Effective March 18, 2025, employees can no longer use SMS (text messages) or simple hardware tokens for CalNet MFA verification. 

In UC’s ongoing commitment to safeguarding and protecting your data, UC Berkeley is introducing enhanced security methods for CalNet MFA verification (aka CalNet 2-Step).

After March 18, 2025, you will have two options:

1. You can log in with a bypass code. If you don’t have a bypass code, open a ticket with ITCS.
2. We will allow you to temporarily log into mycalnet.berkeley.edu to add another device to your account. See our KB article for instructions on how to enroll a new device.

Why Do We Need To Change?

Several higher education institutions have experienced phishing attacks, which resulted in the theft of credentials and redirection of paycheck deposits. Berkeley is committed to keeping our community safe from such attacks. Therefore, we are strengthening our multi-factor authentication (MFA) protections and turning on risk-based authentication for CalNet MFA verification.