2FA while traveling abroad: what breaks, and when

The flight is in nine days, or it left yesterday. Either way the question is the same: when the bank asks for the code it texts you, where is that text going to arrive?

Most of the advice you will find answers that by selling you a number. Rent a line that forwards your texts to an email address. Buy a travel eSIM that can receive SMS. Pay a couple of dollars a month and stop worrying. Every one of those answers takes the same thing for granted, which is that the job is to keep receiving texts. For almost everybody the better job is to need fewer of them before you go, and the reason sits in the details of how a bank's text actually travels.

This page is the travel-specific part only. Why an app beats a text message in general is authenticator app vs SMS. What follows is what changes when the handset crosses a border, the order the work has to be done in, the slot in your account settings that keeps your home number long after you believed you had moved off it, and a short path for somebody who is already abroad with a sign-in screen refusing to let them through.

The short answer

1. Do the switching at home. Almost every service protects its security settings with the factor already on file, so the SMS check you are trying to retire is the one standing between you and retiring it.
2. Start more than a week out. Google treats turning on 2-Step Verification as a sensitive action and wants a device registered for at least seven days before it counts; recovery phone changes can take another seven.
3. Keep your home SIM. Travel eSIMs are usually data only. The number that receives your codes is the one on the SIM you were about to leave behind.
4. Empty the recovery slot too. Moving codes off SMS does not touch the separate phone number sitting in account recovery, and that number is still a way in and still a way out.
5. Do not rent a second factor. A service that forwards your texts to email makes a stranger the first reader of your codes and your mailbox the single point of failure for everything.
6. Crossing time zones never breaks a code. TOTP is computed from UTC. Only a wrong device clock breaks it.
7. If you are already stuck, work in order: backup codes, then a session still signed in, then a route that avoids SMS entirely, and stop guessing at the login screen.

Why a texted code stops arriving at the border

"SMS 2FA is not working abroad" is four different problems wearing one sentence, and the fix is different for each. It is worth knowing which one you have before you buy anything.

You put a local SIM in the phone. Your bank is still texting the home number, which is now in a hotel safe inside a dead handset. The instinct is to give the bank the new local number instead, and this is where the obvious move quietly fails: a great many verification texts are sent from a short code, and short codes are provisioned country by country. Twilio, which operates a large share of them, puts the limit plainly in its international messaging guide: "Not all countries support short codes, nor do they support short codes from one country to send to another country" (Twilio Docs). A short code registered in the United States cannot text a Spanish number at all. Your new local number is not a replacement for the old one; for a large class of senders it is not even a possible destination.

You kept the home SIM and are roaming. The number is now right, and the question becomes whether the message survives the roaming leg. Short-code traffic is the fragile kind here, because it is routed on agreements between operators rather than as ordinary person-to-person text, and support for it across a roaming link is not something the sender controls (Twilio Support). The practical signature of this failure is what makes people believe their phone is broken: a friend's message lands, the bank's does not, and nothing on the screen explains the difference.

The service decides not to send. Even with a working number on a working network, the sign-in itself can be the thing that trips. Google is direct about it in its own troubleshooting page: "If we notice something different about how you sign in, like your location, you might not be able to get a verification code through text message" (Google Account Help). A first login from a new country is exactly the signal a risk engine is built to notice.

The travel plan never carried voice in the first place. This one surprises people who did prepare. Apple's guidance on travelling with an eSIM points at "data only eSIM plans" and notes that if you use only the travel eSIM, FaceTime and iMessage keep working on your home line (Apple Support). That is the shape of most travel eSIMs: a data pipe with no number of its own. iMessage and WhatsApp ride over the data and feel normal, which is precisely why the missing SMS looks like a glitch rather than a design.

The eSIM sellers writing about this problem are not wrong about any of it. They are simply selling the part of the answer that is a number, and the part of the answer that is a number is the part that ages worst.

