Why OTP Codes Go Missing When You Switch Devices or Countries
You reinstall an app on a new laptop, the login screen asks for a verification code, and nothing arrives. There is no error and no bounce message. The spinner runs out, the app offers to call you instead, and the call also fails. Most troubleshooting advice at this point tells you to check your signal and wait five minutes. That advice is harmless and usually useless, because the failure already happened somewhere you cannot see — in the routing between the service’s messaging provider and whichever carrier currently holds your number.
These failures look random from the user side. They are not. There is a short list of reasons an SMS one-time password does not land, and once you can recognise which one you are hitting, most of them stop being mysterious.
The pattern matters more if you run more than one account. A personal profile, a work profile, a regional store account, a test account for something you are building — each one wants a number, and most people quietly point all of them at the same SIM. That works until it does not. Keeping a separate virtual phone number for OTP per identity boundary is the low-effort version of the same discipline you already apply to passwords: stop letting one failure take out everything at once.
Table of Contents
Where the code actually dies
Carrier filtering. Application-to-person traffic is registered, rate-limited, and scored. If a sending route looks like bulk traffic, carriers drop messages silently rather than returning an error to the sender. The service you are logging into often has no idea the message never landed. This is why “resend” sometimes works on the third try — you got a different route.
VoIP and landline rejection. A large share of platforms now check the number type before sending anything. If the lookup says VoIP, the request is discarded. Some services say so plainly in their help docs; many just fail quietly. This catches out anyone who assumed a softphone number or a free web-based number would behave like a mobile line. It will not, and no amount of retrying changes that.
Number recycling. Carriers in most markets return deactivated numbers to the pool after a holding period. If you stopped paying for a line last year and left accounts pointed at it, those recovery codes are now going to whoever holds that number today. This is the failure mode people discover at the worst possible moment, usually during a device migration.
Roaming and cross-border routing. International SMS termination is uneven. A code that arrives instantly at home can take four minutes or never arrive when you are on a foreign network, especially where the sender uses a short code. Short codes are frequently domestic-only. If the service uses one, an out-of-country number may simply be unreachable by design. This is also why travel eSIM setups surprise people: the data works perfectly while the SMS path to your original number quietly does not.
The service’s own risk engine. Some platforms will accept your number, take the request, and then decline to send because the account age, IP, or device fingerprint scored badly. You see the same “code sent” screen either way.
Retrying without making it worse
When a code does not arrive, the instinct is to hit resend repeatedly. That is usually the wrong move. Most platforms count resend attempts against a per-number rate limit, and once you trip it you are locked out of that flow for anywhere from fifteen minutes to a full day — on a number that was never the problem.
Two resends spaced a minute apart is a reasonable ceiling. If neither lands, switch method rather than repeating: take the voice call option if the service offers one, or come back later from a different network. If the platform supports an authenticator app or a backup code, that is the moment to set it up, while you still have access. The worst version of this is discovering that SMS was your only route on the day it stops working.
Why free public inboxes make this worse
The obvious shortcut when a code will not arrive is to grab a number from a public receive-SMS page. It is worth being clear about what that actually is: a shared inbox that anyone can read, on numbers that thousands of people have already used. Two things follow.
First, those numbers are burnt. Anti-abuse vendors maintain lists of them, and most consumer platforms have been blocking them for years. You will often get through the number-entry step and then fail at the code step, which wastes more time than it saves.
Second, if a code does arrive, so does everyone else’s. Anyone watching that page sees your verification code and, more importantly, can trigger a password reset on any account still bound to that number later. Using a public inbox for anything you intend to keep is not a shortcut; it is handing over the recovery path.
Organising numbers before you need them
The useful work here is unglamorous and takes about twenty minutes.
Write down which number owns which account. Most people cannot answer this from memory past three or four services. A plain text file listing account, number, and the year you set it up is enough. The value shows up the day a line is cancelled and you need to know what breaks.
Draw one boundary per number. Personal identity on the SIM you actually keep. Work-shared accounts on something the organisation controls. Region-specific or throwaway registrations on a number that is not also your bank’s recovery contact. The point is not secrecy — it is blast radius.
Test the recovery path once, deliberately. Log out of a secondary account on purpose and log back in. If the code does not arrive, you have found the problem on a Tuesday afternoon instead of during an airport transfer.
Handle numbers at offboarding. If a contractor’s personal mobile is the recovery contact for a shared account, that dependency outlives the contract. Rotate it while you still have their cooperation, not after.
What to check before trusting any number source
If you do end up using a provider rather than a physical SIM, the questions that actually predict whether codes arrive are narrow:
Is it a real carrier SIM or a VoIP line? This single distinction determines whether roughly half the platforms out there will talk to it at all. Providers running on genuine operator SIMs pass the number-type lookups that reject VoIP outright.
Does the country coverage match the service’s market? A service that only issues codes through a domestic short code needs a number in that country. Coverage counts in the marketing copy matter less than whether the specific country you need is live.
What happens when a code does not arrive? Delivery is never one hundred percent, and any provider claiming otherwise is worth less trust, not more. Services like SMS-Act publish a success rate rather than a guarantee and return credits when a code fails, which is the honest version of the same promise. What you want is a defined outcome for the failure case, not the absence of one.
Is the number yours for the session, or shared? If other people can see the inbox, you are back to the public-inbox problem with extra steps.
A short checklist
Before you migrate a device or travel: confirm which numbers hold your recovery paths, check that none of them are lines you have stopped paying for, and make sure at least one account you actually care about is not dependent on a number you cannot receive on abroad. Before you register anything new: decide which identity boundary it belongs to, and use a number that matches that boundary rather than whichever one autofills.
None of this is exotic. It is the same reasoning that made people stop reusing passwords, applied to the one identifier that most account recovery still quietly depends on. The difference is that a password you control forever, and a phone number you only rent — from a carrier, from a provider, from whoever holds it next.
