October 2, 2025

The Federal Housing Administration (“FHA”) rolled out a new phishing-resistant multi-factor authentication (“MFA”) system for its FHA Connection (“FHAC”) portal on September 2, 2025. FHAC is the online platform lenders and servicers use to work with FHA programs. MFA means users must confirm their identity with more than just a password, adding an extra layer of security against cyberattacks.

FHA is offering two ways to set it up:
1) Okta FastPass, an app that verifies logins or;
2) FIDO2, which uses a physical security key or a built-in biometric login (like Windows Hello or Apple Face ID).

Users must complete this setup by October 27, 2025, or they will no longer be able to access FHAC. This requirement only applies to people who log in directly through FHAC, not those who connect through the Business-to-Government (“B2G”) system. Therefore, users should set up MFA now to avoid losing access after October 27.

FHA also announced changes to how loan default data is reported through its Electronic Data Interchange (“EDI”) system. Starting February 2, 2026, servicers must use a new file layout called Transaction Set 264 (“TS 264”) for reporting the January 2026 cycle. The update adds nine new reporting fields (like escrow balances and annual tax or insurance amounts), removes 24 fields that included personal borrower details, and standardizes how dollar amounts are formatted. FHA is urging servicers to begin testing the new file layout with their technology partners and value-added networks (“VANs”) now, but the new format cannot be used before February 2. These changes are meant to strengthen data security, reduce exposure of personal information, and improve reporting consistency across the industry.