[1]. Those two groups follow on 1 July 2027 ^[1].

The change began earlier. From 1 September 2026, passkeys became the default authentication experience in Entra ID and were switched on automatically for users enabled for SMS or voice, who are nudged to register a passkey when they sign in ^[1]. Microsoft's page says SMS and voice "are no longer positioned as secure authentication methods" ^[1].

What this means for you:

• If your work account asks you to set up a passkey, accept: Microsoft's plan nudges users to register a passkey when they sign in and complete MFA ^[1]. Only act on a prompt that appears inside the normal Microsoft sign-in page.
• Depending on your organisation's settings, a passkey can be stored in Microsoft Authenticator, a FIDO2 security key, Windows, or a synced credential manager ^[1].
• Internal guest users follow the 1 February 2027 date, not the later one ^[1].
• Questions about which methods are allowed go to your IT department, which controls the policy.

Never approve a sign-in or passkey request you did not start yourself, and never set one up from a link in an unexpected email or message.

Can I use a passkey for my Apple Account?

Not as the second factor: Apple Accounts use a six-digit verification code for two-factor authentication, and the phishing-resistant upgrade Apple offers is physical FIDO security keys, not passkeys ^[7]. Apple's page on this feature does not mention passkeys ^[7].

Apple's requirements for Security Keys for Apple Account are specific ^[7]:

• At least two FIDO Certified security keys; you can add up to six ^[7].
• iOS 16.3, iPadOS 16.3 or macOS Ventura 13.2 or later on every device signed in to your Apple Account ^[7].
• Two-factor authentication already turned on ^[7].
• Child accounts and Managed Apple Accounts are not supported ^[7].

On iPhone, open Settings, tap your name, then Sign-in & Security, then Two-Factor Authentication and Security Keys, and follow the steps ^[7]. Apple warns that during setup you are signed out of inactive devices (those unused for more than 90 days), and that if you lose all trusted devices and security keys you could be locked out permanently ^[7]. If you remove all security keys, the account goes back to six-digit codes ^[7].

Apple describes security keys as designed for people who want extra protection from targeted attacks such as phishing or social engineering scams ^[7].

How do I set up a WhatsApp passkey?

In WhatsApp, open Settings, tap Account, then Passkeys, Create passkey and Continue, and confirm with your screen lock ^[6]. WhatsApp says that, unlike passwords or SMS verification codes, passkeys are cryptographically secured and can be accessed only with your physical device and your biometric data or screen lock ^[6].

1. On Android you need Android 9 or later, a screen lock, and a password manager account linked to the phone, such as Google Password Manager or Samsung Password Manager ^[6].
2. Open WhatsApp, tap the menu, then Settings ^[6].
3. Tap Account, Passkeys, Create passkey, then Continue ^[6].
4. Confirm with your fingerprint, face or screen lock when asked ^[6].

WhatsApp notes that if you reinstall the app after creating a passkey, you may be asked to use it at registration ^[6]. To change a passkey you delete it and create a new one under the same menu ^[6].

WhatsApp's page does not say that a passkey replaces the SMS code at registration, so treat it as an added layer. Keep the two-step verification PIN as well, so a thief who takes over your number still needs something only you know.

Which accounts support passkeys instead of SMS?

Google, Microsoft and WhatsApp offer passkeys as a stronger option than SMS codes, while Apple Accounts use security keys instead, and many smaller services still offer only SMS or an authenticator app ^[2][4][6][7]. The table below sums up where to find the setting on each, as of 15 November 2026.

Support changes often, so check each service's own security page before you start; the passkeys.directory index lists services that support passkeys for sign-in or as a second factor ^[12].

Prioritise the accounts that unlock everything else: your main email, your phone's cloud account (Google or Apple), your password manager, banking and work accounts. If your email falls, an attacker can reset most other passwords.

What if an account does not support passkeys?

Use an authenticator app instead of SMS, and turn SMS off as a fallback once the app works ^[9]. CISA ranks authenticator apps below FIDO keys and passkeys because their codes can still be phished, but says they are better than SMS, which is not encrypted and can be read if intercepted on a provider's network ^[9]. Interception through telecom signalling, the method Enea describes for SilentAir ^[11], targets messages sent over the phone network, which codes generated inside an app are not.

• Choose an authenticator app that can back up or move codes to a new phone, so a lost phone does not lock you out.
• Save the service's recovery codes on paper.
• Never read a code to anyone who calls or messages you, even if they claim to be the service's support team.
• Check again in a few months: passkey support is spreading quickly, and Microsoft's move away from SMS for work accounts shows the direction ^[1].

If a bank or government service offers only SMS, you cannot change that on your own, but you can reduce the risk: protect your mobile account with a carrier PIN, keep your number's voicemail PIN private, and watch for sudden loss of signal, which can be a sign of a SIM swap. This is general security guidance; your provider's own help pages have the final word on its settings.