Two-factor authentication on a trip: how not to lock yourself out

Why SMS codes fail more often away from home

Google's help pages are frank about it. If Google notices something different about how you sign in, like your location, you might not be able to get a verification code through text message, and delivery speed and availability vary by location and service provider. A trip changes several of those signals at once: a new country, a new network, sometimes a new laptop in a hotel business centre.

That is why Google recommends its sign-in prompts over SMS codes, and why the useful question before a trip is not whether your account has two-factor authentication, but which second steps it accepts. If the only one is a text to your number, one bad roaming connection or a lost phone is enough to keep you out of your email, which in turn holds the reset links for everything else.

Google: prompts, Authenticator and backup codes

Google prompts are a notification on a phone signed in to your account that you tap to confirm a sign-in. They need that phone to be online, over Wi-Fi or mobile data, which a travel eSIM covers. Google Authenticator is the fallback for when you have no connection at all: Google states it can generate codes without an internet connection or mobile service. Set it up at least a week before leaving, because Google says it can take up to 7 days to show up as an available sign-in option.

Backup codes are the last resort. Google gives you a set of 10, each works once, and creating a new set cancels the old one. Google suggests printing them and keeping them somewhere safe, like where you keep your passport. On a trip, that means a copy in your luggage, not in the phone you might lose.

Apple Account: trusted devices first

With an Apple Account, the six-digit code appears automatically on your other trusted devices, such as an iPad or a Mac signed in to the same account. A text or call to your trusted phone number is the backup when no trusted device is at hand. Apple also lets you add more than one trusted number, which is worth doing before a trip: a partner's number or a second line gives you another way in.

One detail confuses travellers. The sign-in notification can show a map of where the attempt comes from, and Apple explains that this is based on the IP address of the new device, so it may reflect the network rather than your real location. If you are the one signing in from a hotel, you can still tap Allow. If you are cut off from both your devices and your numbers, Apple says account recovery can take a few days or longer.

Ten minutes before you leave

• List the accounts that matter on the trip: email, bank, airline, accommodation, cloud storage.
• For each one, check which second steps are enabled and add an app or a prompt where only SMS is set up.
• Install an authenticator app and add your accounts to it.
• Print or write down backup codes and pack them away from the phone.
• Add a second trusted number or a backup phone to your Google and Apple accounts.

Do this at home, where an SMS confirmation still reaches you without any trouble and you have time to fix what fails.

Where a data eSIM fits

A data-only travel eSIM does not receive SMS codes, because it has no number. It keeps the phone online, though, and that is what prompts and app approvals need. Your usual line stays installed alongside it for anything that still insists on a text message; our dual SIM guide explains how to keep that line ready without paying for its data.

If the phone goes missing, Google recommends signing out of it and changing your password from another device, then getting back in with another signed-in phone, a second number, a backup code, a security key or a passkey on another device. Every one of those options has to exist before the phone disappears, which is the whole point of preparing them at home.