Startup Playbook: success through failure

Orange Outage and SMS Codes: How Freelancers Stop Getting Locked Out of Bank, Payment and Client Accounts

TL;DR: Why did SMS codes stop during the Orange outage, and how do you avoid it?

The Orange outage of 21 October 2026 disrupted calls, SMS and mobile data for a large share of Orange and Sosh customers in France for about ten hours, so every login or payment that sent its code by text to those lines was stuck. Most big platforms already offer something better: Google, Microsoft, Stripe, Shopify, PayPal, Wise and LinkedIn accept an authenticator app or a passkey, and several give printed backup codes. Spend one hour moving your bank, payment and client logins off SMS, and the next outage costs you a few calls instead of a locked bank account.
Here is what happened in the Orange outage and what caused it, on our sister site MeanCEO. This guide covers one consequence freelancers and solo founders feel first: the login code that never arrives.
I run my companies from a laptop and a phone, like most of you. When the phone loses its network, the laptop still has Wi-Fi, but half the accounts on it want a six-digit code sent by text. That is the weak spot this outage exposed, and you can fix it this week.

Why did SMS codes stop arriving during the Orange outage?

Because an SMS code travels over the same mobile network as your calls. Orange said in its first statement on 21 October that calls, SMS and mobile data were strongly disrupted for a large share of its customers, consumers and businesses alike, from late morning until shortly after 21:00. Orange told people to use secure Wi-Fi in the meantime.
Wi-Fi keeps your apps online. It doesn't deliver a text to a phone with no mobile signal unless Wi-Fi calling is switched on. So for ten hours, any bank transfer, Stripe login, client dashboard or platform sign-in that relied on an SMS code to an affected line had to wait.
Security agencies have warned about SMS codes for years, for other reasons. France's cybersecurity agency ANSSI writes in its guide on multi-factor authentication: "Il est recommandé de ne pas utiliser le SMS comme moyen de réception d'un facteur d'authentification", meaning it recommends not using SMS to receive an authentication factor, because texts can be intercepted and SIM cards hijacked. The US standards body NIST classes phone-network codes as a "restricted" method and requires services to offer an alternative. An outage adds a third reason: the code simply doesn't come.

Which accounts can you move off SMS today?

I checked the official help pages of the services freelancers and small founders use most. Here is what each offers besides a text message:
ServiceOptions besides SMSWatch out for
GoogleGoogle prompts, passkey, security key, authenticator app, backup codesRecovery changes can take up to 7 days
Microsoft (personal)Authenticator app (works offline), passkeys, security keys, email codes, recovery codeMicrosoft is phasing out SMS codes
Apple AccountCodes on your trusted devices, security keys, recovery key, recovery contactsLose every key and device and you can be locked out for good
StripePasskeys, security keys, Touch ID or Windows Hello, authenticator app, backup codeStripe itself advises against SMS
ShopifyAuthenticator app, security key, passkeys, recovery codesSMS can no longer be added; Payments needs 2-step
PayPalPasskeys, authenticator app, app confirmation, codes by WhatsApp, email or callSet it up in a browser; SMS can't be turned back on
WisePasskeys, app notification, authenticator appRecovery is a selfie check, no backup codes
LinkedInAuthenticator app, in-app prompt, passkeysRecovery without your phone means an ID check
Facebook and Meta BusinessAuthenticator app, security key, 10 recovery codesSome business portfolios enforce 2FA
UpworkApp prompt, authenticator app, security questionNo backup codes; VoIP numbers refused
OVHcloud, Namecheap, CloudflareAuthenticator app, security keys, backup codesNamecheap and Cloudflare don't use SMS at all
Sources: each company's help centre, read on 22 October 2026. Two gaps stood out. Qonto, the business account many French freelancers use, sends its login code by SMS only, and approves sensitive actions on one paired phone, so an outage blocks a fresh login. Fiverr offers codes by email, SMS or WhatsApp and doesn't list an authenticator app. If you depend on either, keep a second way to pay and get paid.

What about French banks and strong authentication?

European payment rules (PSD2, the second Payment Services Directive) require strong customer authentication: two factors from two different categories, something you know, something you have and something you are, as the French consumer institute INC explains. Most French banks now use an app for the "something you have" part, with SMS as a fallback:
  • Société Générale: the Pass Sécurité in its app validates remote operations, with a Code Sécurité by SMS as the alternative.
  • La Banque Postale: Certicode Plus validates in the app with a personal code; Certicode by SMS is the fallback, and you confirm access to your accounts every 90 days.
  • Caisse d'Epargne: Sécur'Pass Pro uses a code or Face ID and Touch ID in the app, with no SMS code needed after setup.
  • CIC: Confirmation Mobile asks for an app approval at every login since 18 October 2023, while online card payments still use an SMS code plus a personal payment code.
App validation runs over the internet, so it keeps working on Wi-Fi when the mobile network is down. The SMS fallback doesn't. If your bank still texts you codes, switch to its app validation today, and check how card payments online are confirmed, because some banks keep SMS there.

Should you keep a second phone line on another network?

