The Text Message sign-in phone belongs to your customer’s individual WHMCS user. It can differ from the account’s notification number. Updating a client contact telephone does not replace an already enrolled sign-in phone.

Change the phone while access is available

Have your customer sign in using their current method, open their Security Settings, and follow WHMCS’s supported disable-and-enrol-again flow for two-factor authentication. Choose Text Message again, enter the new phone in full international format, receive its proving code and confirm enrolment. Keep the newly supplied backup information.

Complete the change deliberately while the user still has access to their current phone or recovery method. Enrolment is per user: another login on the same client account retains its own enrolment and phone. Do not change every account contact number to work around one person’s lost device.

Use the backup route when the phone is lost

Have the person use WHMCS’s offered backup-code login option if they have their backup code. This is different from asking staff to retrieve a current SMS code. The backup code should remain with the person using it rather than being pasted into a support conversation.

An administrator-assisted client recovery

After your hosting team verifies the person through your normal support process, an authorised administrator can use Clients → Manage Users, find the intended user and open Manage User. Set that user’s Two-Factor Authentication to OFF and save as the supported recovery action, then have the person enrol again with a working phone.

Check the user identity carefully: the action concerns that user, not every person sharing access to their client account. An administrator can disable a client user’s factor but cannot complete their phone enrolment on their behalf. This client-user procedure is not a recovery instruction for a locked-out staff administrator.

If a staff administrator cannot sign in, use an existing authorised administrator or established staff recovery route first; this client-user procedure does not recover a staff account.

See the PD SMS Manager WHMCS guide for related tasks, or explore PD SMS Manager.