Shared SMS 2FA: Fix the One-Phone Problem for Teams

Why is shared SMS 2FA a problem for teams?

Shared SMS 2FA is a problem because the account has many users but only one phone number that receives the sign-in code. Shared SMS 2FA means a team account whose second sign-in step sends a one-time code by text message to a single phone.

That phone usually belongs to whoever set the account up. Everyone else depends on that person being awake, reachable and still working for you.

Availability: the holder is on a flight, in a meeting or on holiday, and the team is locked out.
Leakage: codes get pasted into chats where everyone in the thread can read them.
Leavers: when the holder leaves, the account stays tied to their personal number.
SIM swap: if an attacker moves the number to their own SIM, they receive the codes instead.

NIST SP 800-63B treats SMS as a restricted authenticator because of risks like these. CISA also recommends stronger options than SMS where they are available. SMS is still far better than no second factor, so the goal is to manage it well, not remove 2FA.

Can you switch the shared account from SMS to an authenticator app?

Yes, if the site offers an authenticator app (TOTP) option, switching is the best fix for shared SMS 2FA. A TOTP secret can be stored once in a team password manager, so the right people can produce the code without anyone's phone.

Look in the account's security or two-step verification settings for wording like "authenticator app". Many sites list it next to SMS.

Agree with the current code holder on a time to make the change, because you need one SMS code to confirm it.
Choose the authenticator option and copy the setup key or save the QR code.
Store the secret on the shared login in your password manager, not on one person's phone.
Enter the first 6-digit code to confirm, then save the new backup codes.
Remove the old phone number from 2FA if the site allows it, or keep it only as a recovery method.

The full move from SMS to TOTP, including where to keep the secret, is covered in how to share 2FA codes with your team.

What should you do if the site only offers SMS 2FA?

If the site only offers SMS, name one code holder on purpose and write it down. An undocumented holder is how teams end up stuck on a former employee's number.

Pick the holder based on who is reachable during working hours, not who created the account. A company phone or a work SIM is better than a personal number, because it stays with the business when people change roles.

Record who holds the code for each login, and the last few digits of the number.
Name a backup person who can reach the holder or the phone.
Add a second phone number if the site allows one, and record that too.
Check once a quarter that the number on file still works.

Keep this record next to the login itself, so anyone who opens the password knows who to ask.

How does an ask-for-the-code flow work for shared SMS 2FA?

An ask-for-the-code flow is an agreed way for a teammate to request the SMS code and for the holder to send it back privately. It replaces "can someone send me the code" in a team chat.

The teammate enters the password and triggers the SMS on the site.
The teammate sends a request to the named holder through one agreed channel.
The holder checks that the request is expected and comes from the right person.
The holder sends the code back to that teammate only.
The teammate signs in right away, because SMS codes expire within minutes.

Two rules make this safe. Never send a code you did not expect to receive, because an unexpected code can mean someone else has the password. Never read a code aloud to a caller who claims to be a colleague without checking who they are.

What should you do with backup codes for an SMS account?

Save the backup codes the day you set up 2FA and store them in your password manager, attached to the same login. They are your only way in if the phone is lost, broken or gone with a leaver.

Store them encrypted, not in a document, email or screenshot folder.
Limit who can see them to the account owner and one or two admins.
Mark each code as used once you use it, and generate a new set when few are left.
Regenerate them after anyone with access leaves.

Contractors and temporary staff rarely need backup codes. Give them sign-in access only, as described in login-only access for contractors.

Why not share SMS 2FA codes in group chats or through forwarding services?

Group chats and SMS forwarding services spread a sign-in factor to people and companies you did not choose. Both feel convenient and both weaken the reason you turned on 2FA.

A code pasted into a chat sits in the history on every member's devices. Forwarding apps and virtual numbers send every text, including bank and recovery codes, through another service that you now have to trust.

Method	Main risk	Use it?
Post the code in a team group chat	Everyone in the thread, and anyone added later, can see it	No
Forward all texts to an app or email	A third party receives every code on that number	Avoid
Virtual or shared number for 2FA	Some sites reject them, and whoever controls the number controls the account	Only after checking the site and the provider
Holder sends the code privately on request	Depends on the holder being reachable	Yes, with a named backup
Authenticator app secret in a team password manager	Secret must be stored encrypted and access kept tight	Best, where the site allows it

The same reasoning applies to passwords themselves, which is why it is worth learning to share passwords without WhatsApp.

What happens to shared SMS 2FA when the code holder leaves?

When the code holder leaves, move the phone number off their device before their last day. Waiting until after they have gone often means a slow account recovery with the site's support team.

List every login where the leaver holds the SMS code.
With the leaver present, change the 2FA phone to the new holder or switch to an authenticator app.
Change the password on each of those accounts.
Generate new backup codes and store them again.
Update the record of who holds each code.

Fold these steps into your wider employee offboarding password checklist so they are not forgotten.

How does BobWork Vault handle shared SMS 2FA?

BobWork Vault lets each login record who holds its 2FA and lets teammates ask that person for the code inside the vault. It is a free password manager for teams, so this works on the free plan.

Holder on each login: mark the 2FA as SMS, email or app prompt, pick the teammate who holds it and add a hint. A 2FA map shows which logins depend on one person.
Ask for the code: a teammate, including a Login only member, asks the holder from the Chrome extension or web vault. The holder gets an email and a badge or notification, and sends the code back encrypted to that teammate only. It expires in 10 minutes.
Backup codes: store them per login, mark them used and get a warning when few are left. Login only members never receive them.
Authenticator secrets: when a site allows TOTP, store the secret and BobWork Vault fills or copies the 6-digit code after the password.

Everything is encrypted in the browser before it reaches the server. To set up the rest of your shared logins, see how to share passwords with teammates, or create a free BobWork Vault account.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

More: free password manager · free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers

Questions

Is it safe to share SMS 2FA codes with teammates?

Yes, if the holder sends each code privately to one named teammate who asked for it. It is not safe to post codes in group chats or forward every text to a shared service.

Can two people receive the same SMS 2FA code?

Sometimes. Some sites let you add a second phone number, so check the account's security settings. If not, use one named holder and an ask-for-the-code flow.

What happens if the code holder loses their phone?

Sign in with a saved backup code, then move 2FA to a new number or an authenticator app. Without backup codes you will need the site's account recovery process, which can be slow.

Can I use a virtual phone number for shared SMS 2FA?

You can try, but some sites reject virtual numbers and whoever controls the number controls the account. Check the site's rules and the provider's security first, and prefer an authenticator app where the site offers one.

Is SMS 2FA better than no 2FA for a shared account?

Yes. SMS codes stop most attacks that rely on a stolen password alone, so keep SMS 2FA on until you can switch to an authenticator app.