Overview
The Home Office is making Multi-Factor Authentication (MFA) compulsory for everyone who uses the Sponsorship Management System (SMS). Sponsors were notified of the change on 28 August 2026, and it is being switched on in stages rather than all at once.
Two things matter here. The first is getting your account details in order before MFA reaches you. The second is recognising that a period of genuine Home Office emails about login security is exactly the window in which fraudulent ones are most likely to succeed.
Who will be affected?
Every sponsor licence has been assigned to a cohort, and each cohort has its own go-live date. Your own letter from the Home Office states which cohort you are in and the date that applies to you — do not assume a date you have heard from another sponsor applies to your licence.
MFA is switched on after business hours on the stated date, so in practice your users will need it from the following working day onwards.
Dates can move. Where they do, the Home Office posts updates on the SMS message board rather than by email, so someone in your organisation should be logging in to check messages in the days leading up to your cohort date.
Background
The reason for this based around account security, and this restricts SMS access to authorised users only.
The main driver of this system change is due to the phishing emails in 2025 which impersonated Home Office communications that harvested user IDs and passwords. The compromised accounts were then used to issue fraudulent CoS, sold on as fake job offers and sponsorship at £15,000–£20,000 a time. Some sponsors were also flooded with spam to bury CoS payment receipts — so the sponsor wouldn’t notice.
Impact
What to check before your date
MFA will only work if the personal details held for each user are accurate. Log in to SMS and confirm:
- Email address — for all users
- Mobile telephone number — Level 1 users only
- Date of birth — Level 1 users only
Incomplete or out-of-date details can stop a user completing MFA registration or accessing SMS at all.
You should also read the Home Office MFA user guide before your date and keep it open while you register and when you first log in afterwards. The guide is published on gov.uk alongside the sponsorship guidance.
Practical points worth checking now
- Mobile numbers are often stale. Many licences still hold a number from whenever the user was first added. If a Level 1 user has changed phone or left a shared handset behind, MFA will fail at the worst moment.
- Leavers – users who no longer work for you should be removed rather than carried into the new regime.
- Single points of failure – if you have only one Level 1 user, consider what happens if they are unavailable, abroad, or without signal when something urgent needs reporting.
- Whose phone is it? Agree in advance who holds the device that receives the one-time passcode, particularly where SMS duties are shared or outsourced.
The security warning
Change programmes like this generate phishing attempts, because a message about login security looks entirely plausible when you are expecting one.
The Home Office will never:
- Send you a link to the SMS login page, or to SMS guidance
- Send an attachment containing an embedded link to either
- Send you a link to view SMS messages or act on your account, inside or outside SMS
- Ask for your SMS user ID, password, one-time passcode or personal details such as date of birth anywhere outside SMS
- Send you a one-time passcode you did not request
The Home Office will always:
- Direct you to reach SMS through gov.uk
- Direct you to check and update your details within your SMS account
- Warn you against clicking emailed links to SMS or SMS guidance
If you receive an unexpected one-time passcode, treat it as a sign that someone else is attempting to log in as you, and report it.
Reaching SMS safely
Always navigate to SMS yourself rather than following a link:
- Type SMS Log In into your browser
- Search gov.uk for “UK visa sponsorship management system”
- Open that page and select Start now
- Log in
Bookmarking the gov.uk page after arriving this way is safer than relying on a link in an email.
If something looks wrong
Report suspicious emails or calls, and any suspected compromise of your SMS account, to BusinessHelpdesk@homeoffice.gov.uk.
Where the Home Office has reason to believe an account has been compromised, it will act to secure it — including deactivating users — and contact you about next steps. That is a further reason to make sure the contact details on your licence are current.
Date of implementation
17 September 2026 for Cohort 2.
Santa Fe recommendation
If you are unsure which cohort your licence falls into, or you would like support reviewing your SMS user list before MFA is enabled, speak to your usual contact.
To be ready for this change, we advise you log in to SMS and confirm/update:
- Email address — for all users
- Mobile telephone number — Level 1 users only
- Date of birth — Level 1 users only
Contact us
Please get in touch with us for further information or clarification:
Sachini Gamage
Immigration Manager — UK
Santa Fe Relocation
+44 20 3457 3595
sachini.gamage@santaferelo.com
About our Immigration Services
Our distinguished immigration services oversee a substantial volume of visa applications annually, catering to a diverse array of international corporations. Our seasoned team of immigration experts and accredited migration agents are entrusted with the meticulous management of the entire immigration process on your behalf. We are committed to delivering streamlined reporting and offering comprehensive guidance on all immigration-related affairs, ensuring a smooth and efficient experience for our valued clients.