There is a very modern form of anxiety: staring at a phone screen while waiting for a six-digit code. The banking page shows a countdown, the payment expires in 90 seconds, and the text message doesn't arrive. You refresh, you tap "Resend code", you switch the device off and on again. Nothing.
This tiny failure has wildly disproportionate consequences. Without that message, you can't validate an online payment, recover access to an email account, board a plane or sign a contract. SMS — a technology born in 1992 and long dismissed as a channel for small talk — has become the entry key to half of our administrative and financial lives.
Yet almost nobody knows how it actually travels. Hence the feeling of dealing with something magical and capricious. The reality is far more mundane: an undelivered text message always has an identifiable cause, and that cause is very rarely "your phone is broken".
The real journey of a text message, in four steps
Unlike an email, a text message does not travel directly from point A to point B. It must pass through a central piece of equipment called the SMSC (Short Message Service Center), a kind of post office operated by each carrier.
The typical path of a verification code sent by your bank looks like this:
- The business sender (the bank) does not talk directly to the mobile network. It goes through an A2P aggregator (Application-to-Person), a technical intermediary with agreements in place with the carriers.
- The aggregator picks a route. There are direct "premium" routes and cheaper "grey" routes that pass through foreign operators. The price paid largely determines reliability.
- Your carrier's SMSC receives the message, checks that it is legitimate, then looks up where your phone is via the HLR register.
- Final delivery. If your handset is reachable, the message is pushed. If not, it is stored in a queue and retried periodically for a validity period set by the sender.
That last point explains the most baffling phenomenon of all: messages that all land at once, in a burst, an hour later. They were never lost — they were waiting in the SMSC.
A text message carries no delivery-time guarantee. The GSM protocol, as standardised by ETSI and then 3GPP, defines a "best effort" service: the network does what it can, with no commitment on delivery time.
The seven real reasons a text message doesn't arrive
1. The queue and the validity period
Every business text message leaves with an invisible parameter attached: its validity period. Many senders of verification codes deliberately set it very short — 2 to 5 minutes — precisely because an expired security code is worthless.
The consequence: if your phone was briefly off the network (a lift, an underground car park, a tunnel, a plane), the message may be permanently destroyed before you become reachable again. It will never catch up. This is the number one cause of codes that are "never received" while ordinary messages from friends always end up landing.
2. The carrier's anti-fraud filtering
Since the explosion of smishing, French carriers have significantly tightened their filters. These systems analyse content, sender, volume and routing in real time. A legitimate message can be wrongly blocked when:
- it contains a shortened link (bit.ly, tinyurl…) — overwhelmingly associated with fraud;
- the alphanumeric sender ID is not declared in the sender-name register set up by the French industry;
- it travels via a suspicious international route;
- it statistically resembles a fraud campaign currently under way.
The message is then neither received nor flagged. It vanishes silently.
3. "33700" blocking and subscriber block lists
Some users have — sometimes without realising it — enabled blocking options: refusing messages from alphanumeric senders, blocking short codes, or a built-in smartphone spam filter. On Android, Google's Messages app automatically files certain messages under a "Spam and blocked" tab that nobody ever opens. On iOS, the Filter Unknown Senders option pushes messages into a discreet second tab.
Before calling support, always check these two hidden folders. In most cases, the code was there all along.
4. A full SIM card memory
This has become rare but is still real, especially on feature phones and older models. When the SIM memory is full, the handset refuses delivery and the network keeps retrying without success. On a senior mobile phone with large buttons kept as a second device, this blockage is common after a few hundred messages. Simply clearing the memory lets the queue pour in all at once.
5. Roaming and short codes
Abroad, message delivery is normally guaranteed, but two exceptions cause trouble:
- short codes (4-5 digits) are not always routable from abroad;
- codes sent from an alphanumeric sender ID may be filtered by the local visited carrier.
Hence the classic stories of travellers unable to validate a bank payment from a hotel in Bangkok. The workaround is to keep a second line and activate a local data plan — which sometimes means packing a universal travel plug adapter so you don't end up with a dead phone at the worst possible moment.
6. A carrier or aggregator outage
A2P platform incidents do happen, and sometimes affect millions of subscribers for several hours. They rarely make the news because they only hit business traffic: your personal messages get through, only the verification codes go missing. Carrier status pages and community outage-reporting platforms let you confirm within two minutes that this is a collective failure and not a personal problem.
7. An outdated number on the sender's side
A mundane yet very frequent cause: the organisation sends the code to the right number… from eight years ago. A changed line, a botched number port, a typo at sign-up. Nothing signals it to the user — the screen simply reads "A code has been sent to 06 •• •• •• 42", masked just enough that you don't notice the error.
