Verified October 2026 against PlayStation, Xbox and Microsoft support pages.
Signing in from a new country, a hotel network or a borrowed connection can trigger a security alert from Microsoft. The Sony help pages we checked don't describe when PlayStation adds a sign-in check. Either way, an expected prompt is not a problem as long as you can still receive a code. The problems start when your only verification method is a phone number that does not work abroad, so the fix is preparation before you leave, not workarounds once you are away.
Why a trip can trigger a security check
Microsoft says that activity which deviates significantly from your typical patterns may be treated as potentially risky, and a handheld or console joining a new Wi-Fi network in another country can look like that kind of change. Microsoft also notes that mobile networks can route your connection through other places, so a sign-in can appear to come from somewhere you aren't.
For a Microsoft account (the one your Xbox uses), Microsoft says it may send an email or text message to your alternate contact methods when it notices a sign-in attempt from a new location or device, and genuine alerts come from [email protected]. To see what it noticed, open the account's Recent activity page; our guide to reading Microsoft account Recent activity walks through it. See also what happens if there's an unusual sign-in to your account.
If an alert lists a place you have not been and you did not sign in, treat it as a possible takeover and act on it right away.
The weak link: a phone number that does not travel
A common cause of lockouts on a trip is that codes sent by text message stop arriving. A local SIM replaces your home one, roaming is off, or automated messages are not delivered abroad. If text messages are your only second step, you may be stuck until you are home.
Microsoft adds another reason not to depend on texts: its verification code troubleshooting page states it is phasing out SMS as a method of authentication and account recovery for personal Microsoft accounts. Microsoft also warns that excessive or repeated code requests can get you blocked.
Authenticator app versus SMS
An authenticator app generates codes on the phone itself, so it generally keeps working without a mobile signal or your home SIM. PlayStation's 2-step verification supports an authenticator app (Sony names Authy, Google Authenticator and Microsoft Authenticator as examples) or text messages; to change the method you turn 2-step verification off under Account Management > Security > 2-Step Verification Status > Edit and set it up again with the new one, as described on the PlayStation 2-step verification page. For a Microsoft account, two-step verification can use an email address, a phone number or an authenticator app, managed from the account's security settings. Menu names can vary by console software and region.
The trade-off: an authenticator lives on one phone. If that phone is lost or stolen on the trip, you need a fallback that is not on the phone.
Backup options that work anywhere
- PlayStation backup codes. Found in Account Management > Security > Backup Codes. Sony currently lists a set of 10, each usable once. Sony is clear that if you can't sign in, you can't check them online, so write them down before you go.
- Microsoft recovery code. A single 25-digit code generated from the account's sign-in management page. Generating a new one cancels the old one, and it cannot be looked up later. Microsoft notes that if two-step verification is on, using it still starts a 30-day wait before the change takes effect, so treat it as a last resort, not a quick fix on a trip.
- A second verification method. For a Microsoft account, an alternate email address you can open from any browser is a practical backup.
Keep printed codes in your luggage separately from the phone, or in a password manager you can reach from another device.
One timing warning for Xbox players: if you replace all of your Microsoft security info at once, or replace it because you no longer have the old methods, Microsoft holds the change for 30 days. Make security-info changes well before you travel, not the night before a flight.
Account region and your bank
Xbox Support says that if you are only temporarily elsewhere, you don't need to change your Microsoft account's country or region. Tell your bank before you travel.
A short pre-trip checklist
- Sign in once at home on each device you will take, and confirm the password works.
- Move 2-step verification to an authenticator app, or add one alongside SMS where the platform allows it.
- Print or safely save fresh PlayStation backup codes and a current Microsoft recovery code.
- Make sure the email address on each account opens from any browser and has its own recovery options set up.
- Turn on purchase protection in case a device is lost: PlayStation's Require Password at Checkout (Sony notes it isn't compatible with accounts that have passkeys set up), or, on Xbox, Ask for my PIN or Lock it down (or Custom with purchases protected) in the console's sign-in and security preferences, so purchases on that console need your PIN or password.
For the wider set of settings worth reviewing, see the full PSN and Xbox security checklist.
What to do next
If you are already abroad and locked out, stop requesting codes and use the fallback you prepared. If you have no working method left, the official routes are still open:
- PlayStation with 2-step verification on and no phone: regain PSN access after losing your 2-step phone.
- Xbox codes not arriving or the authenticator gone: what to do when Xbox two-step verification locks you out.
- Microsoft has locked the account after unusual activity: how to unlock a locked Microsoft account for Xbox.
Never hand your password or a verification code to anyone offering to get you back in faster. Only PlayStation Support and Microsoft's own recovery tools can restore access to your account.