Microsoft is taking text-message codes out of Xbox account security

Microsoft has started removing SMS authentication and SMS account recovery from personal Microsoft accounts, according to Pure Xbox. This is not a cosmetic settings change. It also affects Xbox accounts, because Xbox sign-in is tied to the same Microsoft identity layer.

The old flow was familiar: during sign-in or account recovery, the user receives a text message with a six-digit code, enters it into a form and proves control of the linked phone number. Microsoft is now phasing that path out because, according to the source article, SMS-based authentication has become a leading source of fraud. The weakness is not theoretical. Phone numbers can be hijacked, moved through SIM-swap scams or used as the softest target when an account is tied to games, purchases, subscriptions and saved payment methods.

For Xbox users, the practical consequence is direct: if SMS was the main safety net for signing in or recovering access, another verification method needs to be ready. Microsoft is steering users toward passkeys for Microsoft accounts, where identity can be confirmed with Face ID, a fingerprint or a device PIN. In practice, that is less like typing a temporary code and more like proving that the trusted device is actually in the owner’s hands.

The other obvious option remains Microsoft Authenticator, which many Xbox account owners already use for sign-in approval. Nothing in the supplied context indicates that Authenticator is being removed; the change targets SMS as an option. That distinction matters, because users who already moved to an authenticator app are unlikely to feel the same disruption as those who kept their account recovery path tied to text messages for years.

This is also a broader signal about where account security is heading. Passkeys are designed to replace passwords and SMS codes by reducing reliance on secrets that users must copy, remember or receive over a mobile network. For gaming accounts, that is not an abstract standards debate: a game library, Game Pass access, purchases, friend lists and profile history can be valuable enough to attract fraud.

Microsoft’s message is dry, but operationally important. An Xbox account should no longer be treated as “just” a gaming profile; it is a personal Microsoft account with financial and identity consequences attached. The sensible move for anyone still depending on SMS is to check account security settings, add a passkey or Authenticator and stop relying on a text-message code before that option disappears from the sign-in flow.