Dynamic passwords without an Iranian SIM — what works and what does not
You have an Iran IP, the banking app loads, you have signed in — and now the bank wants a dynamic password sent to a number you no longer carry. This is the most common dead end for Iranians abroad. Here are the routes that actually exist.
Why a VPN cannot deliver an SMS
This is the point that needs the most explaining. A VPN moves internet traffic, and SMS is not internet traffic. Text messages travel over the mobile operator's signalling network — the same network that connects a phone call. The two paths are entirely separate.
So when the bank says “a dynamic password has been sent to your number”, that message heads towards Iran's mobile network and waits for your SIM to appear somewhere on a mobile network. If that SIM is sitting switched off in a desk drawer in Berlin, the message never arrives — no matter how good your internet connection is.
The five routes that actually exist
Best to worst:
1. The in-app password generator — the best route
Most Iranian banks now generate the dynamic password inside their own app. A counter on your phone produces a new number every 60 seconds and no SMS is involved. If you have this enabled, you can transact from anywhere in the world with an Iran IP.
The catch: enabling it usually requires one confirmation SMS. That is why this is something to do before you leave Iran, not after. If you are still there, or have a trip coming up, do this one thing.
2. Roaming on the Iranian SIM
Keep the Iranian SIM in a phone and enable international roaming. Incoming texts arrive, and receiving them is usually free. This is the simplest route that requires no advance preparation.
The drawback: you have to keep the SIM alive. Iranian prepaid SIMs are cancelled after a long period of disuse, so a call or a small top-up every few months is necessary.
3. A second phone in Iran
Leave your SIM in an old family phone in Iran and have them relay the code. It is practical and plenty of people do it.
Two caveats. First, you need someone available — a dynamic password is usually valid for 60 to 120 seconds, so it takes a coordinated call rather than leaving a message. Second, it means somebody else has access to your banking codes; only do it with someone you trust completely.
4. A postpaid SIM instead of prepaid
If you will be away for years, a postpaid SIM is not cancelled for disuse and its bill can be paid from abroad. It costs a monthly fee but removes the worry of cancellation.
5. Changing the registered number to a foreign one — usually a dead end
People ask this often. Most Iranian banks will not accept a foreign number for dynamic passwords, because the number has to be tied to your national ID in the operators' systems. Some services are exceptions, but do not count on it.
What needs a dynamic password and what does not
Not everything requires one. If you only want to look at something, you can usually do it without:
- No dynamic password: checking balances and history, viewing bills, seeing your Sahame Edalat portfolio, browsing Iranian sites.
- Dynamic password required: card-to-card, any online payment, buying a top-up, Paya and Satna transfers.
Which means that even if none of the routes above is available to you, an Iran IP still solves half the problem: you can see your account.
The right order to do things
- Connect with Iran IP VPN so you have an Iran IP.
- Open the banking app after connecting. If it was open, close it fully and reopen it.
- Sign in — this step usually needs only your ordinary password.
- For a transaction, take the dynamic password from the in-app generator or wait for the SMS.
If the dynamic password does not arrive, wait a few minutes before retrying — repeated requests sometimes make the bank pause sending altogether.
In short
If you keep one thing from this: enable your bank's in-app password generator before you leave Iran. It takes five minutes and removes most of your banking problems for years afterwards. For everything else, see the guide for your bank: Melli, Mellat, Saderat or Blu Bank.