The Login Code Goes Where? The UK Phone Number Hiding in Your Admin Accounts

There is a particular kind of silence that fills a small office when someone tries to log into the payroll portal and the expected text message never arrives. The screen says a code has been sent. The phone on the desk says nothing. Someone checks the handset, then the softphone app, then a dusty forwarding rule set up years ago. Twenty minutes later, the team is still locked out and the person who set up the account has left the company.

That is the quiet risk with one-time passcodes. They are not glamorous. They are not the sort of thing a UK business puts on a strategy slide. But they sit between your team and bank accounts, tax filings, domain names, email admin, booking systems and supplier portals. If the number receiving those codes is a landline that cannot accept texts, a VoIP extension nobody watches or a desk phone in a meeting room, your security setup has a very ordinary weak spot.

Start with the number, not the software

Most guides begin with the login page. It is better to begin with the phone number. Somewhere in your business, there is a number that has been used as the contact point for years. It may have started life as the main office line. It may have been forwarded to a mobile during the pandemic. It may be a virtual number that rings three desks at once. The question is simple: if a service sends a text to that number today, where does it land, and who can see it?

Build a list. Finance should check the bank, the accounting package, the payroll system and anything connected to VAT or PAYE. Operations should check the domain registrar, website hosting, email administration, the CRM and any scheduling tool. Someone should look at insurance portals, courier accounts, utilities, landlord contacts and the software that runs your tills or bookings. Do not forget HMRC and Companies House-related services, plus any portal that holds customer records.

For each one, note the phone number on file. Then note the type of number: old landline, desk phone, hosted VoIP extension, direct dial, mobile or virtual number. Add the recovery email address. Add the name of the person who can actually access the account. This register should live somewhere secure, not in a shared document called final-final-2.

The two-minute text test that often lies

Testing sounds obvious. Send a text to the business number from a personal mobile. If it arrives on a handset or in a softphone inbox, good. But one successful test does not prove everything. Many UK landlines were never designed to receive SMS. A VoIP number may accept texts from a mobile but reject shortcode messages from a bank or a large software provider. Forwarding rules that work beautifully for voice calls can quietly ignore text messages altogether.

Test from more than one phone. Test a shortcode if you can. Test during a busy period when the front desk is not watching the screen. If you are brave and well prepared, use the 'forgot password' route on one low-risk account and see where the code lands. Do not do this on the day before a payroll run.

Also check who receives the message. A text to the main number may hit a shared inbox, a single desk phone or an app on one person's work mobile. If that person is on holiday in Cornwall with poor signal, your recovery plan is essentially a postcard.

Landlines, desk phones and well-meant forwarding

The classic problem is an old landline that has been kept alive because it is printed on invoices. It rings, so everyone assumes it works. But SMS is a different service. A standard analogue phone line may not accept a text at all. A digital desk phone may support messaging on paper, yet the provider may not route SMS to it. A VoIP extension may be technically capable but not configured with a text inbox.

Forwarding deserves special suspicion. Call forwarding is common in UK offices, especially where a number has been moved to a hosted phone system. Text forwarding is not always included. A rule that sends calls to a mobile may leave SMS behind. If nobody has tested it, nobody knows.

There is also the ownership question. A number may belong to a former employee's account, an old SIM in a drawer or a provider contract that finance stopped reviewing. That is not just inconvenient. It is a security problem wearing a lanyard.

Sensible fallbacks that do not create a new trap

The best fallback is not another secret mobile number. It is a deliberate setup. Where services allow it, use an authenticator app or a security key instead of SMS. Store backup codes properly, ideally printed and kept in a locked cabinet, with a named person responsible for them. Give at least two trusted people admin access, not because you distrust each other, but because people leave, retire and take holiday.

If a service insists on SMS, use a business number that is genuinely text-capable. Check that it can receive messages from banks and software providers, not just from a colleague's phone. A hosted number with a shared SMS inbox and an audit trail is usually safer than a single desk handset. Avoid making one person's personal mobile the only route into a company account. That is not a recovery plan; it is a future argument.

Move one login at a time

Migration does not need to be dramatic. Choose the target number, confirm it can receive the messages you need, then update one service at a time. Log in, change the number, test the login, and record the change. Keep the old number active until every critical account has been moved. Cancelling it early is how a tidy-up becomes a lockout.

If the old number sits on a line due for the UK's PSTN retirement, give yourself more time than you think. Ask your provider direct questions: does this number receive SMS, including shortcodes? Who can see the messages? Can we have multiple users? What happens to texts during a port? Can we export a log? A provider that cannot answer clearly is a provider to question before an emergency, not during one.

If the code is not arriving

Do not hammer the resend button. Check coverage, check the softphone inbox, check spam folders and check whether the service is sending to an old extension. Look for a voice-call option or a backup code. Contact the provider through a verified channel, with the account details to hand. And once you are back in, fix the number that caused the problem.

EasyToCall's view is simple: a business phone number is infrastructure, not decoration. It should be owned, documented and tested like any other part of your admin stack. A five-minute review this week is far calmer than a Friday afternoon spent begging a bank's automated system to send a code somewhere, anywhere, that a human can reach.