Should You Use a Second Phone Number for 2FA?

Use a second phone number for 2FA only when a site offers nothing but text codes, or when a shared or business account needs codes that don’t depend on one person’s phone. Where a site offers an authenticator app, a security key or a passkey, use that instead, because a text code is the weaker option either way.

What you need: for the second-number setup, a spare iPhone on iOS 26 or later with its own SIM or eSIM, the Shortcuts app (it’s already on the phone), and, if the codes need to reach someone else, Fwrd and a place to send them, such as a private Slack channel.

Is a second number safer than your own for 2FA?

A little, in one narrow way: it keeps codes for that account off your personal number and out of your personal Messages. It doesn’t make text codes any stronger. The same weaknesses follow the codes to whatever number gets them.

The US government sources explain the risk:

• The FTC says “Hackers can take over your phone number through a SIM card swap attack,” and that an authenticator app is safer because its code isn’t exposed to that (FTC, read October 18, 2026).
• CISA lists codes sent by SMS or voice as open to SIM swap attacks and to flaws in the phone network’s SS7 signalling, and calls phishing-resistant MFA “the most secure form of MFA” (CISA fact sheet, read October 18, 2026).
• NIST, which writes the federal standard, says “Use of the PSTN for out-of-band verification is restricted” and requires services that follow its guidelines to offer at least one other option (NIST SP 800-63B-4, section 3.1.3.3, read October 18, 2026).
• The FCC adopted rules in November 2023 making carriers check who you are before moving your number to a new SIM or carrier, because SIM swaps and port-out scams take over phone numbers without touching the phone (FCC, read October 18, 2026).

Apple describes passkeys as “resistant to phishing,” and designed so there’s no shared secret to steal (Apple, read October 18, 2026).

When does a second number make sense?

When text codes are the only choice and they shouldn’t sit on your own phone. Common cases:

• A shared work account only sends codes by text, and it has to keep working when the person who set it up is away or leaves.
• A business number should belong to the company, not to one employee’s personal line.
• A backup. Apple suggests that if you have more than one number, you consider adding one “not associated with your iPhone” as an extra trusted number, so a lost or broken iPhone doesn’t lock you out (Apple, read October 18, 2026).

Some services refuse internet numbers from calling apps. Indeed’s help page, for example, says it “no longer allows non-fixed VoIP numbers for account verification” (Indeed, read October 18, 2026). Codes sent to a real mobile number in a spare iPhone arrive like any other text, and Fwrd can pass them on, as long as the line stays active so the number isn’t recycled.

How to get codes off a spare iPhone

The catch with a second phone is that it sits in a drawer. These steps send just the code texts from it to the people who need them.

1. Add a destination in Fwrd. On the spare iPhone, open Fwrd, tap +, and choose where codes should go: a private Slack, Discord, Teams or Telegram chat, your own webhook, an email address, or another phone.
2. Keep only the codes. Set the destination’s filter to texts that look like a verification code. For email or another phone, also put the send action inside an If in the shortcut, then turn on I Added the If in that destination’s Which Texts.
3. Create a Message automation. In Shortcuts on iOS 27, tap Library, then Automation, then +, then Message. On iOS 26, open the Automation tab, tap +, and choose Message.
4. Choose which texts to forward. Choose Message Contains (on iOS 27, change Sender to Message) and type a word your codes contain, such as code. With a code filter on, a single space works too.
5. Make it run without asking, then add Fwrd’s action. On iOS 27, turn off Confirm Before Run and check Allow Running When Locked is on, under ⓘ, then Privacy. On iOS 26, choose Run Immediately. Add Forward Message to All Destinations and set its Message to Shortcut Input (on iOS 26, Shortcut Input, then Message).
6. For email or another phone, add Apple’s action. Below Fwrd’s action, add Send Email or Send Message, set its Message to Forward Message to All Destinations, and add the address or number. The email guide and phone guide show each tap.
7. That’s it. New code texts now go where you chose on their own, with the iPhone unlocked or locked.

The verification codes page covers more ways to route codes, and sharing 2FA codes with your team in Slack walks through the Slack side in full.

What forwarding codes can’t fix

• Forwarding a code widens who can see it. Anyone in the channel, inbox or group can use it while it’s valid. Keep the destination private, small, and limited to accounts you’re allowed to share.
• It doesn’t protect the number. A SIM swap on the spare line still sends codes to whoever took it. Ask the carrier for its account lock or port-out protection.
• The phone has to stay on and online, and after a restart it needs to be unlocked once before forwarding starts again.
• It doesn’t replace a stronger option. If a site adds passkeys or an authenticator app later, switch to it.