Bank of America: OTP and verification codes abroad

A Bank of America one-time code abroad depends on something the bank states plainly: the account's number has to be one it reads as American. The bank publishes that boundary on its Security Center, along with the hardware alternative for accounts with no US number at all.

The sentence, and what it is scoped to

The Security Center page carries a question about using Secured Transfer internationally, and the answer sets out both paths: "if you have a U.S. based mobile number and can receive SMS internationally, you can continue to use Secured Transfer as you travel. However, if a U.S. based mobile number is not available, you may choose to use a USB Security Key. We do not support international phone numbers at this time."

Two things about that sentence need keeping straight, because it is easy to generalize it into a claim the bank did not make.

The first is the subject. This is the answer under Secured Transfer, a specific feature for certain transfers and wires, not a statement covering every code the bank might send. Reading it as "Bank of America will not text you abroad" goes further than the page does, which is why this card names the feature rather than the bank in the sentence above.

The second is what the two halves add up to. A US number that still receives SMS while roaming is enough. The boundary is about how the bank reads the number, not about where the customer is standing.

The code you will meet more often

The same page describes the other code path, the one that arrives without anyone asking for a transfer. Under the heading for one-time authorization codes, the page says "this is always on, so if we need to know it's really you, we'll send you a one-time code by text or email", and adds that your "contact info" should be "current".

Email appearing in that sentence matters for anyone leaving the country, because email delivery does not run through a foreign carrier's short-code handling. The page states the two channels without ranking them; it does not say email is available for every situation in which a code is required.

The key option

The security key appears on the page for one case only: an account with no US mobile number to fall back on. It is a FIDO-certified USB key registered in advance: the page recommends "FIDO® certified keys" and describes plugging it into the computer's USB port as the login step.

Registration, therefore, is a thing to do while the account is still ordinary. A key that was never enrolled cannot help on the day a foreign number fails to receive a message.

Before you leave

• Decide whether the account's number will still be readable as a US number, because that is the line the page draws: a US number that roams works, while a number the bank reads as international sits outside what Secured Transfer supports.
• Enroll the security key early if you want that route to exist at all.
• Check that the contact email on the account is one you will still control abroad, since the page names email as the second channel for one-time authorization codes.
• The other two banks' published positions are on bank OTP abroad, and the failure map is on why OTP SMS fails abroad.

What this page does not answer

The Security Center page we read does not discuss VOIP numbers or app-based approval anywhere. Those cells stay unverified here rather than being filled from forum reports that mention this bank by name.