Why is my two-factor code not arriving by text?
The mundane causes first — signal, the wrong number, a full inbox, a delay — and then the serious one to rule out. Plus why moving off text codes is the permanent fix.
- Difficulty
- beginner
- Time
- 25 min
- Read
- 5 min
- Safety
- warning
Short answer
Check the obvious three first: does the phone have signal, is the number on the account the one you actually use now, and is the message sitting in a blocked or filtered folder? Then request a new code rather than waiting, because an old one may already have expired. If codes have stopped arriving and your phone has also lost service, stop troubleshooting and call your mobile provider — that combination is what a SIM swap looks like.
Codes sent by text are the weakest form of two-factor authentication and by far the most widely used, and they fail for a longer list of reasons than any other method. Some are trivial: no signal, a message caught by filtering, a code that expired while you were reading it. Some are administrative: the account still holds a number you gave up years ago, and the code is arriving somewhere you cannot reach. And one is serious. Because the code goes to a phone number rather than to a device, anyone who can take control of the number receives the codes, and that is a well-established attack. It is worth knowing what it looks like, because the early symptom is exactly this.
Safety
Step by step
- Check signal and request a fresh code.A phone with no bars receives nothing, and codes expire — often within a few minutes. Requesting a new one after confirming signal resolves a large share of cases and costs nothing.
- Check which number the account actually has.Sign in on another device if you can, or use a recovery route, and look at the number on file. An old number from a previous provider, a work phone you no longer have, or a typo entered years ago all produce codes going somewhere you cannot see.
- Look in blocked and filtered messages.Both platforms filter messages from unknown senders into a separate list, and codes come from short numbers that are not in your contacts. On iPhone, check the Unknown Senders filter; on Android, check spam and blocked in the Messages app.
- Wait a little, then try a different method.Code delivery goes through aggregators and can be delayed by minutes at busy times. Most services offer an alternative — a code by voice call, a code to email, or an authenticator app — and the alternative frequently works when the text does not.
- Rule out the account being barred or the mailbox full.An unpaid bill, a bar on premium and short-code messaging, or a phone that has not been used long enough to stay active can all block these specific messages while ordinary texts work. Networks can lift a short-code bar.
- Check whether you are abroad.Codes are frequently not delivered on roaming, and some services will not send to an international number at all. This is a well-known trap when travelling, and the answer is to move to an authenticator app before you go rather than after.
- Treat sudden total failure plus loss of signal as an emergency.If your phone shows no service and codes have stopped, your number may have been transferred to someone else's SIM. Call your mobile provider from another phone immediately, and then secure your email account before anything else — the catalogue's guide on SIM swap attacks covers the sequence.
- Move off text codes permanently.An authenticator app generates codes on the device with no network involved, works abroad and in a basement, and cannot be intercepted by taking over your phone number. A passkey or a hardware key is stronger again. The catalogue's guide on choosing a two-factor method covers the comparison.
Common mistakes
- Requesting the code twenty times — Each request usually invalidates the previous one, so a queue of delayed messages arrives with only the last one working — and some services temporarily lock the account after repeated requests.
- Relying on text codes as the only method — They are the method most exposed to losing the phone, travelling, and SIM swap. Adding an authenticator app and saving recovery codes takes ten minutes and removes almost all of this.
- Ignoring codes you did not request — A code arriving unprompted means someone has your password and is trying to get in. That is the moment to change that password, not to dismiss the message.
If it doesn't work
Codes arrive for one service and not another
Cause: That service's delivery route, or its stored number — Fix: Check the number on that specific account. Different services store different numbers, and one may still have an old one.
Codes arrive but are always rejected as incorrect
Cause: An expired code, or clock drift on an authenticator app — Fix: Codes have short lives. For app-generated codes, a device clock that has drifted breaks them entirely — set the time to automatic and check the app's own time-correction setting.
Nothing arrives while abroad
Cause: Roaming delivery of short-code messages is unreliable — Fix: Use an authenticator app, or set up a backup method before travelling. Retrieving access from abroad without one is genuinely difficult.
Phone has no service and codes stopped at the same time
Cause: Possible SIM swap — Fix: Contact the mobile provider immediately from another phone, then secure your email. Do not spend time on other troubleshooting — this one is time-critical.
The account has a number you no longer have
Cause: Never updated after switching — Fix: Use the service's account recovery process, which usually involves identity checks. Then update the number and add a second method so this cannot recur.
You have lost the phone entirely
Cause: No access to the delivery method — Fix: Recovery codes, if you saved them, are the intended answer. The catalogue's guides on recovering two-factor access and storing recovery codes cover both the recovery and the preparation.
Questions people ask
Why is text-based two-factor considered weak?
Because it authenticates a phone number rather than a device, and phone numbers can be transferred. It also depends on network delivery, which fails abroad and in poor coverage. It is still very much better than no second factor — the criticism is relative, and turning it off is not the answer.
What is a SIM swap, exactly?
Someone persuades your mobile provider to move your number to a SIM they control, usually with information gathered about you beforehand. Your phone loses service and their device starts receiving your calls, texts and codes. Providers have tightened checks considerably and it still happens.
Is an authenticator app safer if I lose my phone?
Both leave you locked out if the phone is gone and you prepared nothing. The difference is that app codes can be backed up or synced across devices, and recovery codes can be saved in advance. Setting up a second device and saving recovery codes is what actually makes either survivable.
Can I use email instead?
Better than nothing, and weaker than an app, because your email is what everything else can be reset through. If your email account is itself protected only by a password, a code to email adds very little. Securing email properly first is the higher-value change.