A verification code that never arrives is one of the most common small ways a trip goes wrong. The fix takes an evening and has to happen before you leave.
Why SMS codes fail abroad
An SMS code needs your phone to be reachable on a mobile network under your home number. Travel breaks that in several ways:
- Data-only eSIM. Most travel eSIMs give you internet but cannot receive texts on that profile. Your bank still sends the code to your home number, and if you switched the home SIM off to avoid roaming charges, nobody is listening.
- Local SIM. Your home number is out of the phone entirely.
- Roaming. International SMS is slower and less reliable than domestic SMS because it routes through more networks. Codes expire, you request another, and the account starts to treat you as an attacker.
Use an app for the codes
A time-based code from an authenticator app is computed on the device from a shared secret and the clock. It needs no signal, no SIM and no network. On a plane, in a basement or in airplane mode it still produces the right six digits.
Most people postpone the move because the migration is fiddly. Do the accounts that would ruin a trip first: your bank, your main email (it is the recovery path for everything else), your airline, and the account that holds your documents.
A data-only eSIM such as Saily alongside your home SIM keeps the home number live for SMS while the eSIM carries everything else.
Some password managers hold time-based codes alongside the passwords. That puts the codes on every device you own rather than on one phone, which removes the single-device failure that strands people abroad. It also puts the password and the second factor behind one login.
NordPass is one manager that holds the codes. Its support page says the authenticator “can be used simultaneously on multiple browser extensions and mobile devices”. The extensions are Chromium-based browsers on macOS and Windows and Firefox on Windows, so on a Mac that only runs Safari the codes stay on the phone alone. NordPass’s pages do not say whether a code shows with no connection. Put the phone in airplane mode at home and check before you rely on it. A free authenticator app does the core job either way.
Recovery codes
Every service that offers app-based two-factor also issues one-time recovery codes. They are the only thing that works once the device is gone.
Print them. Keep them away from the phone and out of the bag the phone travels in. A copy with someone you trust completely is sound. A photo of the codes on the phone they are meant to recover is not a backup.
Keep the home number alive
Some services will still only text you, and banks are the frequent offender. It is usually not a setting you control. Keep the home SIM active and reachable alongside a travel eSIM rather than pulling it out, even when all your data runs through the eSIM instead. The home number stops being a data plan and becomes the thing your bank texts.
Passwords and codes in one app
A compromised vault gives up both factors when passwords and codes share one app. That is a real argument for keeping them apart.
NordPass’s own support page says “Do not store TOTP for NordPass inside NordPass Authenticator”. Once you are logged out on every device, the code you need to get back in sits inside the thing you cannot open. For the wider risk, NordPass asks for a biometric check on each code, “Confirm your identity with biometrics to view the two-factor code”. That adds a step on the device without separating the factors, because the vault still holds both. If you keep codes in NordPass, keep the code for NordPass itself in a separate app or on the printed recovery sheet.
Most people do not separate the factors rigorously anyway. They reuse passwords and strand codes on one device. A strong unique password everywhere plus codes that survive losing the phone beats that, even if it is not the theoretical maximum. If you do split them, put the second factor on a device that is not the one holding the vault. Choose deliberately rather than by default.
We have affiliate arrangements with Saily and NordPass and earn a commission if you buy through our links. The setup this page recommends works just as well with a free authenticator app and a printed sheet of recovery codes.
A data connection that survives the SIM swap this article is about Our full write-up. (affiliate link)
NordPass is one manager that holds the codes (affiliate link)