2FA While Traveling: Bank SMS, Logins and SIM Swaps

On a compatible unlocked dual-SIM phone, keep the home line on and choose the travel eSIM for mobile data, with automatic data switching off. Turning off data roaming on the home line stops roaming data only; the line still needs the carrier’s roaming service to receive SMS abroad. Apple’s dual-SIM guide lists the combinations each iPhone supports. Ask your carrier whether your plan receives SMS in each destination and what incoming calls cost.

Banks send codes to the number registered on the account, so a travel eSIM number is a separate line. Holafly offers SMS through a virtual number on its Unlimited subscriptions only, with no promise that bank codes arrive (as of 26 Sep 2026). Saily’s base plans are data-only; its optional number requires identity verification, and Saily says one-time-code support depends on the app or bank (as of 7 Sep 2026). On Airalo, voice and SMS depend on the package (as of 26 Sep 2026).

If a code is late, check the home line, the signal and the registered number, and wait before requesting another, since repeated requests can hit limits. Then use the bank’s alternative method or call support.

Passkeys and security keys (FIDO/WebAuthn) are the strongest option. CISA lists them as phishing-resistant because, as NIST explains, the credential is tied to the genuine site’s domain and a fake page cannot use it. A passkey may sync across your devices or stay on one device or hardware key, so check where yours is stored, and register a spare hardware key.

An authenticator app (TOTP) makes codes on the phone with no SIM or signal. The site still needs internet, and a fake page can capture a typed code. If codes fail, set the phone’s clock to update automatically. App approval needs the bank app and data; approve only requests you started, after reading the amount and merchant.

Google Authenticator transfers codes manually only from the old phone, and its sync needs access to your Google Account, so give that account another sign-in method, as Google recommends.

In a SIM swap, a fraudster gets your carrier to move your number to a new SIM or eSIM, or to port it to another carrier, and then receives your bank and email codes. A SIM PIN only locks the physical card. The protections that matter sit in your carrier account: an account PIN, SIM-change protection and port-out protection. T-Mobile, for example, offers SIM Protection and Port Out Protection as separate settings.

Before departure, ask which changes each setting blocks, who can lift it and how to reach support from abroad without the number. Then check password resets: an email account that signs in with an authenticator but resets by SMS still depends on the number. Turn on sign-in and payment alerts and delete email forwarding rules you did not create.

Banks add checks when something looks new: a new phone or reinstalled app, a login from another country, a VPN or proxy, or an outdated app. Travel eSIM data can also be routed through another country, so the bank may see a location you are not in. Note the exact error and whether the app, the website or both fail, and check the provider’s status page.

Then follow the provider’s own steps. Wise’s CAPTCHA help asks you to turn off a VPN or proxy for the check and back on afterwards. Revolut’s UK login help covers the linked phone number, email verification, a selfie check, app updates and outages. Change one thing at a time on your own phone and a trusted connection, and contact support after one clear failure instead of retrying passwords.

Before you go, update the app, confirm the phone number and email on the account, and set a travel notice if the bank offers one. Keep your residence details accurate; if a provider says a service is unavailable where you live or travel, ask its support for the permitted option. Carry a second card and some cash so you can pay while a login is blocked.

3-D Secure, the check on online card payments, sometimes runs silently and sometimes asks for a code or app approval. A payment that went through without a prompt has left your SMS route untested, so test SMS on its own.

Lost signal can be coverage or an outage. Treat it as a possible SIM swap when alerts about password changes, new devices or payments you did not make arrive with it. Call the bank at once if anything looks touched, without waiting for the number to come back. A card freeze stops card payments, so also ask the bank to block transfers and end other sessions.

Never move money to a “safe account” a caller suggests, and never install remote-control apps to fix your number. Once the number is back, review your accounts and recovery settings again.