When the code comes by phone call instead of text

The three kinds of call

Every verification call in this table arrives the same way — the phone rings. What separates them is what has to happen next, which is exactly the part almost nobody publishes.

The last-digits flow, step by step

This one confuses people most, because nothing is ever spoken and there is no message to read. The screen asks for the last four digits of the number that just called you.

On a line where calls are transcribed, the calling number is shown beside the message, which is the whole of what this flow needs. How line type decides what a service accepts covers why a real mobile line gets through more screens than an internet number in the first place.

Who actually offers a call

Short list, because the honest version is short. These are the companies whose own pages say a call is available:

• Google — “Codes can be sent in a text message or a voice call, which depends on the setting you chose.”
• Apple — “You can choose to receive the codes by text message or automated phone call.”
• Microsoft — offers a call, and it is the keypress flow above.
• PayPal — offers a call to a landline alongside SMS, which is the closest any large payment company comes to publishing a number-type position.
• Amazon — offers a voice call for KDP, noting only that “OTP through calls are not supported on Landlines”.

The more useful half is the silence. Discord, Steam and Coinbase document no voice option at all. Chase describes no call mechanics. Bank of America publishes text or email only. Outside Telegram's developer documentation, essentially nobody publishes what their call actually does — which is why this page quotes an API reference for a consumer question. What each service publishes about VoIP numbers and codes is the full dated record.

What this means for a Cleat line

A Cleat line is receive-only. You cannot answer a call on it, listen to one, record one, place one or return one, and it cannot reach 911. What it does instead is transcribe an incoming call into the same inbox as a text, pull out the code, and show the number that called. For a flow that needs a key pressed, the line presses it for you.

That covers all three flows above. What it does not do is make any service accept any number: no provider can promise that, and a page that implies otherwise is selling you something. If a service's call is the deciding factor in your purchase, test it inside the first month.

Voice codes are on the way out, and you should hear that from us

Microsoft's own documentation, on the same page that describes its keypress flow, says: “Microsoft recommends users move away from using text messages or voice calls for multifactor authentication.” It links its own note titled *It's Time to Hang Up on Phone Transports for Authentication*. Google is blunter about what the weakness is — “verification codes sent by texts or calls can be vulnerable to phone number-based hacks”.

Both are right, and saying so costs us a sale. A phone number is a delivery route, not a security upgrade: where a service offers an authenticator app or a passkey, that is the better choice. A number is for the accounts that give you no other option, and there are still a great many of those. Where our own line is not the answer is the same argument made at more length.

Who this page is not for

Anyone looking for a free or shared line to take verification calls. The sites offering to receive calls online are public pools: whoever else is watching that number hears your code too, and there is nothing you can do about it. How we handle your codes and who can read them is our side of that. A Cleat line is one number, yours alone while you pay for it, at $24.99 a month.

If you are building rather than signing in, a transcript fires a webhook exactly like a text does — the developer notes cover the payload.