Mandatory 2FA for Phone Number Updates in Sparkforge

By Sparkforge Support Team ·Last reviewed May 3, 2026

Sparkforge now requires 2FA whenever a user changes their phone number. Verify through your existing email, your existing verified phone, or a TOTP authenticator app. OTPs are never sent to the new number.

Sparkforge now requires two-factor authentication on every phone number change. The check uses a previously verified channel: existing email, existing verified phone, or a TOTP authenticator app. OTPs are never sent to the new number.

Why This Matters

Account security: blocks phone-swap takeovers because OTPs cannot route to a brand-new number.
Consistency: mirrors the email update + 2FA flow.
Compliance: stronger identity controls on critical profile data.
Abuse protection: daily attempt limits curb brute-force change requests.

Prerequisites

You must have at least one verified channel on your profile:

Verified email (recommended)
Verified phone (SMS)
Authenticator app (TOTP) enabled (optional, recommended)

You must be able to access the verification channel during the update. If you currently have no verified channel, set up TOTP or verify your email before attempting a phone change.

Supported Verification Channels

Email OTP — offered if your email is verified.
SMS OTP — offered only if your current phone is already verified.
Authenticator app (TOTP) — offered if you previously enabled it.

OTPs cannot be sent to the new phone number being added.

Rate Limits

Maximum of 5 phone or email change attempts per user per day.
Hitting the limit blocks further attempts until the counter resets.
If you hit a limit unexpectedly, check whether another admin or an automated process attempted changes the same day.

Update Your Own Phone Number

Go to Settings → My Profile.
In Personal Data, edit the phone number.
Enter the new number and click Update Profile.
In the Choose how to verify modal, pick an available channel (email, existing SMS, or TOTP).
Enter the code from that channel and confirm.

Admin Updates on Behalf of Users

Admins can initiate phone changes from Settings → Team. The OTP is delivered to the team member's verified channel, not the admin's.

Audit and Hardening

Only verified channels are eligible for OTP delivery.
OTPs are never delivered to the new phone number.
Daily attempt limits curb brute-force activity.
Review audit logs (where available) to see who initiated changes.
Enable TOTP as a backup so you are not blocked when SMS is unavailable.

Frequently Asked Questions

Why can't the OTP go to my new phone number?

Routing OTPs to the new number would defeat the purpose. An attacker could swap your number and verify the swap with the same number. Sparkforge only sends OTPs to channels that were already verified.

What if I have no verified channels at all?

Set up TOTP or verify your email before changing your phone number. Without a verified channel, you cannot complete 2FA.

How many change attempts do I get per day?

Five phone or email change attempts per user per day. Further attempts are blocked until the counter resets.

Can an admin update my phone number for me?

Yes, from Settings then Team. The OTP is sent to your verified channel, not the admin's, so you still have to approve.

What's the most reliable verification method?

A TOTP authenticator app. It works without SMS coverage and is not tied to a phone number that could be ported.