Using your US phone in Portugal for 2FA

How to use your American phone for two factor authentication

For most people, their mobile phone is the center of their online digital life. Be it an Android phone or an iPhone, these devices help us stay in touch with friends and family, act as our digital banks, and are a mini photo and video studio that fits in a pocket. We need even more from our phones when we move to a new country, as our phone keeps us connected in our new and old homes.

Fortunately, once you understand some basic technical features of your phone, you can come up with a good plan to have one phone take care of all your needs in Portugal and the US.

Dual-SIM, eSIM and other technical matters

To better understand your options, you will need to first understand some basic technical concepts. The key bit of technology at play here is the SIM, or Subscriber Identification Module. The SIM is a small device that securely stores unique identification information used to authenticate your phone to your account with your provider.

When you sign up for cellphone service with, say, T-Mobile, T-Mobile provides you with a SIM card that ties your phone to your account. Frequent travelers will often sign up for a mobile phone account when out of the country, and get a new SIM. After swapping the SIM card, their phone will be tied to the mobile provider in that country, and have a local phone number, and local mobile internet access.

This works fairly well if you don’t travel frequently, but what if you need access to two mobile phone numbers and accounts at the same time? For the longest time, that meant two phones, maybe one for work and one for personal use. But, paying for, managing and carrying two phones isn’t great. Fortunately, we have access to dual-SIM phones. By supporting two SIMs, these phones let us connect one phone to two mobile networks at the same time. Two different accounts, two different phone numbers, and most importantly for us, phone numbers in two different countries.

The eSIM

The final bit of technology to address is the eSIM, or Embedded SIM. With an eSIM, the electronics needed to store the unique identification data for your account is embedded directly on your phone. Since setting up an eSIM on your phone doesn’t require swapping out a physical card, this can be done remotely by the user (that’s you) scanning in a QR code or typing in an activation code. That can be a massive benefit when the nearest T-Mobile or AT&T store is 3,500 miles away.

Depending on how you purchased your phone, you may need to deal with a "SIM lock". A locked phone will only work with SIMs from a specific service provider. For example, if you purchased your phone in an installment payment plan from AT&T, your phone is “locked” to the AT&T network and will not work with any other provider. Usually, once you have satisfied your initial contract, your phone has been paid off and your account is in good standing, the provider will unlock the phone, allowing you to install a SIM from a different provider. Some US providers are easier to work with in this regard than others, though.

Ultimately, your goal is to have a phone that supports eSIM, is dual-SIM capable, and is not locked to your current provider. Fortunately, most iPhone and Android phones sold in the USA over the three or four years support both eSIM and are dual-SIM capable. Finally, confirm that your iPhone or Android phone are not carrier locked.

Coming up with a strategy

Most people moving to Portugal want to keep their US phone number. Some will even try to get by in Portugal by only using their US phone number. This is a terrible idea. Getting Portuguese phone service and a local phone number is one of the more important things you can do to get settled in and set up your new life in Portugal. You will need a Portuguese phone number for all manners of services, and having access to a local cellular data network will be a huge advantage, too. The good news is that mobile phone service prices in Portugal are typically far less expensive than in the US, so you can often save a lot of money each month.

That is why I recommend the two-phone number strategy. With this strategy, you keep your US phone number, but port it over to a low-cost phone service, then you take advantage of your dual-SIM phone and add a Portuguese cell phone plan. When in Portugal, you set your Portuguese SIM as the primary and your US SIM as the secondary. Most importantly, you will use the Portuguese cell network for all of your data needs when away from Wi-Fi. You will always have the option to choose between your US and Portuguese phone number when placing calls or sending text messages.

The next thing you will need to consider is your intended use for your US phone number. Most people have two main reasons to keep their US phone number:

1. Keeping in contact with friends & family back in the States and making it easy for them to contact you.
2. Receiving two-factor authentication (2FA) codes when logging into banking and other online services.

You should put some thought into each of these reasons, and any others, to make sure you fully understand the extent you require each. I would go as far as to write down all the people you regularly call and text and what type of phone they use (iPhone vs. Android). Finally, write down every login you use that offers some form of 2FA.

Two-factor authentication considerations

Two-factor authentication is a critical means to help secure your online accounts, everyone should be using some form of 2FA. Two-factor authentication involves (wait for it…) two factors:

1. Something you know. In this case, you know your username and password.
2. Something you have. In this case, a device to provide a one-time password (OTP) to prove you have that device in your possession.

For most people, their cellphone satisfies the “something you have” requirement. It is super easy to provide your phone number to receive a one-time password by SMS text message. While this is straightforward, and does improve your online security, it is NOT very secure, though it is better than no 2FA at all. Not only that, SMS is tied to your phone number and when you move out of the country, you have to find some way to maintain the ability to receive those 2FA codes.

