Getting Stripe's two-step code on a number the business keeps

What Stripe publishes about number type

Nothing. Across the five Stripe support pages that cover two-step authentication — the overview, the SMS setup page, the page on changing your number, the requirement page and the lockout page — the words VoIP, virtual number and landline do not appear. If a page tells you Stripe's definite VoIP policy, ask where they read it.

What Stripe does publish is an argument against SMS in general. Its own SMS setup page says the method “is unencrypted, requires cell reception, and is vulnerable to SIM swap attacks”, and that “Stripe encourages you to use an authenticator app or a hardware security key instead” (Stripe)). Take that seriously: on a payments account, a passkey or security key is the better primary method, and the phone is the fallback you hope you never need.

The full list Stripe offers is “Passkeys, Security keys, Touch ID or Windows Hello, Authenticator apps, Text messages (SMS)”, and it recommends you “enable two or more authentication methods and avoid SMS in favor of more secure options” (Stripe).

When Stripe asks again

• Stripe, on SMS two-step authentication

  “Stripe will request a code if you sign in from a new device, as well as periodically to make sure it's still secure.”

  https://support.stripe.com/questions/enable-two-step-authentication-using-text-messaging-(sms)

That word *periodically* is the whole reason a number on a Stripe account has to be one you will still hold next year. It is not a sign-up hurdle you clear once. A number that lapses when someone changes carrier, leaves the company or moves abroad will be asked for again, at a moment nobody chose.

Adding or changing the number

To add SMS as a method, from Stripe's own instructions (Stripe)):

1. 01Go to your user profile.
2. 02Click Add under the Two-step authentication section.
3. 03Select Add SMS, enter the phone number, and click Confirm phone number.
4. 04Enter the code Stripe texts to confirm it has the right number.
5. 05Write down the backup code it shows you and store it somewhere that is not the same phone.

To change a number you still control: open the Personal details page in the Dashboard, click the … icon next to the current number under Two-step authentication, and select Update (Stripe). If you no longer have the old number, Stripe's instruction is blunter: “Use a backup code to disable and re-enable two-step authentication.”

If the number is gone and so is the backup code

Then it stops being self-service. Stripe's lockout page tells you to “Submit an account recovery request to prove your identity as the account owner”, says the decision “may take up to a couple of business days”, and gives you 48 hours to use the link it emails (Stripe). Two business days is a long time to be out of your own payouts.

This is the argument for the number belonging to the business rather than to a phone. Not because Stripe asks for that — it does not — but because the recovery path is slow enough that you want to never walk it.

Stripe wants one login per person, and that is correct

This is where a lot of advice about shared numbers goes wrong, so it is worth being exact. Stripe's position is that teammates get their own logins: “If other people need access to your account, invite them as team members so each user can have their own credentials and devices for two-step authentication” (Stripe). An administrator “can require two-step authentication for everyone on the Team settings page”.

So a Cleat line is not a way for five people to share one Stripe login. That is a worse setup, and Stripe gives you a better one for free. What a business-owned line is for is the *owner* account: the one login that holds the account, whose number should not be a personal cell that walks out of the building. Shared 2FA for teams covers the pattern, including the agency version where the client owns the line.

When Cleat is the wrong answer here

• You can use a passkey or a security key. Stripe recommends them over SMS. Do that, and keep the phone as a second method rather than the only one.
• You want one Stripe login for the whole team. Use team members. Each person's own credentials are both safer and what Stripe supports.
• You want a second Stripe account. One verified person holds each Cleat line, and using it to get around a platform's account rules breaks their terms and ours.
• You need to place calls. A Cleat line receives. It cannot dial out and cannot reach 911. An automated call that reads a code is transcribed into the inbox instead.

Where a Cleat line fits

A Cleat line is a real US mobile number, not VoIP, held by one identity-verified person and readable by a team in a shared inbox. On a Stripe account it makes sense in three situations: the founder is outside the US and the US mobile that received the codes is gone; the account belongs to a company rather than to whoever set it up; or an ops team needs to see that a challenge was sent without one person being the bottleneck. It is $24.99 a month, and it receives only. Why line type decides whether a code arrives explains the mechanism behind every page in this section.

Keep reading

Shopify · QuickBooks · GitHub · Every service in this section