How to keep your phone number and 2FA working while living abroad (2026)

Move every account you can to an authenticator app or a passkey, keep backup codes somewhere offline, and keep one phone number that can still receive SMS for the accounts that insist on it. That's the whole strategy. The rest of this guide is how to do each part without paying for three phones, and what each carrier, VoIP service and platform actually says on its own pages (all checked on 26 October 2026).

Why your phone number is a business risk

Losing the number that receives your bank's or Stripe's codes can lock you out of the business. If you're the only owner, there may be nobody else who can let you back in quickly.

It happens in ordinary ways. A prepaid SIM expires while you're overseas. You stop paying for a home plan you thought you didn't need. A VoIP number gets reclaimed for inactivity. Or someone takes the number from you: Australia's regulator, the ACMA, explains that telcos must use two or more proofs of identity before a high-risk transaction such as moving a number or a SIM swap, precisely because a stolen number lets a criminal receive your SMS codes.

The cost isn't the phone bill. It's days without access to payouts, payroll or your domain while a support team verifies who you are. Stripe says an owner's account recovery request may take up to a couple of business days to decide. That's the best case, when you can still prove your identity.

Why SMS is the weak link

SMS is the weakest common second factor, and the standards bodies say so. NIST's final SP 800-63B-4 says use of the public phone network for out-of-band verification "is restricted", and names it as the only restricted authenticator. Providers that use it must give users meaningful notice of the risks, offer at least one alternative that isn't restricted, and plan for the day it's no longer acceptable. NIST also says verifiers should consider risk signals such as device swap, SIM change and number porting before sending a code.

Stripe is blunter. Its two-step authentication page lists methods from most to least secure: passkeys, security keys, Touch ID or Windows Hello, authenticator apps, then text messages last. It says text messages "are unencrypted, require cell reception to use, and are vulnerable to SIM swap and SS7 attacks", and recommends enabling two or more methods and avoiding SMS.

Living abroad adds one more failure mode. Google's 2-Step Verification help says that if it notices something different about how you sign in, like your location, you might not be able to get a code by text message, and that delivery varies by location and provider. So SMS can fail exactly when you've just landed somewhere new.

Option 1: keep the number on a plan that works abroad

The simplest way to keep a number is to keep it on its own mobile plan and make sure that plan still receives texts overseas. Receiving texts is often cheap or free; it's data and calls that cost money.

Google Fi (US). Google's Fi help page says the Flexible and Unlimited Premium plans support travel in over 200 destinations, Unlimited Standard includes Canada and Mexico, and Unlimited Essentials doesn't work outside the US. You must activate and use the service in the US for at least one day before using it abroad. The catch for people who live overseas: an extended period outside the US, typically 50 days, triggers a warning, and international data is suspended 30 days after that email. Fi says you can still call and text after data is suspended, which is what matters for codes.

Mint Mobile (US). Mint's travel help page says receiving SMS text messages while travelling is free of charge; replying needs a Minternational Pass. The passes cost US$5 for 1 day (60 minutes, 60 texts, 1GB), US$10 for 3 days, US$20 for 10 days, and US$5 for a 30-day pass with 100 minutes, 100 texts and no data (checked 26 Oct 2026). The plan must have been activated in the US, the passes work in over 180 countries, and a bought pass expires 360 days after purchase.

Telstra (Australia). Telstra's international roaming page says its International Roaming Day Pass covers over 80 destinations and that "Receiving an SMS will not trigger your Day Pass." Watch the fine print, though: Day Pass charges apply on any day you make or receive calls, send an SMS or use data, including background data. If you turn the Day Pass off, pay-as-you-go rates apply, listed as $3 per MB of data and 75c per SMS (Australian dollars, checked 26 Oct 2026).

The practical setup with any of these: keep the home line installed as a second SIM or eSIM, turn data roaming off for that line so background data can't run up charges, and use a local SIM or travel eSIM for data. Check each carrier's own terms on how long you can stay abroad before the plan or its roaming features are restricted, as Fi's 50-day warning shows.