Instead of receiving these one-time passwords by SMS, you should instead consider using either a hardware key such as the Yubikey, or a 2FA app such as Authy or 1Password. Not only are these options far more secure than SMS text messages, for someone moving to a different country, they are far more convenient because they are not tied to a US phone number. I strongly recommend moving as many of your accounts as you possibly can to using one of the 2FA apps. By doing so, you will improve your online security and reduce or eliminate your reliance on maintaining the ability to receive codes by SMS when in Portugal. If you have certain accounts that don’t support a hardware key or 2FA app, you are stuck with using your US phone number, so you will need to find a way to keep that available to you in Portugal.

For the US IRS and Social Security websites, definitely sign up for the ID.me login service before you move to Portugal. You will need to sign up for the ID.me service separately for each site, and this involves a video call to verify your identity, so it is pretty invasive. But, once you have this in place, logging into your IRS or Social Security account from Portugal is much easier.

For both Fidelity and Schwab investment websites, you can use the Symantec VIP app for 2FA. While I would have preferred to use 1Password or Authy, this is still a much better option than getting your OTP by phone call or SMS text message. So, if you use either of these online investment services, you will need to call them to set up the Symantec VIP app before you move.

Ways to keep your US phone number active and available

The good news is that there are a few options for maintaining a US phone number in Portugal without having to maintain an expensive US mobile phone plan. The two most popular options are:

1. Port your US phone number to a low-cost mobile virtual network operator (MVNO) such as Mint Mobile, Google Fi, Tello, or Ting Mobile. Get the most basic and affordable plan available, and rely on Wi-Fi calling as the primary means of using this phone number.
2. Port your US phone number to Google Voice other VoIP services, which provides call forwarding and voicemail services, and is internet-based instead of relying on a traditional SIM card and cellular network plan.

Option 1 tends to be pricier, but if you need a reliable way to receive 2FA codes by SMS text, this is your best bet. VoIP services such as Google Voice generally work fine, but there is a list of banks and other online services that either flat-out do not work with Google Voice or can be very unreliable. If all you require is a way to call and message friends and family back in the States, Google Voice and other VoIP services like iPlum are great. But, if you rely on your US phone number for 2FA codes, the cost savings for a VoIP service are probably not worth it, at least in my view. The iPlum Measured plan starts at $5.99 per month, or $71.88 per year, compared to $180 per year for Mint Mobile. If you’re locked out of your US bank account due to just one incident of undelivered 2FA codes, you’ll likely suffer more than $100 in frustration and lost time.

Cost scenarios

In the US, we tend to pay a LOT for our mobile phone service and home internet service when compared to the rest of the world. For example, back in the States, we had T-Mobile phone service and home internet through our local cable TV provider.

We ported our phone numbers over to Mint Mobile, on their least-expensive plan. In Portugal, we have a bundled service package from MEO, but Vodafone and NOS have similar plans. For roughly $70 (€65) per month, MEO provides us with:

• mobile phone service for 2 phones, each with 10 GB of data
• fiber home internet service with 500 Mb/s download speed and no data caps
• 170 channels of TV service
• A land-line with free international calling during certain hours of the day.

So, even with the extra money we spend on the Mint Mobile plan to keep our US phone numbers active, we still enjoy considerable savings each month.

Wrap-up/TL;DR

• You will almost certainly need two phone numbers; one US, one Portuguese.
• Dual-SIM phones and eSIMs make that fairly easy if you have a newer, unlocked phone.
• SMS text messages for 2FA suck, but are better than nothing. Migrate as many online accounts as possible to a 2FA app like 1Password or Authy
  • Sign up for the ID.me login service for your IRS and Social Security accounts while in the US.
  • If you use Schwab or Fidelity, contact them, so you can use the Symantec VIP app for 2FA.
• Google Voice and other VoIP services are fine for texting and calling friends and family, but are not a reliable option for getting 2FA codes from your bank.
• Try to get your friends and family over to using WhatsApp since it works great for iPhone or Android and works great internationally for messaging and calls.

FAQs

Do I really require a Portuguese phone number?

Yes. Getting a local Portuguese mobile phone number is one of the more important things you can do to get settled in here. Otherwise, you’re still basically a tourist. So many services rely on you providing a Portuguese phone number. Plus, Portuguese mobile internet service is fast, reliable and significantly less expensive than what we’re used to paying in the US. Buying an international plan through your US provider will be extortionate, and is only meant for short-term use, and still won’t help you when you need to provide a Portuguese phone number. So yeah… you definitely need a Portuguese phone number if you are serious about moving to Portugal.

Do I need to use a VPN?

Maybe, it all depends on what you are trying to do. I wrote a separate article on VPN options, but when it comes to using your mobile phone in Portugal, I don’t think it is necessary. While I do have a VPN on my iPhone, the only time I’ve used it on my phone was to read an article from my hometown newspaper website the was region-blocked here in Portugal.