The migration loop: why this is a job for home

Here is the trap the pre-departure checklists do not quite name. The check you have to pass in order to change the method is the method you are trying to change. Open the security settings to move an account off SMS and the service asks you to prove it is you, by texting you a code. At home that is a five-second annoyance. Abroad, with the text that will never arrive, it is a closed door, and it is closed on the one screen that could have opened it.

Two documented Google behaviours turn that annoyance into a calendar problem rather than an afternoon problem.

Turning on 2-Step Verification is classed as a sensitive action, and the proof Google wants has an age requirement: "To prove it's you, make sure you have a device or security key. It needs to be registered to your account for at least 7 days" (Google Account Help). A phone you registered this morning is not yet evidence of anything.

Changing the recovery phone number has its own delay. Google's page on it says the change "may take up to 7 days to take effect" (Google Account Help).

Neither of those is a bug and neither can be hurried. They are the reason this work has a date attached rather than a place on a list, and they are the single biggest thing separating a calm departure from a frantic one.

The dated pre-departure sequence

Two weeks is comfortable. Ten days is enough. Under seven days you are relying on the services that have no waiting period, which is most of them but not the important ones.

Two notes on that table. The sign-out test on the day before is the step people skip and the one that catches the most: an authenticator entry that was scanned but never saved, a service that silently kept SMS as the preferred method, a backup code sheet that belongs to the account you regenerated afterwards. And every one of these steps is reversible from home and almost none of them are reversible from a hotel.

The recovery slot nobody empties

You moved the codes to an app. The account no longer texts you at sign-in. And in a different part of the same settings page, a phone number is still on file, because sign-in and recovery are two separate edges out of your account and almost no interface shows them together.

Google lists what its recovery number is for, and the list is not decorative: "to send you a code to get into your account if you're ever locked out", "to make it easier for you to prove that an account is yours", and "to tell you if there's suspicious activity on your account" (Google Account Help). Every one of those depends on a number you can read. Abroad, on a local SIM, that is a number you cannot read, so a slot you believed was a safety net is a dead end, and it is a dead end exactly when you need it.

On Apple accounts the shape is different and the fix is better. Apple requires the number: "To use two-factor authentication, you need at least one trusted phone number on file where you can receive verification codes." It also offers the move worth making before a trip, which is that if you have several numbers, "consider using one not associated with your iPhone as an additional trusted phone number" (Apple Support). A second trusted number on a partner's phone, or on a line you keep at home, is a route back in that does not depend on the handset in your pocket. Apple's trusted devices also display a code directly, which means a laptop you travel with can answer the challenge with no text message anywhere in the path.

The audit is short. For each account on your list, ask what the recovery number is, whether you will be able to receive on it from where you are going, and if not, whether there is a second number or a non-phone route you can add instead. Where the honest answer is that there is nothing to add, that is the account to give a printed sheet of backup codes to.

Why renting a number, or forwarding your texts, is the wrong trade

The most widely shared advice for this problem is to pay a small monthly fee for a service that receives your 2FA texts on a number it owns and forwards them to your email. It is genuinely convenient and it is a poor trade, for three reasons that have nothing to do with the company's honesty.

It gives your second factor to somebody else first. The entire point of a second factor is that it reaches you and nobody else. A forwarding service reads every code before you do, for as long as you are a customer and for as long as its systems hold the message. You are not adding a factor; you are adding a party.

It makes email the single point of failure for everything. Once the codes arrive by email, your mailbox is no longer one account among many, it is the key to all of them, and a mailbox you cannot reach takes every account with it. That failure has its own shape and its own escape route, both of which are in locked out of email and 2FA. Adding a deliberate dependency on it, days before leaving the country, is the wrong direction to walk.

A number that lives inside another account inherits that account's lockout. Google says this about its own product rather than a competitor's, which is what makes it worth quoting: "If you use Google Voice to get verification codes, you could lock yourself out of your account" (Google Account Help). Sign out of the app, need a code to sign back in, and the code goes to the app you are signed out of. Any virtual number reached through a login has the same shape, and a rented number has one more problem on top: it is a tenancy. Stop paying and it is not yours, along with every account still pointing at it.