Express diagnosis: five minutes to settle it
When a message is missing, this sequence identifies the cause in the vast majority of cases.
| Test | What it reveals |
|---|---|
| Do you receive texts from a friend or relative? | If yes, the problem lies with the sender or with filtering, not with your line |
| Is the "spam" tab in your Messages app empty? | Local filtering on the smartphone |
| Airplane mode for 30 s, then back on the network | Forces a new delivery attempt from the SMSC |
| Is the number displayed by the service the right one? | Outdated number on the sender's side |
| Is another service able to send you a code? | Distinguishes a global outage from targeted blocking |
The airplane mode trick deserves a word: by re-registering on the network, the phone signals its availability to the HLR, which immediately triggers the flushing of the queue. It's faster and more effective than a full restart.
One last reflex that is often forgotten: check the actual signal quality, not the number of bars displayed. On both iOS and Android, engineering mode (via a code dialled on the keypad) shows the strength in dBm. Beyond -110 dBm, the signalling layer that carries text messages becomes unstable. In poorly covered areas, an approved mobile signal repeater or, more simply, enabling calls and texts over Wi-Fi (VoWiFi) solves the issue for good.
The special case of bank codes and PSD2
Since the European payment services directive (PSD2) came into force, every online payment must be subject to strong authentication. French banks have massively shifted to their mobile apps, but SMS remains in use as a fallback — and that is precisely where the blockages concentrate.
Three concrete recommendations:
- Enable app-based validation as soon as your bank offers it. It runs over mobile data or Wi-Fi, bypasses the SMS network entirely and resists SIM swapping.
- Don't request three codes in a row. Each new request invalidates the previous one; the codes then arrive out of order and none of them works. Wait at least 60 seconds.
- Never share a code you have received, not even with someone claiming to be your account manager or the anti-fraud department. No French institution needs that code: it is meant to be entered by you, on the screen you are already looking at.
This last point has become the dominant modus operandi in banking fraud in France. The Banque de France and the Observatoire de la sécurité des moyens de paiement regularly point out that "adviser fraud", where the scammer pushes the victim to authorise a transaction themselves, accounts for a growing share of losses.
Breaking free from SMS dependence
SMS was adopted as a second authentication factor for one simple reason: everyone has it. But it was never designed for the job. It isn't end-to-end encrypted, it depends on a number that can be hijacked, and its delivery isn't guaranteed.
Alternatives exist and are, today, more reliable:
- Authenticator apps (TOTP) generate a code every 30 seconds, offline, with no network at all. They work on a plane, in a car park, abroad.
- Physical security keys built to the FIDO2/WebAuthn standard are the next level up: a FIDO2 USB-C security key plugs in or is tapped against the phone, and makes phishing technically ineffective since it checks the site's address before responding.
- Backup codes provided when you enable two-factor authentication: print them out and store them away from the phone. A fireproof document safe — or simply a sealed envelope in a drawer — beats a screenshot in your photo gallery.
ANSSI, in its guidance for the general public, and the CNIL, in its practical password fact sheets, converge on the same view: SMS is an acceptable stopgap, never an ideal.
When silence from SMS is a warning sign
An important nuance to close on. If you suddenly stop receiving all your texts and calls, with no reported network outage, don't look to filtering: that is the classic symptom of SIM swapping. A fraudster has had your number transferred to their own SIM card, your line is deactivated, and they are now receiving your verification codes in your place.
Signs not to ignore:
- persistent "No service" or "Searching…" while other phones in the household work fine;
- a text or email announcing a number-port request or a duplicate SIM you never asked for;
- reported login attempts on your accounts.
The response must be immediate: call your carrier from another line to have the SIM suspended, alert your bank, and file a police report. The public Cybermalveillance.gouv.fr scheme offers a dedicated assistance pathway, and 17 Cyber allows you to report online.
Conversely, a single missing code while everything else works is not alarming: it is almost always a routing, filtering or queueing issue. Getting into the habit of telling the two situations apart — total silence versus selective silence — prevents both needless panic and dangerously slow reactions.
Key takeaways
- An undelivered text message has an identifiable technical cause; it isn't just bad luck.
- Verification codes have a very short lifespan: off the network at the wrong moment and they are destroyed, not delayed.
- Airplane mode for 30 seconds is the single most effective way to force delivery.
- Always check the spam tab in your messaging app before any other diagnosis.
- Move your sensitive accounts to an authenticator app or a physical security key.
- Total silence on the line, calls included, should make you think of SIM swapping and trigger an immediate call to your carrier.
