Google tells you not to use Google Voice for Google's own codes

The warning Google prints about Google Voice

• Google Account Help, on recovery options

  “Do not use a Google Voice number as a recovery phone number. If you do, you could lock yourself out of your account.”

  https://support.google.com/accounts/answer/183723

• Google Account Help, on 2-Step Verification problems

  “If you use Google Voice to get verification codes, you could lock yourself out of your account.”

  https://support.google.com/accounts/answer/185834

The reason is circular dependency: the codes that get you into the account arrive inside the account. It is the clearest published example of why a free internet number is a bad place to keep the keys, and Google is the company least likely to be talking down its own product when it says so. Google Voice and verification codes covers the failure mode in detail.

On third-party VoIP and virtual numbers Google publishes nothing at all. The only other number-type constraint we found is geographic, in the Workspace admin help: “2SV using local phone numbers is not currently supported for some domains in Nigeria and Ivory Coast, due to large volumes of account abuse” (Google).

What Google tells Workspace admins

• Google Workspace Admin, on 2-Step Verification methods

  “Text messages are discouraged—They rely on external carrier networks and might be intercepted.”

  https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification

• Google Workspace Admin, on the strongest method

  “Security keys are the most secure form of 2SV and protect against phishing threats.”

  https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification

Take that seriously for the accounts that matter most. A super-admin account should be on a security key or a passkey. Google offers both, plus an authenticator app: “With a passkey, you can sign in to your Google Account with your fingerprint, face scan, or device screen lock, like a PIN”, and “you can set up Google Authenticator or another app that creates one-time verification codes” (Google).

Admins also have a lever most people do not know about. Workspace super administrators can issue backup codes to a user who is locked out, and Google notes the two catches: “Creating new verification codes invalidates any existing code”, and “Only super administrators can generate backup verification codes for other admins” (Google).

Changing the number has a waiting period

• Google Account Help, on changing your number

  “It may take a week before you can use your new phone number to verify it's you for sensitive actions like changing your password.”

  https://support.google.com/accounts/answer/3463280

That week is the reason to move a number while the old one still works rather than after it stops. Google also warns that removing your last second step is a trapdoor: “If users remove their last-known second step on their account, such as a phone number, they get a warning”, and “If they don't add a new second step, they could be locked out of their account” (Google). And one thing not to assume: “Changing the number in your Google Account only affects some Google services” (Google).

Adding or changing the number

From Google's own instructions (Google):

1. 01Open your Google Account and go to Personal info.
2. 02Select Phone.
3. 03To add one, select Add a recovery phone to help keep your account secure.
4. 04To change one, select Edit next to the number, then Update number.
5. 05To take one off, select Delete, then Remove number.

Two-Step Verification itself is switched on from Security & sign-in, under “How you sign in to Google” (Google). If you would rather not be asked on every sign-in, Google's page notes the option to “check the box next to 'Don't ask again on this computer'”.

If the number is gone

Backup codes, which Google tells you to “Create… to use in case you lose your phone, change your phone number, or otherwise can't get codes by text, call”, with the caveat that “After you use a backup code to sign in, that code becomes inactive” (Google). And the sentence that decides how seriously to take all of this: “For your security, you can't call Google for help to sign into your account” (Google).

Where a Cleat line fits

On the recovery and 2SV number for a Workspace account the company owns: a business whose admin account should not hang off a founder's personal handset, or a team outside the US that needs a US mobile for the accounts hanging off Workspace. A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person, readable by a team in a shared inbox, $24.99 a month. Codes can also land in a Slack or Microsoft Teams channel — how to set that up — which is how most companies actually want an admin challenge to surface. Shared 2FA for teams is the longer version.

When Cleat is the wrong answer here

• For a super-admin account, use a security key. Google says so, and it is right. Keep the phone as a recovery route, not the primary one.
• You want to skip the week-long wait. You cannot. Move the number while the old one still works.
• You want one number to be everyone's second factor. Each Workspace user signs in as themselves and needs their own. A shared line is for the account the business owns.
• You need to place calls. Receive-only, no outbound, no 911.

Keep reading

Personal Google Accounts · GitHub · Meta Business Suite · GoDaddy · Every service in this section