2FA while traveling: keep bank SMS and logins working abroad

The classic failure looks like this: you land, install a travel eSIM, and switch the physical SIM off or leave it at home. A week later your bank asks for a login code — and sends it to a number that no longer receives anything. Nothing is broken on the bank’s side, nothing is broken on yours; the message simply has nowhere to arrive.

Even with the home SIM in the phone, delivery is not guaranteed. If roaming is disabled on your plan, texts stop at the border. International SMS travels through carrier interconnects that can silently drop or delay one-time codes, and some senders restrict delivery to foreign networks outright. You see nothing: the bank reports the code as sent, and your phone stays quiet.

The workarounds people reach for first often fail too. Many banks refuse VoIP and virtual numbers for verification because they are easy to obtain fraudulently, so forwarding your number to an internet service may kill the channel entirely. And changing your registered number mid-trip usually requires — you guessed it — a code sent to the old number, or a branch visit.

The most reliable pattern uses both SIM slots for different jobs. Your home number stays in slot one — physical SIM or eSIM — with roaming enabled and mobile data switched off for it. Its only job is receiving texts and the occasional bank call. In most destinations, receiving SMS while roaming costs nothing; it’s outgoing calls and data that generate the scary bills.

The travel eSIM goes in the second slot and is set as the default for data. That split gives you cheap local-rate internet for everything — banking apps, authenticators, messengers — while the home number quietly keeps its lifeline role. Check two things with your home carrier before departure: that roaming is actually enabled for your plan, and what the plan charges for receiving texts in your destinations.

If your home number is prepaid, check its expiry rules. Many prepaid SIMs are deactivated after a period without top-ups or activity — often somewhere between three and twelve months — and a recycled number is a security problem, not just an inconvenience: whoever gets it next can receive your codes. Set a recurring reminder to top up or trigger some activity.

SMS is the weakest 2FA channel even at home — abroad it is also the least reliable. Wherever a bank offers an alternative, take it. The usual upgrade path: in-app push confirmation first, an authenticator app second, and passkeys where they exist. All three work over any internet connection and do not care which SIM, number or country you are on.

Push confirmation inside the banking app is the easiest win: the bank sends the challenge to the app itself, you approve with a fingerprint or your face, done. Authenticator apps (TOTP) generate six-digit codes offline from a stored secret, so they work even with no connection at all. Enable them in each account’s security settings and store the backup codes the service shows you at setup.

The important choice with authenticators is cloud-synced versus device-bound. Cloud sync (as in many mainstream apps) means losing your phone does not lose your codes — but anyone who compromises that cloud account inherits them. Device-bound is stronger against remote attacks and worse against theft or loss. For travel, sync plus a strong, passkey-protected cloud account is the pragmatic middle; whichever you choose, export or record the recovery material before you fly.

Passkeys are becoming the default for email and platform accounts and are appearing at banks. They are phishing-resistant, need no code at all and sync through your platform account. Where a money account offers a passkey, adding one costs nothing and gives you a channel that no SIM problem can touch.

A hardware security key is a small USB-C or NFC device that answers login challenges physically. You do not need one for every account — but for the two or three accounts that guard everything else, it is the strongest option there is. For most nomads that means your primary email (the recovery hub for everything) and, if you hold crypto, your exchange accounts.

The travel rule with hardware keys: never carry one, carry two. Register both keys on every account that supports them, keep one on your keychain or in your daypack and the second in different luggage or at your accommodation. A single key that disappears with a stolen bag turns the strongest 2FA into the hardest lockout.

Practicalities matter: pick keys that speak both USB-C and NFC so they work with your laptop and your phone, and check that the specific services you care about accept them — support among banks is still rare, while email providers and major exchanges support them widely.

Login codes are only half the problem. Online card payments increasingly require the issuer to confirm it is really you — in the EEA and UK this is mandated by SCA rules, and elsewhere 3-D Secure has become standard for many merchants. When you pay, the checkout hands over to your bank for a confirmation. If that confirmation is a code texted to a dead number, the payment fails.

The symptom is confusing: the physical card works fine in shops and ATMs, but online checkouts — flights, hotels, visa portals — decline with a vague error. Issuers differ in how they confirm: some push a notification into their app, some show a prompt with biometrics, and some are still SMS-only with no alternative. You want to know which type your card is before you travel, not during a hotel booking.

Two mitigations work in most cases. First, open your banking app’s security or 3-D Secure settings and switch confirmation to in-app wherever offered — one tap now saves a failed checkout later. Second, wallet payments through Apple Pay or Google Pay often authenticate with the device itself, sidestepping the SMS round-trip entirely for merchants that accept them.

Every channel you rely on can die: phones fall in the sea, apps get corrupted, numbers expire. The recovery layer is what turns that from a trip-ending event into an evening of admin. Its first component is backup codes — the one-time codes each service offers when you enable 2FA. Store them twice: printed on paper packed away from your phone, and in your password manager.

The second component is a second trusted device. An old phone or a tablet left in your room, with your authenticator restored and your banking apps logged in, means losing the main phone takes nothing else down with it. Keep it updated and charge it occasionally; a dead backup is a decoration.

The third is recovery email hygiene. Your accounts’ password resets flow through one or two mailboxes; if those mailboxes are themselves protected only by SMS to your home number, the entire structure hangs on the channel most likely to fail. Give your recovery email the strongest 2FA you own — a passkey or a hardware key — and make sure its own recovery options do not point back to the same phone number.

Banks do not advertise their 2FA design, but they cluster into recognisable patterns. App-first banks and fintechs generally confirm everything with push and barely use SMS. Traditional retail banks often mix an app for logins with SMS for payments. A shrinking group is SMS-only for everything — and those are the accounts that break hardest abroad.

You usually cannot change a bank’s channel — but you can choose which accounts you lean on while traveling. Run the table below against each of your accounts, and treat any money you cannot reach without an SMS as conditionally accessible until you have tested delivery from abroad or moved the account to a better channel.

The audit takes under an hour and removes the whole category of surprise. List every account that touches money: banks, brokers, payment apps, exchanges, the email addresses behind them, and your password manager itself. For each one, write down how it confirms logins and payments today — the honest answer, not the one you assume.

Then run the decisive test: put your phone on Wi-Fi with the home SIM removed or disabled, and try logging into each account and making a small online card payment. Whatever fails in your living room will fail in an airport at midnight. Fix the failures while fixing is easy — some changes, like registering a new 2FA method or changing a phone number, themselves require confirmation through the old channel or a branch visit, which you can only do at home.