Columbia to Phase Out Text and Call Multi-Factor Authentication

Columbia University is officially pulling the plug on phone calls and text messages as valid forms of multi-factor authentication.

Starting in early December for staff and rolling into January for students, the university will require members of its community to move toward more secure verification methods, the Columbia Daily Spectator reported.

The move marks a significant tightening of the university’s digital perimeter. It comes after a difficult 2025 data breach that compromised the personal information, including Social Security numbers, of nearly three million individuals. As Columbia Information Technology (CUIT) works to harden its defenses, it is treating the reliance on SMS and phone-based verification as a critical vulnerability rather than a convenience.

The math behind this decision is straightforward: hackers have become adept at intercepting text codes and hijacking phone numbers through SIM swapping. In some cases, bad actors have even barraged users with repeated authentication prompts, hoping the victim will eventually tap “approve” just to stop the nuisance.

Once inside, an attacker can redirect payroll deposits, view sensitive academic records, and use the compromised account to launch phishing campaigns against the rest of the campus.

Sh how to know if a security phone call is a scam

The shift aligns with broader industry standards that increasingly view SMS-based authentication as a liability. The Cybersecurity and Infrastructure Security Agency has long recommended against relying on SMS for sensitive systems, noting its susceptibility to interception and phishing. By forcing this transition, Columbia is effectively aligning its internal policy with the guidance provided by national cybersecurity experts.

For the average student or staff member, the shift means migrating to the Duo Mobile app, which is the university’s preferred method. Other supported options include physical security keys, hardware tokens, or biometric verification like Face ID and Touch ID.

The university has made it clear that those who fail to transition before their specific deadline will face a hard lockout from essential systems, including Courseworks, the university’s VPN, and payroll portals.

The transition schedule is tiered by user group, requiring careful attention to the calendar:

User Group	Authentication Deadline	Exception Request Deadline
Faculty & Staff (Text)	Dec. 7	Dec. 2
Faculty & Staff (Call)	Dec. 10	Dec. 2
Students & Alumni (Text)	Jan. 5	Dec. 11
Students & Alumni (Call)	Jan. 11	Dec. 11
Students & Alumni (Other)	Jan. 14	Dec. 11

For those who find themselves in a bind, the university is offering a narrow window for temporary exceptions. However, these are strictly stop-gap measures; all exceptions are set to expire on Jan. 28, 2027. While this transition may feel like an administrative burden, it represents a departure from the “security by convenience” model that has historically left institutions open to sophisticated credential theft.

The reality is that as long as phone numbers can be ported and text messages can be intercepted, they will remain a target for those seeking unauthorized access to institutional data. By closing this door, Columbia is betting that the friction of a new login procedure is a small price to pay to avoid the catastrophic fallout of another large-scale breach.

Worth a look