KPN mandatory SMS authentication
KPN is a Dutch telecommunications company. Its MijnKPN service provides customer access to billing, subscription management, and account settings for broadband, television, and mobile services.
Background
[edit | edit source]In July 2025, KPN announced that two-step verification (2FA) would become mandatory for all customer accounts, being gradually phased in over the following month: it was mandatory for 1% of customers on 14 July 2025, 5% the following week, and all customers starting in mid-August 2025.[1]
Incident
[edit | edit source]When the requirement was enforced, KPN's implementation relied exclusively on one-time codes sent by SMS. Customers without a mobile phone, or with a non-Dutch mobile number, could not receive the codes: KPN's platform accepted only Dutch mobile numbers, and the two-step verification could not be disabled, including through customer service.[2]
A KPN moderator on the company's community forum confirmed that only Dutch mobile numbers could be used for verification, and advised customers without one to contact customer service by phone.[3]
KPN's response
[edit | edit source]KPN stated that SMS was the most widely accessible form of verification, and initially said that alternative secure login methods were being explored but no concrete plans were known.[1]
On 23 April 2026, KPN added an authenticator-app option alongside SMS, so that customers can choose the method that suits them best.[2]
Consumer response
[edit | edit source]Customers on the company's community forum reported being unable to set up two-step verification with a foreign mobile number, and asked how the requirement could be met without a Dutch number.[3]
References
[edit | edit source]- ↑ 1.0 1.1 Redactie (2025-07-25). "KPN verplicht 2-stapsverificatie in augustus voor alle klanten" [KPN makes two-step verification mandatory in August for all customers]. Security.NL (in Nederlands). Archived from the original on 2025-07-27. Retrieved 2026-09-28.
- ↑ 2.0 2.1 Shyrin (2025-07-23). "MijnKPN: Tweestapsverificatie (MFA) wordt verplicht: wat betekent dit voor jou?" [MijnKPN: Two-step verification (MFA) becomes mandatory: what does this mean for you?]. KPN (in Nederlands). Archived from the original on 2026-09-27. Retrieved 2026-09-28.
- ↑ 3.0 3.1 Alexandra (2025-08-18). "Hoe gebruik ik tweestapsverificatie zonder Nederlands telefoonnummer?" [How do I use two-step verification without a Dutch phone number?]. KPN (in Nederlands). Archived from the original on 2026-09-29. Retrieved 2026-09-27.