Two-Factor Authentication Without a Phone Number

Why SMS Is the Weakest Second Factor

SMS codes travel over the carrier network, which was never designed as an authentication channel. SIM swap attacks, where an attacker persuades a carrier to move your number to their SIM, have emptied crypto accounts and hijacked email for a decade. SS7 interception and malware that reads incoming texts are less common but real. NIST stopped recommending SMS as a second factor in 2017, and Google, Microsoft, and most exchanges now steer users toward authenticator apps and passkeys.

There is a second problem that has nothing to do with attackers: SMS 2FA ties account access to a phone number you must keep. Change carrier, lose the phone, move country, or let a temp number expire, and the code goes to a number you cannot read. Platforms have recovery flows for this, but they are slow and sometimes fail.

The alternatives below remove both problems. They generate the second factor on a device or key you control, with no carrier in the loop and no number to keep alive.

TOTP Authenticator Apps

Time-based one-time passwords are the standard replacement for SMS. The platform shows a QR code containing a secret; the app stores the secret and generates a 6-digit code every 30 seconds from it and the current time. The platform computes the same code and compares. Nothing is transmitted at login except the code you type, and the secret never leaves your device.

Google Authenticator, Microsoft Authenticator, Authy, Aegis (Android), Raivo and 2FAS (iOS), and the built-in generators in Bitwarden, 1Password, and Apple Passwords all implement the same RFC 6238 standard, so any of them works with any platform that offers authenticator app 2FA. Pick one that backs up the secrets encrypted, or export them, because losing the app without a backup is the same as losing the phone number.

Setup takes a minute per account: open the platform's security settings, choose Authenticator app, scan the QR code, enter the code the app shows to confirm, and save the backup codes the platform offers. From then on the platform accepts the app code in place of SMS.

Hardware Keys and Passkeys

A hardware security key such as a YubiKey 5, a Google Titan key, or a Feitian key uses the FIDO2 and WebAuthn standards. At login the platform sends a challenge, the key signs it with a private key that never leaves the hardware, and the browser returns the signature. Phishing sites cannot capture it because the signature is bound to the real domain. Google, Microsoft, Coinbase, Binance, Twitter/X, Discord, and GitHub all support keys.

Passkeys are the same standard implemented in software, stored in iCloud Keychain, Google Password Manager, or a password manager and released by the device's biometrics or PIN. They are phishing-resistant like a hardware key and sync across your devices. Google and Microsoft accounts can be set to passkey-only login with no phone, no password, and no SMS.

Register two keys or a key plus a passkey, and keep one somewhere safe. A single hardware key with no backup is a lockout risk of its own.

Backup Codes

Every platform that offers an authenticator app also issues backup codes: typically 8 or 10 single-use codes that work in place of the second factor. They exist for the day the phone is lost or the key is left at home. Print them or store them in a password manager, and regenerate them after using any.

Backup codes are not a primary method. They are the last line before a recovery request, and a recovery request on an account with no phone and no reachable email can take weeks. Treat the codes as the thing that makes going phone-less safe rather than as a convenience.

Where SMS Is Still the Only Option

Some services have not moved on. Retail banks in many countries, particularly in the UK, Germany, and Australia, use SMS or a proprietary app tied to a registered mobile number and offer no TOTP alternative. Card issuers use SMS for 3-D Secure purchase confirmations. Some marketplaces, including parts of eBay and Amazon's seller flows, insist on a reachable phone for payout changes. Government portals in several countries require an identity-linked number.

For these, a temp number is not a fit beyond the initial signup, and in the case of banks it is not a fit at all. The number has to be one you will hold for years, on a carrier account in your own name. TempNumber.me states this directly on /pricing and in the guide at /blog/how-long-do-temp-numbers-last: verification numbers are for receiving signup codes, not for ongoing 2FA on accounts that hold money.

The practical split is: platforms that let you remove the phone after adding an authenticator are candidates for the temp-number-then-TOTP approach; platforms that require a permanent phone are not.

Temp Numbers as the Signup-Only Step

Google, Discord, Twitter/X, Coinbase, and Binance all require a phone code at some point during registration, before you can reach the security settings where TOTP lives. That is the one step where a temp number belongs. Select the service and a mobile-range country on TempNumber.me, receive the code, and finish registration.

Then, in the same session, go to the security settings and set up an authenticator app, a hardware key, or a passkey. Confirm it works by logging out and back in with the new method. Save the backup codes. Finally, remove the phone from the account or, if the platform will not allow removal, replace it with a persistent number you own. All of this must finish before the TempNumber.me activation or rental ends; a rental gives you days to do it rather than minutes.

This differs from a public shared inbox in one important way: the number you verified with is private to you for the duration, so nobody else can pull a recovery code from it while you are still setting up the authenticator.

Checklist: Services That Let You Remove the Phone

Each entry below confirms that the platform lets you remove the phone number entirely once an authenticator or key is set, and where to find the setting.

• Google: myaccount.google.com, Security, 2-Step Verification. Add Authenticator or a passkey, save backup codes, then remove the phone under Voice or text message. Also remove the number from Recovery phone. Google keeps a recovery email as the remaining fallback.
• Microsoft: account.microsoft.com, Security, Advanced security options. Add Microsoft Authenticator, then remove the phone from Ways to prove who you are. A recovery email must remain.
• Discord: User Settings, My Account. Enable Authenticator App, download backup codes, then click Remove next to Phone Number. Discord requires the authenticator to be active first.
• Twitter/X: Settings, Security and account access, Security, Two-factor authentication. Enable Authentication app or Security key, then go to Account information, Phone, and Delete phone number.
• Coinbase: Settings, Security. Add Authenticator app or a Security key, set it as the preferred method, then remove the phone under Phone numbers. Coinbase may hold withdrawals for 48 hours after a security change.
• Binance: Security, Authenticator App and Passkeys. Enable Binance Authenticator or Google Authenticator, then under Phone Number choose Remove. Binance imposes a 24-hour withdrawal lock after removing a verification method.
• Telegram, WhatsApp, Signal: not on this list. The phone number is the account identity and cannot be removed; only changed to another number.

Never Leave SMS 2FA on a Temp Number

An account with SMS 2FA pointing at an expired temp number has no working second factor. Every login from a new device, every password change, and every recovery flow will send a code to a number that has returned to the pool and may belong to someone else. You are locked out, and the next holder of the number receives your codes. That is the worst outcome on both counts.

The fix is procedural. Verify with the temp number, add TOTP or a key immediately, save backup codes, remove the phone, and confirm the removal before the number expires. If you get interrupted, extend the rental rather than gambling on finishing later. And for accounts where the phone cannot be removed, replace it with a persistent number while the temp number can still receive the confirmation code.