Menu
Expat.com
Search
Magazine
Search

USA SMS 2-Factor Authentication

danfinn

One concern of many USA expats here has been the use by banks and CC card companies of SMS texts for OTP codes when trying to log on to online banking apps and cc's. Since, typically, US cell phone providers would not allow permanent roaming in the Philippines, getting the OTP 2FA codes became a problem, having no access to the USA cell network to receive SMS texts. Some people mention T-Mobile. I think T-Mobile allows roaming here for 6 months before suspending text, voice and data.


I have used the google voice hack and that worked well and still does for my institutions but others have said GV doesn't work for them. For some reason, my OTP texts make it to google voice even though it is VOIP which is a format said to be blocked by most banks. But BV must be doing something to make hteir number look more like a cell network number. Still, I consider it unreliable. It is free and I don't expect it to work forever. Also, it might not work for some banks and CC's.


MagicJack numbers do not work at all for 2FA. Institutions easily discern MJ as not being in a cell network. MJ is totally VOIP. None of my 2FA texts make it to magicJack but it may work using the voice option instead of text, if available.


I suspect banks do not like VOIP numbers because the internet can be easily hacked.


So my banks always insisted on sending the codes to SMS over the cell network. To solve the reliability problem, I installed Google Fi during my last trip to the USA. This is a paid service that must be installed in the USA with defined terms and conditions and guarantees that call, texts and data will work in a certain list of countries as stated, and the Philippines is one of them.


Google Fi does give reliable voice and text service to/from the USA while in the Philippines. It does not suspend text/voice after 6 months like T-mobile although it slows data after 90 days (which is fine with me because I only need text, which is free). It works excellent for text 2FA and also is very nice for making reliable calls to the USA over the cell network at a cost of 20 cents per minute. For calls to banks and other businesses in the USA ii is much better than using MagicJack which is very hit and miss for call quality. Google Fi works.


Google Fi basically solves the USA 2FA OTP code text problem for authorized access to your accounts.


In recent months there have been many reports of "sim card swapping" scams. In those cases, a hacker has your number transferred to the hacker's sim and by receiving your sim SMS texts, he uses the OTP codes to log in so he can wire transfer your money wherever he wants.


This totally wipes out the security of the SMS 2FA text method these banks have been using!


It is possible that banks have become more sensitive to this scam. As I have recently seen more reports of SIM swapping scams, coincidentally I have been getting no requests to send them  the  texted 2FA codes anymore. Have they stopped doing this (hopefully?).


If they are discontinuing this method that will be good news for many reasons. Now it seems, they have taken my fingerprint and made it a passkey for logon in addition to my regular passwords.


If SMS text 2FA goes away, then I can cancel my (reliable but a bit expensive) international google fi cell service.


I have suspected that banks and cc card companies will eventually move away from text and towards phone authenticator apps for 2FA like Google Authenticator of Microsoft Authenticator. That would be highly secure. However, for many elderly expats, they may need to be sort of a geek to get authenticators working. I am not speaking about we internet experts on this thread lol.  Once you do get it established, it is an excellent method for 2FA...until you decide to get a new phone but that us a different subject.


I am wondering if anybody else has similar (or quite possibly, dissimilar) experiences.

See also

Opening a bank account in the PhilippinesMoney transfer options in the PhilippinesAdvertising Agencies in the PhilippinesPublic Relations & Marketing Consultants in the PhilippinesWU TransfersWISE PilipinasUS Immigration/Banking
Enzyte Bob

Two US Banks, Citi & Chase will call or SMS me on my Philippine Cell Phone for authorization. Bank of America has a third option emailing you the code.


It's been some while, but I believe I could not enter my Philippine number online and had to call them.

danfinn

Two US Banks, Citi & Chase will call or SMS me on my Philippine Cell Phone for authorization. Bank of America has a third option emailing you the code.
It's been some while, but I believe I could not enter my Philippine number online and had to call them. - @Enzyte Bob

Calling the bank to have them input a Philippine phone number is a new option I never tried. Their softwares would not let me enter a Philippine number; it had to be USA number format. However, I never did try calling them.


