Does Bank of America accept a VoIP number for security codes?

What Bank of America publishes about number type

Nothing, on its Security Center pages. Its tools and resources page links to USB security keys, Trusteer and third-party data sharing, and says nothing about VoIP, landlines or carriers. Its Security Center overview lists “Set up your two-factor authentication” among the ways to raise your security, without saying what kind of phone that takes (Bank of America).

So anyone quoting Bank of America's definite VoIP policy is guessing. Plenty of financial services do refuse internet numbers after checking line type, and how that check works explains it. That's a general pattern, not something Bank of America has said.

The option most people don't know about: a USB security key

• Bank of America

  “USB security keys are an optional, alternative to SMS-based, one-time security codes. You can use them if you don’t have access to a U.S. mobile phone number or can't receive texts to your phone.”

  https://web.bankofamerica.com/en/security/tools-resources/usb-security-key

That's the bank describing the exact situation that sends people looking for a phone number. The details, from the same page:

• What it does. It “adds an extra layer of security in Online Banking to increase limits for certain transfer types”, and once it's set up “it serves as extra security at login and for adding transfer recipients to your account.”
• What to buy. The bank doesn't supply one. It says they “typically cost between $18 to $50” and to “make sure the key you choose is FIDO-2 certified.”
• Where it works. In a supported browser such as Chrome, Edge, Safari or Firefox. “Internet Explorer does not support USB security keys.”

The limit, honestly: the page describes the key in Online Banking, in a browser. It doesn't say the key replaces texts everywhere, so don't assume every prompt will offer it.

When codes or alerts stop arriving

The bank's own fine print on alerts is a reminder of how texts fail: “Delivery of alerts may be affected or delayed by your mobile carrier's coverage.” (Bank of America) Before blaming the type of number, check the obvious:

• Is the mobile number on file still yours? If it isn't, sort that out while you can still sign in.
• Are you travelling? Carrier coverage is the first thing that changes abroad.
• Can the number receive texts at all? The USB key page treats having “a U.S. mobile phone number” and being able to receive texts as two separate things. You need both.
• Got a text asking for your code? Don't reply. The bank says to forward suspicious texts to abuse@bankofamerica.com.

When a real mobile line is the answer

When you'd rather keep text codes and alerts than carry a key: you bank from your phone more than a browser, you live abroad without a US SIM, or a small business needs the bank's texts to reach more than one person. A Cleat line is a real US mobile number, not VoIP, that receives texts and transcribes incoming calls. It's receive-only, so it can't call the bank back, and it's $24.99 a month. Bank of America publishes no number-type rule, and no provider can promise a bank accepts a particular number, so test it before you rely on it.

If you're abroad

This is the case the USB key was written for, and it's the bank's own answer, so start there. If you'd rather keep texts, a US mobile line that doesn't depend on roaming is the other route. Getting a US number from abroad lays out the options, including keeping a US SIM, and Cleat for expats covers who it suits.