Two-Factor Authentication for Phone Number Changes

Enrollio requires two-factor authentication (2FA) whenever you change your phone number. This security measure protects your account from unauthorized access and ensures that only you can update your contact information.

This article explains how phone number verification works, who it affects, and how to complete the process using your email, an existing verified phone number, or an authenticator app.

Table of Contents

What is 2FA for Phone Number Updates?

Enrollio adds a verification step whenever you update the phone number on your profile. You'll need to verify your identity using a channel you've already set up—your email, current verified phone, or authenticator app.

This prevents anyone from hijacking your account by changing your phone number without your permission. Verification codes are only sent to channels you already control, never to the new phone number you're adding.

Key Benefits

Understanding why this security measure exists helps you protect your childcare center's data:

  • Account security: Blocks phone-swap attacks by ensuring verification codes only go to your existing, trusted channels
  • Consistency: Works the same way as email updates, making profile changes predictable
  • Compliance: Strengthens identity controls for sensitive family and enrollment data
  • Abuse protection: Daily limits prevent repeated unauthorized change attempts

Prerequisites

Before you can update your phone number, you need at least one verified channel on your profile. Check this list before attempting a change:

  • Verified Email (recommended) — your current email address must be verified
  • Verified Phone (text message option) — your current phone on file must already be verified
  • Authenticator App (optional, recommended) — a TOTP app like Google Authenticator or Authy

You must be able to access your chosen channel during the update process. Staff members need permission to edit their own profile; admins need permission to edit team member profiles when making changes on their behalf.

Pro tip: If you don't have any verified channels set up yet, start by verifying your email or enabling an authenticator app. This ensures you won't get blocked when updating your phone number.

Verification Channel Options

Enrollio only shows you verification options that are already trusted on your account. Here's what you might see:

  • Email: Sends a code to your verified email address — always available if your email is verified
  • Text Message: Sends a code to your current verified phone — only available if your existing phone is already verified
  • Authenticator App: Use your TOTP app to generate a code — available if you've previously enabled this option

Important: You cannot receive a verification code at the new phone number you're trying to add. Codes only go to channels you've already verified.

[SCREENSHOT: The "Choose how to verify" modal showing the three verification options with radio buttons]

Rate Limits

Enrollio limits phone and email changes to protect your account from abuse. You can attempt up to 5 phone or email changes per day.

When you reach this limit, you'll see a message asking you to try again later. The counter resets at midnight.

Note: If you hit the limit unexpectedly, check whether another admin or automated process attempted changes on your behalf earlier in the day.

Staff vs. Admin Updates

The verification process is similar for everyone, but where you start depends on whose number you're updating:

Updating your own number: Start from your profile page and choose your preferred verification method.

Admins updating staff numbers: Start from Settings → Team and open the staff member's profile. The verification code is sent to the staff member's verified channels, not yours.

Security Considerations

These security measures help your center maintain safe profile changes and spot suspicious activity:

  • Verification codes never go to the new phone number you're adding
  • Only pre-verified channels can receive codes
  • Daily attempt limits prevent brute-force attacks
  • Activity logs track who initiated changes and when (check your audit logs if available)
  • Authenticator apps work even when text messages aren't available
Pro tip: Enable an authenticator app to add a backup verification method that works even when you don't have cell service.

How to Update Your Phone Number

Follow these steps to securely update a phone number in Enrollio.

A) Update Your Own Phone Number

  1. Click Settings → My Profile
  2. In the Personal Data section, click the edit icon next to your phone number
  3. Enter your new phone number
  4. Click Update Profile
  5. When the "Choose how to verify" window appears, select one of your available channels:
    • Email (code sent to your verified email)
    • Text message (code sent to your existing verified phone)
    • Authenticator App (enter your 6-digit code)
  6. Click Continue
  7. If you chose Email or Text message, check for your code and enter it
  8. Confirm the change

You'll see a success message and your profile will show the new number.

[SCREENSHOT: The profile page showing the phone number field with the edit icon highlighted]

[SCREENSHOT: The verification code entry screen]

Important: If you don't see "Text message" as an option, your current phone isn't verified. Use Email or Authenticator App instead, or verify your existing phone first.

B) Update a Staff Member's Phone Number (Admin)

  1. Go to Settings → Team
  2. Open the staff member's profile
  3. Edit the phone number and enter the new number
  4. On "Choose how to verify," select an available channel
  5. The code is sent to the staff member's verified email or phone, or they can provide their authenticator app code
  6. Enter the code (or have the staff member provide it securely)
  7. Click Continue to complete the change

[SCREENSHOT: The Team settings page with a staff member's profile open, showing the phone number edit field]

Security reminder: Verification codes are never sent to the new number you're adding. The code goes to channels the staff member has already verified.

Troubleshooting

Use these tips to resolve common verification issues:

No Verification Options Available

You need at least one verified channel to proceed. Set up an authenticator app or verify your email first.

Don't See Text Message as an Option

Your current phone isn't verified. Use Email or Authenticator App instead, or verify your existing phone number before updating it.

Code Not Received

Check your spam or junk folder. For text messages, confirm you have cell service. You can request a new code after the resend timer allows.

Daily Limit Reached

You've made 5 change attempts today. Wait for the counter to reset at midnight. Consider setting up an authenticator app to reduce reliance on text messages.

Lost Access to Email and Phone

Use backup codes if you've enabled them, or contact your account owner or admin for assistance.

Frequently Asked Questions

Why can't I send the verification code to my new phone number?

For security, codes only go to channels you've already verified on your account. This prevents attackers from adding a new number and receiving the code there.

I don't see text message as a verification option—what should I do?

Text message verification only appears if your current phone is already verified. Use Email or Authenticator App instead, or verify your current phone first.

How many times can I attempt a change per day?

You can attempt up to 5 phone or email changes per day. The counter resets at midnight.

What happens if I lose access to all my verification channels?

Contact your account owner or admin immediately. They may be able to assist, or you can use backup codes if you've previously enabled them.

Can an admin update my phone number without me knowing?

No. Even when an admin initiates the change, the verification code is sent to your verified channels, not theirs. You'll receive the code and can see the change in your activity log.

Should I enable an authenticator app?

Yes, we recommend it. Authenticator apps work even when you don't have cell service or email access, giving you a reliable backup verification method.