If a user at your firm can't log in because their multi-factor authentication (MFA) text message never arrives, the cause is usually a temporary block applied by our SMS authentication provider — not a problem with the user's phone or their Performance Leader account. This guide explains how to confirm that's the issue you're facing, why it happens, and how to restore the user's access straight away by temporarily disabling MFA in the User Manager.
Confirm this is the issue you're facing
This guide applies when all of the following are true:
The user enters their login details correctly but never receives the SMS verification code, or codes arrive in a delayed batch (e.g. 30 minutes later) and are rejected.
An error message on the login screen indicates the phone number or destination has been blocked.
Other users can log in normally — typically only one or two people at the firm are affected.
The user has a good mobile signal and can receive other text messages.
If several users are affected at once, or nobody at your firm can log in, contact CX or Support instead.
Why this happens
Performance Leader sends MFA codes through an industry-standard SMS authentication provider which protects all of its customers from a type of attack called SMS pumping fraud. Fraudsters use automated scripts to trigger thousands of verification messages across a range of phone numbers, so the provider's fraud protection sometimes blocks an entire range or prefix of numbers when it detects suspicious activity nearby.
Occasionally a legitimate number falls inside a blocked range and is caught as a false positive. When that happens:
The block sits with the authentication provider, not with Performance Leader or the user's mobile network — we are unable to remove it directly.
The block is temporary. It lifts automatically once the provider detects no further suspicious activity, typically within about 12 hours.
Nothing is wrong with the user's account, and their data is unaffected.
Restore access: temporarily disable MFA
Whilst you wait for the block to lift, you can restore the user's access immediately by temporarily disabling the MFA requirement on their account. This takes less than two minutes.
Important: Only super admins and restricted admins can edit user accounts.
Go to the Admin tab and open the User Manager.
Find the affected user (search by name if needed).
Click the pencil icon to edit their account.
Select the option to disable or reset MFA, then save.
Ask the user to log in again — they should now get in without an SMS code.
Once the user is back in
The block normally lifts within about 12 hours. After that window:
Ask the user to re-enable MFA on their account and re-register their phone number, so their account is fully secured again.
Double-check the registered number is a mobile number. SMS codes can only be delivered to mobiles — if a landline or office number was entered, the code will never arrive even after the block lifts.
If codes still don't arrive after 24 hours, contact the support@performanceleader.com with the user's name, their phone number, and a screenshot of the error message.