Option 2: port the number to a VoIP service

Porting moves your number to an internet phone service, so you can receive texts on Wi-Fi anywhere without a mobile plan. The trade-off is that some services won't send codes to VoIP numbers, and the number can be reclaimed if you don't use it.

Google Voice. Google's porting page says Google Voice charges a US$20 fee to port in a mobile number (checked 26 Oct 2026), and not all mobile numbers can be ported. You'll need the account number and PIN from your current provider. Once the port finishes, your provider cancels the phone service. The number can take up to 48 hours to move and texts up to 3 business days. US-based users can only port active US mobile numbers and must make and update port requests in the US, and accounts managed by a work or school can't port a mobile number in.

Google Voice also reclaims numbers that have no activity. You'll get a warning with a reclaim date; making a call, sending a text from the number or listening to voicemail before then keeps it. After the reclaim date you have 45 days to get it back. Put a recurring reminder in your calendar to send one text a month.

The bigger issue is using Voice for verification codes. Google's own 2-Step Verification help warns: "If you use Google Voice to get verification codes, you could lock yourself out of your account." If you sign out of the Voice app, the code you need to sign back in goes to the Voice number you can't reach. Never make your Google account's only second factor a Google Voice number.

Before you port anything, do it from home. Carriers increasingly require you to be on their network to release a number. T-Mobile's transfer page says only the Primary Account Holder can generate a Temporary Port Out PIN, and you need to be on the T-Mobile network using your own phone with Wi-Fi switched off. In Australia, the ACMA says telcos must do an additional identity check before a mobile port, such as sending a code by SMS, calling your number or asking for ID documents, and some telcos may charge A$8 to port a mobile number. If your SIM has already lapsed abroad, each of those steps gets harder.

Option 3: eSIMs, and what they don't do

An eSIM is a way to install a plan, not a way to keep a number. Most travel eSIMs give you data only. Airalo's help page says "Data Only" plans don't include calls and texts, and that local packages with calls and texts are strictly for local communication within the country of coverage.

Where eSIMs help is letting you carry your home number and a local data plan on one phone. Convert your home SIM to an eSIM with your carrier before you leave, add a travel eSIM for data, and keep the home line set to receive calls and texts. That's option 1 with less plastic.

The three options side by side

Which services accept VoIP numbers

Only trust what a service's own help page says, and most say nothing. Here's what we could confirm on 26 October 2026:

• Login.gov (the US government sign-in service) says its phone verification doesn't accept "Google Voice or similar VoIP" numbers, most prepaid numbers or international numbers, and the number must be based in the United States.
• Google doesn't ban Google Voice for 2-Step Verification, but its help page warns that it can lock you out, as quoted above.
• Mercury requires two-factor authentication, and none of the methods on its 2FA page is a text message: it lists an authenticator app, a security key or a passkey (recommended). Supported apps include the Mercury app, Google Authenticator, 1Password and LastPass.
• Stripe's two-step page doesn't mention VoIP or virtual numbers either way. It ranks SMS last and recommends better methods.

Services can tell the difference. Twilio's Line Type Intelligence identifies line types including mobile, landline, fixed VoIP and non-fixed VoIP, and gives Google Voice as an example of a non-fixed VoIP number "obtained online without requiring a physical device". So a VoIP number that works today can be refused later without warning. Treat it as a backup, never the only route into a bank.

Move to authenticator apps and passkeys

An authenticator app or a passkey removes the phone number from the problem. Neither needs a SIM, roaming or a local network.

Authenticator apps generate short-lived codes on the phone itself; Mercury's 2FA page describes them as 6-digit codes that refresh every 30 seconds. Google says Google Authenticator can still generate codes without an internet connection or mobile service, and that signing in to your Google Account in the app syncs your codes across devices. Without sync, you move codes to a new phone by exporting a QR code from the old one. Turn sync or another backup on before you travel, or a lost phone means resetting every account.

