A borrower or user cannot sign in because the 6-digit verification code never arrives by text. Clearing cookies and switching devices does not help.
Check the spam folder first
Most of the time the code is not missing. It is sitting in the phone's SMS spam / unknown-sender folder, which both iOS and Android have. Ask the borrower to look there before anything else.
The reason it is filtered is that the sending number is not a saved contact. Have the borrower save the sending number as a contact, and later codes come through normally.
Since 3.7 codes come from a dedicated verification number, so the sender is consistent and easy to save. A code pasted with spaces around it is now accepted.
Then check these
- The mobile number on the account is correct and is the number the borrower currently has.
- The borrower has waited a full two minutes. Delayed delivery is far more common than non-delivery.
- The number is not a landline or VoIP line that cannot receive SMS.
- A borrower who has not created an account yet has no MFA to fix. They set their own number when they click the invite link.
What can be changed
MFA can be set to optional or switched off at company level, not only per user.
Support can clear a borrower's MFA enrolment so the borrower registers a number again. This is the fix for a borrower who changed phones but kept the same number.
If your organisation turns on one-time passcode, the authorisation code is removed entirely, which also removes the last-4-of-SSN step and the lockouts that follow it. See article 48, borrower cannot find where to sign.
The choice to receive codes by email instead of SMS is offered only at first setup and cannot be changed afterwards.
Have this ready when you contact support
- The email address on the account
- The cell number on the account
- The borrower's mobile carrier
The carrier matters more than it looks. Codes route through several upstream carriers, and delivery failures have repeatedly isolated to one carrier rather than to an individual device or account.
How support resolves it
Support checks the text logs for the number and can tell you whether the code actually went. A send failure points upstream, and support will check whether other open tickets share that carrier — a cluster is diagnostic of a carrier-level outage.
If several users are affected at once, file one ticket listing everyone affected rather than one per user. Simultaneous failures are almost always a provider incident, and consolidating lets support correlate and escalate faster.