Many websites and apps rely on a weak form of two-factor authentication (2FA) that involves texting you a short number or code. These sites and apps might also offer to make an automated voice call that reads the code aloud. If you’re outside your home country or region and have an expensive fee per message to receive SMSes or per minute for voice calls or cannot receive them at all, you need an alternative.
Set up an app-based second factor in Passwords or elsewhere
Your best option is to upgrade account security for the service that currently sends you an SMS for verification. Look for a way to add two-factor authentication that might be labeled as specifically as “use Google Authenticator” (you can use other apps or Apple’s Passwords app), shown as a QR code, or require navigating through security > two-factor authentication or other menus.
If this isn’t an option, skip ahead.
At Google, for instance, you go to myaccount.google.com, click Security > 2-Step Verification; you may be prompted to authenticate. In this section, you can add a passkey (supported by Apple and managed in Passwords), which is a single-step login that combines two security factors, a hardware security key that you would need to carry with you, or Authenticator, which is a time-based one-time password (TOTP) system. You can have all three and more enabled for Google.
Passkeys are the easiest, as they replace a login and require no additional factors. The most common option, however, is the Authenticator/TOTP approach. A TOTP requires a secret shared by the account site and you. The secret allows the synchronized generation of a short code. When you’re prompted for the code, your authentication app calculates one based on the current time, and, when you enter it, the account site can confirm it by running the same algorithm locally.
Apple managed this process extremely well once it started to support TOTPs, which it calls “verification codes.” On an account enrollment page displaying a TOTP enrollment QR code, you can Control/right-click the code in macOS or touch and hold on a Code in iOS/iPadOS and choose Set Up Verification Code (or similar language). This adds the secret to Passwords for that site.
If that set of steps doesn’t work correctly, the site should also let you see the raw secret text, a short string of letters and numbers. Copy that text. Open the Passwords app, search for the entry for the website or domain associated with the app that contains your login, click or tap Edit, click or tap Set Up Code, paste the code into the Setup Key field, and click or tap Use Setup Key. Click or tap Save.
When you next try to log into the site or app, Apple automatically generates a password prompt in the authentication code field. You’re prompted for a fingertip, face, or password to fill in the generated code.
Get a Google Voice number for free incoming SMS and North American phone calls
Google still offers free Google Voice accounts for personal use, which provide a legitimate regular telephone number that can place and receive voice calls and send and receive SMS messages. Google doesn’t charge for calls and texts that originate within the United States and you can call and text most numbers in those countries at no cost or low cost.
You may be able to change your SMS-receiving number in the account you want to verify when traveling to a Google Voice number. If you can set up multiple numbers of SMS codes, add a Google Voice number as a secondary one.
It may not work. As Google notes, “Some websites, such as banks or subscription services, won’t send text messages to Google Voice numbers. In those instances, you may need to use your mobile carrier number.” I have found in testing that advice to be mostly outdated but your particular financial or other services may still restrict known ranges of Google Voice numbers.
To make the process of receiving a code from Google Voice even easier, you can go to Settings > Messages at voice.google.com and enable “Forward messages to email.” This sends any incoming text messages to your associated Gmail address. In my case, I have an additional forwarding rule at Gmail that sends the message on to my main mailbox.
In most cases, I receive a code in my inbox within a few seconds and at most a couple of minutes no matter where in the world I am.
This Mac 911 article is in response to a question submitted by Macworld reader Brian.
Ask Mac 911
We’ve compiled a list of the questions we get asked most frequently, along with answers and links to columns: read our super FAQ to see if your question is covered. If not, we’re always looking for new problems to solve! Email yours to mac911@macworld.com, including screen captures as appropriate and whether you want your full name used. Not every question will be answered; we don’t reply to emails, and we cannot provide direct troubleshooting advice.
Author: Glenn Fleishman, Contributor, Macworld
Glenn Fleishman’s most recent books include Take Control of iOS and iPadOS Privacy and Security, Take Control of Calendar and Reminders, and Take Control of Securing Your Mac. In his spare time, he writes about printing and type history. He’s a senior contributor to Macworld, where he writes Mac 911.