None of this means a second number is useless. A real, long-lived SIM on a cheap plan, kept in your own name and in your own hands, is a reasonable thing for a frequent traveller to own. The thing to avoid is renting the delivery of your second factor from somebody whose business is reading it.

The time-zone myth

This one costs people a genuinely bad hour in an airport, so it is worth settling. Crossing time zones does not break an authenticator code. TOTP is computed from Unix time, counted from a fixed moment in UTC, and RFC 6238 requires both sides to be able to derive it. Two correctly set phones in Tokyo and in Lisbon produce the same six digits for the same account at the same instant. There is no local time anywhere in the calculation, and there is no setting in any authenticator that needs changing when you land.

What actually breaks is the absolute clock, and travel is unusually good at breaking it. A phone set to manual time, because somebody turned off automatic date and time once and never turned it back on, drifts freely and will not correct itself on arrival. A handset that spent eleven hours in airplane mode comes back needing a network to resync against, and the airport Wi-Fi it finds first does not supply one. A phone that picked up the wrong time from a border network, or a dual-SIM phone taking time from a line you just disabled, lands on a time that looks plausible and is not. The symptom is identical in every case: correct-looking codes, universally refused.

The fix is the same everywhere and takes ten seconds: turn automatic date and time back on, let the phone reach a network, and try again. The full diagnosis, including the apps that keep their own time offset separately, is in why your 2FA code is not working.

Already abroad and the codes are not arriving

Work this list in order. The order matters, because the cheap routes cost nothing to try and the expensive ones have a way of closing the cheap ones behind them.

1. Backup codes, if you have them. They need no network, no number and no clock. Google issues ten and spends them one at a time: "after you use a backup code to sign in, that code becomes inactive" (Google Account Help). If the sheet is in your luggage, this is a two-minute problem and you are done.

2. Find a session that is still signed in. A tablet, a work laptop, a browser profile you never use. A live session will often let you reach the security settings and add something permanent from inside the account, which is the one move that makes everything after it easier. Spend it immediately rather than carefully; the method is the same as for a lockout at home and it is laid out in locked out of email and 2FA.

3. Try Wi-Fi Calling, and verify rather than assume. It carries your home number over an internet connection instead of a cellular one, which is exactly the right shape for this problem. Whether it works for you depends on your carrier and your plan, so check your own carrier's page rather than a general article. AT&T, as one documented example, states that "Wi-Fi calls from other countries to U.S. numbers are at no additional charge" and that "text messages you send or receive with Wi-Fi Calling count the same as regular text messages" (AT&T). Two cautions: it usually has to be switched on before you leave, and a successful ordinary text does not prove that a short-code message from your bank will follow the same path. Test with a code you actually need, not with a message from a friend.

4. Put the home SIM back and roam for a day. Unglamorous, and often the fastest route to a single code you need once. Inside the European Union and the EEA this is also cheap by law: under the roaming rules, travellers can call, text and use data in another member state without extra charges, and receiving a text while roaming is covered too (European Commission). Elsewhere, buy the smallest day pass your carrier sells, clear the codes you need, add a factor that does not depend on the number, and switch back.

5. If it is a work account, call your administrator first. This is the one case where somebody genuinely stands above your account and can act. A Microsoft Entra Authentication Administrator can issue a Temporary Access Pass, which Microsoft describes as "a time-limited passcode that can be configured for single use or multiple sign-ins" and which "makes recovery easier when a user loses or forgets a strong authentication method". Its lifetime is configurable anywhere from ten minutes to thirty days and defaults to one hour (Microsoft Entra docs). It exists for exactly the person this section is about. For a personal account nobody holds that power, and the time is better spent on the routes above.

6. Take the email-free accounts first. Plenty of services never touch a phone number in the 2FA path at all, and those are free wins that sometimes hold a code or a contact you need for the harder ones.

7. Stop retrying. Repeated failures trigger throttling, and at more than one large provider a fresh attempt sets back a recovery already in progress. Work out the route first, then make one attempt, from a device and a network you normally use.

