A migration plan away from SMS codes names a stronger alternative, tells users why, adds checks for recent SIM changes, sets a trigger for dropping SMS, and assigns an owner. NIST SP 800-63B asks services that offer restricted authenticators to have such a plan.
Why a plan is expected
NIST SP 800-63B treats SMS and other PSTN based out of band verification as RESTRICTED. For restricted authenticators, Section 5.2.10 says the service must offer at least one alternate non-restricted authenticator, give subscribers meaningful notice of the risks and alternatives, address the added risk in its risk assessment, and create a migration plan in case the authenticator becomes unacceptable. NIST also notes that it may change the status over time.
Outline for the plan
- Scope. Which user groups use SMS today? Administrators, customers, staff? Count them.
- Alternative. Pick the non-restricted option or options you will offer, and make sure each can meet the assurance level you need.
- Enrolment path. Decide how users add the alternative without weakening recovery. Changing the registered phone number counts as binding a new authenticator under the standard, so treat it with the same care as a new enrolment.
- Notice. Write the user message: what is changing, what the risk is, and how to switch. Keep it short and specific.
- Risk signals. Section 5.1.3.3 says verifiers should consider device swap, SIM change, number porting and other abnormal behaviour before sending a secret over the PSTN. Decide which signals you can get, and what you do when one appears, such as requiring the alternative.
- Trigger. Define what makes you stop offering SMS: a change in NIST's position, a rise in account takeover tied to SMS, or a customer or regulator requirement. Pick a date for review even if nothing triggers it.
- Owner and metrics. Name one owner. Track the share of active users on SMS, and the share with an alternative enrolled.
Sequencing that tends to work
Start with the people whose accounts do the most damage if taken over, such as administrators, finance users and support staff. Offer the alternative, make it the default for new enrolments, then work down.
Do not remove SMS before account recovery has been rethought. If SMS doubles as the recovery path, removing it can lock people out, and a rushed fallback to weak support questions is worse than the problem you started with.
What to avoid
- Telling users SMS is "unsafe" without giving a clear next step.
- Using email as the replacement for out of band codes. The standard says methods that do not prove possession of a specific device, such as email, must not be used for out of band authentication.
- Leaving the plan as a document nobody owns.
Quick check
Is the migration plan a formal requirement for every service?
NIST SP 800-63B says the credential service provider must create one for restricted authenticators. Whether a given contract or regulation adopts that standard is something to check for your case.
Sources
Last reviewed: 19 October 2026.