Passkeys replace the password and the code. The FIDO Alliance describes a passkey as a credential based on FIDO standards that you use with the same method you use to unlock your device, and says phishing resistance is a core design goal. Its 2024 commissioned survey found 53% of people had enabled passkeys on at least one account. Google's passkey help says a passkey bypasses the second step of 2-Step Verification, and that you can sign in on a computer by scanning a QR code with your phone, with Bluetooth on.

For business accounts, follow the provider's own ranking. Stripe puts passkeys and security keys first. Mercury recommends passkeys and says, in its reset guide, to set up additional methods to avoid getting locked out.

Backup codes and a second admin

Backup codes are your way back in when every device is gone. Google issues backup codes in sets of 10; each works once, and creating a new set makes the old one inactive. Google suggests keeping a printed copy where you keep your passport or other important documents. Stripe tells you to store your backup code safely; entering it removes two-step authentication so you can set it up again.

A second admin turns a multi-day recovery into a quick approval. Mercury's reset guide says that if there's another admin on the account, they're asked to approve your reset; if there isn't, you submit a video showing your ID and reading a script, then wait for Mercury's team. The approval link expires after 14 days. Stripe works the same way for team members: an account administrator can reset their two-step authentication. A co-founder, operations lead or trusted adviser with admin rights is cheap insurance. If you're setting up accounts for the first time, our guide to business accounts for remote founders covers which providers fit founders who live abroad.

Setup checklist for founders

Do this before you leave, not from an airport.

1. Inventory every account that can lock you out. Bank and business account, payment processor (Stripe, PayPal or your merchant of record), domain registrar and DNS, email, cloud hosting, code hosting, app stores, accounting and payroll. For each, write down the current second factor and the phone number on file.
2. Switch each one to a passkey or authenticator app where it's offered, and add at least two methods, as Stripe recommends. Remove SMS as a fallback where the service allows it.
3. Decide where your one SMS number lives. Either a home plan that receives texts abroad, or a VoIP port done from inside the country. Do any port while you can still use the home network.
4. Lock the number. Set a carrier account PIN and turn on port-out protection where your carrier offers it. T-Mobile's transfer page says its Port Out Protection is free for postpaid, business, prepaid and Metro customers, and only the Primary Account Holder can remove it.
5. Download and store backup codes offline. Print them, keep one copy with your passport and one somewhere safe at home or with a trusted person.
6. Add a second admin to the bank, payment processor, registrar and cloud account, so one lost phone isn't a company-wide outage.
7. Back up your authenticator. Turn on sync or a cloud backup, and check it works on a second device.
8. Test before you travel. Sign out of each critical account and sign back in using only the method you'll have abroad. Turn your home SIM's data off and confirm an SMS still arrives.
9. Set reminders. A monthly text from any VoIP number, a check that the roaming plan is paid, and a yearly review of who holds admin rights.

If your team works across several time zones, agree who can approve a reset at any hour; our guide to running a team across time zones covers handoffs like this.

Common mistakes

• Letting a prepaid SIM lapse. The number that receives your bank's codes is the one asset you can't easily replace from overseas.
• Making Google Voice your Google account's only second factor. Google warns this can lock you out.
• Porting after you've left. Carriers may require you to be on their network, or to receive an SMS on the old number, to approve the move.
• Assuming a travel eSIM has a number. Data-only plans don't include calls or texts.
• Leaving data roaming on for your home line. On Telstra, background data counts as use and triggers a Day Pass charge for that day.
• Keeping backup codes only on the phone you might lose. Put them on paper or in a separate, secure place.
• Being the only admin. Without a second admin, recovery means an identity review on the provider's timeline.
• Never testing. The first time you need a code abroad is a bad time to find out SMS doesn't arrive.

Making it stick

This is a one-afternoon job that saves you a week of locked accounts. Do the inventory, move what you can to passkeys and apps, keep one number alive for the stragglers, and test it before you go. If you'd like to compare setups with other founders who build companies remotely, request an invite to Remote Builders.