Starting today, SMU requires a Verified Push from Duo Security when accessing the majority of SMU services protected with Duo multi-factor authentication (MFA).
Malicious actors have taken advantage of push harassment and fatigue to exploit weaknesses in security features. To combat this nuisance, the new Verified Push requires you to enter a six-digit numeric code with any push notification. By using a verification code, we ensure only verified users can log in and reduce the chances of someone absent-mindedly accepting a push they did not request. The Verified Push will increase the protection of our MFA solution and help protect your accounts from unauthorized access. Continue reading Duo Verified Push Starts Today
Last week, OIT notified the campus of a successful phishing campaign targeting the SMU community. In this campaign, we noted that cybercriminals had begun using a new technique where they repeatedly send Duo requests to users who have shared their username and password to annoy users into approving the two-factor request.
In an effort to strengthen password security, starting December 19, 2022, any new password may not contain all or part of the user’s account name, common passwords, or words related to an SMU campaign that are vulnerable to password-guessing attacks. 
On Tuesday, January 4, 2022, a security change was made in Duo, preventing the “call me” or SMS passcode options by the SMU community, as these factors were susceptible to vulnerability and fraud.
The Verge