There is an eighth option people reach for, which is to ask somebody at home to read them the code from a phone holding their SIM. It works. It is also a habit worth keeping rare, because a second factor read aloud over a phone call is a second factor that two people have now handled, and the same conversation is what a stranger with your name would attempt. Use it for the account you need today, then fix the account so you do not need it tomorrow.

What a hardware key in your bag buys you

For some travellers the right answer is not an app at all, and this is the point to say what KeyNesta cannot do: it has no passkeys and no security keys. It generates TOTP and HOTP codes and nothing else, and passkeys are named on the features page among the things deliberately not built. Where the best travel answer is a key, KeyNesta is not that answer, and registering one directly with the account is the move.

A security key is unusually well suited to this exact trip. It needs no network, no phone number and no correct clock, so three of the four failures above simply do not apply to it. It is also the only factor on this page that survives the hotel-lobby phishing page, because the credential is bound to the real site's domain and will not release anything to a lookalike. Against that: it is a physical object in a bag that airlines lose, and some countries and some venues will ask about it. The standing advice is to carry two, registered to the same accounts, kept in different places, which is also the advice that makes losing one survivable.

Whether it is worth the money and the ritual is a real question with a real answer either way, and it is worked through in authenticator app vs security key and passkeys versus authenticator apps.

Where KeyNesta fits, and what it cannot do

KeyNesta is an authenticator, so it covers the part of this an authenticator can cover. Codes are generated on the device from a secret that never leaves it, which means they keep working on a plane, on a foreign SIM, on no SIM at all and with the network off. There is no phone number anywhere in the product, so nothing in it can be lost by swapping a SIM, and no account is needed to generate a code at all. What the server holds, and does not, is listed at what our server stores.

The travel-shaped thing it does handle well is the second device. An encrypted backup file needs no account and can be restored onto a laptop you are taking with you; optional sync is end to end encrypted, so a second device set up before departure keeps generating the same codes if the phone is stolen in a market. That is worth doing deliberately rather than as a convenience, and the trade-offs are in using an authenticator app on two devices.

What it cannot do is the rest of the page. It cannot make a bank text a foreign number, it cannot stand in for a passkey or a security key, and it cannot recover an account whose only route back in is a phone you cannot reach. Nor can it recover your vault: sync is zero knowledge, the server holds ciphertext and no key that opens it, and a forgotten passphrase is a dead end. That trade is set out honestly in what zero-knowledge costs you.

Frequently asked questions

Takeaway

The question is not how to keep receiving texts in another country. It is how many accounts still depend on receiving one, and the answer to that is decided at home, on a date, with the text messages still arriving. Spend an evening two weeks out: list the accounts that text you, move the important ones to an app while the SMS check still works, register the factor you will travel with early enough that the seven-day clocks have run out, fix the recovery phone number that nobody fixes, and print the backup codes. Keep the home SIM where you can reach it. Remember that no time zone has ever broken a code and only a wrong clock has. And if you are reading this in a hotel with a sign-in screen refusing you, start with backup codes, then a session still signed in, then a route that avoids SMS altogether, and stop guessing in between.

Sources

• Twilio Docs, "What to know before sending international SMS messages"
• Twilio Support, "Will my Twilio short code work internationally?"
• Google Account Help, "Fix common issues with 2-Step Verification"
• Google Account Help, "Verify it's you when you complete a sensitive action"
• Google Account Help, "Add or change your recovery phone number"
• Google Account Help, "Sign in with backup codes"
• Apple Support, "Use eSIM while traveling internationally with your iPhone"
• Apple Support, "Trusted devices and trusted phone numbers"
• AT&T, "Stay connected with Wi-Fi Calling"
• European Commission, "Roaming: connected anywhere in the EU at no extra charge"
• Microsoft Entra docs, "Configure a Temporary Access Pass"
• RFC 6238, "TOTP: Time-Based One-Time Password Algorithm"