Emailing the codes was never given to me as an option. My bank will not even work with their android app with a Philippines IP address so I get a VPN set for USA. I assumed based on that they wanted only a USA number to text by SMS the code.


Using the https web address on my laptop for online banking does accept a Philippine IP address but still has been subject to 2FA to a USA phone number. Thanks.

Jameelur

What happened when you put in a VOIP number? Did it detect and reject that number out right or you just never got an SMS on it after adding it?

danfinn

What happened when you put in a VOIP number? Did it detect and reject that number out right or you just never got an SMS on it after adding it? - @Jameelur

never got SMS otp code when using magicJack VoIP. still works on google voice VoIP i believe.

Enzyte Bob

Jameelur asked . . . .What happened when you put in a VOIP number? Did it detect and reject that number out right or you just never got an SMS on it after adding it?

*******************************

danfinn replied . . . . never got SMS otp code when using magicJack VoIP. still works on google voice VoIP i believe.

****************************

I use Ooma Telo v.o.i.p. for years starting in the states to replace my landline. I still use it now calling the states with my old US telephone number.


At first I was able to received voice authorization login pass codes, but not sms. Eventually the banks caught on, so never received those phone calls in the future.


My work-a-rounds: I called the problematic banks and two of them change the phone numbers to my Philippine phone number for sms codes.


Bank of America on their website "choose another way" and I opted for email for receiving the code.


For another I call them and through automated their menu I can check my balances & payments due. They recognize my v.o.i.p. number when calling them, but for nothing else.

Bank accounts for expats
Discover the best international banks to manage your money securely.
danfinn

Jameelur asked . . . .What happened when you put in a VOIP number? Did it detect and reject that number out right or you just never got an SMS on it after adding it?
*******************************
danfinn replied . . . .  never got SMS otp code when using magicJack VoIP. still works on google voice VoIP i believe.

****************************
I use Ooma Telo v.o.i.p. for years starting in the states to replace my landline. I still use it now calling the states with my old US telephone number.
At first I was able to received voice authorization login pass codes, but not sms. Eventually the banks caught on, so never received those phone calls in the future.

My work-a-rounds: I called the problematic banks and two of them change the phone numbers to my Philippine phone number for sms codes.

Bank of America on their website "choose another way" and I opted for email for receiving the code.

For another I call them and through automated their menu I can check my balances & payments due. They recognize my v.o.i.p. number when calling them, but for nothing else. - @Enzyte Bob

Once, earlier this year, I investigated with AI as to why magicjack VOIP didn't work but our 2 Google Voice VOIP numbers did work. It came back with a reasonable response; the banking algorithms supposedly considered Google voice to be very secure because of the good security Google has to stop hackers from breaking in to your account. Magicjack on the other hand was not considered to be very secure. But AI being AI, sometimes it gives you BS answers. On our last trip to the states I installed a Google Fi esim which is not voip and runs off the cell networks and problem solved for all SMS. I was concerned Google voice might stop working at any time but both numbers still seem to be working today. The strange thing is that one of my GV numbers was based on my my magicjack number, which was originally based on my ooma landline voip in 2016, which was based on our southern bell number. My wife's GV was based on a t-mobile.prepaid cell number purchased for the trip in 2024. But for reliability, the Google Fi is what we use today so SMS OTP is not a problem. I like Bob's idea of contacting them to use a Philippine number but I am wary of so directly informing my credit union that we are overseas; recently they updated their mobile and web apps to reject a foreign IP addresses. Right now, we can still access it using a VPN if the server is located in the same state as the CU. However, that is not reliable. We may need to change credit unions to one that is more expat friendly in the future and they do exist and want your business, like Alliant. When I couldn't access my current CU their IT dept. told me to use a VPN which I did but which may even violate their TOS. But it works, for now. Still, I set up auto pay for all monthly deductions and alerts for transactions and balances by email plus telephone banking for transfers and I can essentially go retro-digital and not need the app. However, I don't like their becoming expat unfriendly and I may ditch them in the near future.