Twitter on Friday announced that text message-based two-factor authentication (2FA) will now only be available to Twitter Blue subscribers.
Up until now, Twitter users could opt for one of three 2FA methods for additional account security: SMS verification, an authentication app, or a security key. “While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used – and abused – by bad actors,” Twitter said.
As of Friday, users who aren’t subscribed to Twitter Blue will only be able to select an authentication app or a security key as their 2FA method. Non-Twitter Blue subscribers who already have text messages set as their 2FA method will be able to switch to a different option until March 20, 2023, at which point 2FA will be automatically disabled on their account.
Effective March 20, 2023, only Twitter Blue subscribers will be able to use text messages as their two-factor authentication method. Other accounts can use an authentication app or security key for 2FA. Learn more here:https://t.co/wnT9Vuwh5n
— Twitter Support (@TwitterSupport) February 18, 2023
While SMS-based 2FA is prone to SIM cloning and social engineering attacks, the decision to limit it to paid users was likely also financially motivated. Twitter owner and CEO Elon Musk revealed in a December Twitter Spaces session that some telecom operators outside North America were overcharging Twitter for 2FA texts.
Companies have been using bots to artificially pump up 2FA text numbers, costing the social network an absurd $60 million per year. “We’re okay with dealing with some fraud but be reasonable,” Musk said at the time.
“To be clear, two-factor authentication is still not required to log into Twitter, although we highly encourage users to enable it. This change just restricts the 2FA methods available for accounts not subscribed to Twitter Blue,” Twitter Support explained in a follow-up tweet.
SMS-based 2FA now joins blue checkmarks and 4,000-character-long tweets in being a paid feature.
Musk reacted to the change in a tweet on Saturday:
Use of free authentication apps for 2FA will remain free and are much more secure than SMS https://t.co/pFMdxWPlai
— Elon Musk (@elonmusk) February 18, 2023
