CBP Adds SMS Text as a Second Two-Factor Option for ACE Portal Login — Register a Mobile Number and the Security Token Can Go to Your Phone Instead of Only Your Email
CBP has deployed SMS text messaging as an additional two-factor authentication channel for trade users logging in to the ACE Portal. Until now the ACE Portal sent its six-digit security token only to the email address on the user account; from this deployment a user can also register a mobile phone number and choose Text Message or Email each time the Identity Verification step appears. CBP's own ACE Development and Deployment Schedule lists the capability as "ACE Portal: SMS for Two-factor Authentication" (CBP-293) with a target deployment of September 2026 and impacts flagged for Trade and PGA users, and CBP's September 2026 ACE Portal Account Types user guide documents it as already live under "Changes in September 2026." Registration is optional — the prompt offers Yes, Ask Me Later, and Not Interested — so nothing breaks for users who stay on email tokens. For Amazon sellers this is a small quality-of-life change with one practical use: it removes the dependency on a shared or slow company inbox at the exact moment you need to get into ACE to check an entry.
Real-World Impact
The practical limit to know is the lockout: CBP's user guide states that three failed attempts to enter the authentication code will log the user out of the system for 15 minutes. If your ACE token currently goes to a shared inbox that nobody watches, that 15-minute penalty is the cost of guessing — registering a mobile number removes the inbox from the path entirely.
Key Points
- CBP's ACE Portal Account Types user guide (Publication No. 5685-0926, September 2026) lists "SMS Text Authentication with Login" under Changes in September 2026: "Trade users can now use SMS text for two-factor authentication when logging in to the ACE Portal"
- Where the prompt appears: after a user initiates a normal login, completes the email authentication, and accepts the terms of use, an Add Phone For SMS Identity Verification dialog box displays
- Three options are offered — Yes (register a mobile phone number and verify it with a passcode), Ask Me Later (be prompted again at the next login), and Not Interested (add a number later via Manage SMS Settings). Registration is optional, not mandatory
- Once a number is registered, the next ACE Portal login shows a Text Message option alongside the Email option for receiving the authentication code
- Manage SMS Settings — reached by selecting the Manage SMS Settings checkbox on the Identity Verification page — lets users add, change, or remove the mobile phone number at any time
- The Country Code drop-down defaults to US (+1) and can be changed, which matters for sellers whose operators sit outside the United States
- CBP's ACE Development and Deployment Schedule (Publication Number 2027-1022, August 2026) lists the capability as "ACE Portal: SMS for Two-factor Authentication" (CBP-293), target deployment September 2026 (subject to change), with impacts marked for Trade and PGA and no EDI impacts; it was added to the schedule in the August 2026 change log
- Customs brokerage newsletter The Carmichael Compass (Issue 26-035, September 9, 2026) reported the implementation date as September 12, 2026 — CBP's own published schedule states only "September 2026," so treat the specific day as broker-reported rather than as a CBP-published date
- This is an authentication-channel addition, not a new access requirement — no ACE account loses access and no EDI or ABI filing process changes
What You Should Do Now
- 1If you hold an ACE Portal login, decide before your next login whether to register a mobile number — the Add Phone For SMS Identity Verification dialog appears right after you accept the terms of use
- 2Register a number that belongs to a person who actually needs ACE access, not a shared line; the token is the second factor protecting your importer account data
- 3If you declined the prompt earlier, use the Manage SMS Settings checkbox on the Identity Verification page to add a number later — you do not have to wait for a new prompt
- 4If someone leaves the business, use Manage SMS Settings > Remove Phone (or Change Phone) so the authentication token does not keep going to a number you no longer control
- 5Separately, confirm your CBP Form 5106 contact data is accurate and belongs to you — CBP began voiding IOR numbers with inaccurate Form 5106 data on September 18, 2026, and that enforcement matters far more than this login change