For anyone who earns money by phone, yes, and it costs less than a coffee a month. The trick is the network: Sosh runs on Orange's network, RED by SFR on SFR's, B&You on Bouygues Telecom's and Free on its own. A second Sosh line doesn't help an Orange customer during an Orange outage.
Cheap second line (Oct 2026)NetworkPriceWhat you get
Free Forfait 2€Free2 € a month (0 € with a Freebox)2 h calls, unlimited SMS, 50 MB; SIM or eSIM 10 €
RED by SFR 1 GBSFR1.99 € a month1 GB of 4G, eSIM available
B&You Série spéciale 2h 50MoBouygues Telecom1.99 € a month2 h calls, 50 MB; 1 € SIM and 1 € activation
Sources: the operators' price pages, read on 22 October 2026, for new customers and without commitment. Most recent phones hold a physical SIM and an eSIM at once, so the backup line lives in the same phone. Register that number as a second recovery number where a service allows it, and the next outage at your main operator becomes a minor annoyance.
Wi-Fi calling is the free half of the fix. Orange and Sosh offer it on every plan at no extra charge, with a compatible phone, in mainland France. Texts travel over Wi-Fi only if your phone supports it, and Orange's compatibility list shows which phones do. On an iPhone, go to Settings, then Mobile Data, then Wi-Fi Calling. Bouygues Telecom switches Wi-Fi calls and SMS on by default, and Free offers both with a compatible phone.

What is the one-hour plan to stop depending on SMS codes?

  1. List every account that texts you a code. Bank, business account, Stripe or PayPal, your domain registrar and host, Google or Microsoft, freelance platforms, social accounts you sell through. Start with the ones that hold money or your domain.
  2. Install one authenticator app and use it everywhere it's offered. Microsoft notes its authenticator works offline, because the codes are generated on the phone itself.
  3. Add a passkey where it's offered. Stripe ranks passkeys first among its methods, and Google, Microsoft, Shopify, PayPal and Wise support them.
  4. Save backup codes offline. Google gives one-use backup codes, Microsoft a recovery code, Shopify recovery codes, Facebook 10 recovery codes. Print them and keep them away from your phone.
  5. Add a recovery email you can reach without your phone, and on Apple consider recovery contacts. Recovery through support takes days, Apple and Google both say.
  6. Switch your bank to app validation and ask how online card payments are confirmed.
  7. Keep a second way to pay and get paid. A second account or card, ideally at a provider that doesn't rely on SMS at login. Our guide to auditing your startup's payment set-up walks through it.
  8. Check client logins tied to your number. If a client's WordPress, Google Workspace or ad account sends codes to your phone, move it to an authenticator and write it into your handover notes, as we explained after the Ogi Networks breach for freelancers.
  9. Turn on Wi-Fi calling in your phone settings, and check on your operator's compatibility list that your phone can receive texts over Wi-Fi too. On a new phone, Orange says it can take 4 to 6 hours to start working.
  10. Test it. Put your phone in flight mode with Wi-Fi on, and log in to your bank and your payment provider from your laptop. If either asks for a text, you've found your next fix.
One warning from Apple's own help pages: with security keys switched on, losing every key and trusted device can lock you out permanently. Register at least two keys, or stay with trusted devices and a recovery contact. Moving off SMS should add ways in, never remove the last one.
If you look after websites for clients, the same week brought a second wake-up call: our 24-hour PHP vulnerability plan for freelancers covers that one. And for the wider basics, start with cybersecurity basics for women-led startups.
Turn your skills into your first startup

The Fe/male Switch startup game takes you from idea to first paying customers in weekly quests, with an AI co-founder and a community of founders.

👉 Start the game

More on this story

Running a shop or salon that lost sales on 21 October? The Fe/male Switch Foundation explains what Orange outage compensation you can claim, with an evidence list and a letter to adapt.

FAQ: the Orange outage and SMS codes

Why didn't I get SMS codes during the Orange outage?

SMS travels over the mobile network. On 21 October 2026 Orange's network disrupted calls, SMS and mobile data for a large share of Orange and Sosh customers for about ten hours, so codes sent by text couldn't reach affected lines.

Does Wi-Fi help when the mobile network is down?

Wi-Fi keeps apps, authenticator codes and passkeys working. Texts reach you over Wi-Fi only if Wi-Fi calling is on and your phone supports SMS over Wi-Fi. Orange and Sosh include Wi-Fi calling on every plan in mainland France.

What is safer than SMS codes?

An authenticator app, a passkey or a hardware security key. France's ANSSI recommends not using SMS to receive an authentication factor, and Stripe ranks SMS last among its methods.

Which services still need SMS?

Among the services we checked, Qonto sends its login code by SMS only, and Fiverr doesn't list an authenticator app. Keep a backup way to pay or get paid if you depend on them.

What are backup codes?

One-use codes a service gives you to sign in when your phone isn't available. Google, Microsoft, Shopify, Facebook, OVHcloud, Namecheap and Cloudflare offer them. Print them and store them away from your phone.

Can my bank work without SMS codes?

Most French banks validate operations in their app, which works over Wi-Fi. Société Générale, La Banque Postale, Caisse d'Epargne and CIC all offer app validation; SMS is the fallback.

About the Author

Violetta Bonenkamp, also known as MeanCEO, is an experienced startup founder with an impressive educational background including an MBA and four other higher education degrees. She has over 20 years of work experience across multiple countries, including 5 years as a solopreneur and serial entrepreneur. Throughout her startup experience she has applied for multiple startup grants at the EU level, in the Netherlands and Malta, and her startups received quite a few of those. She’s been living, studying and working in many countries around the globe and her extensive multicultural experience has influenced her immensely.
2026-10-22 14:39 news