Temporary phone numbers for receiving SMS: how they work, what the risks are, and which legitimate alternatives exist

A temporary phone number is a number other than your personal line that you use briefly to receive a text message, almost always a verification code. The free ones you find through search engines are public: anyone can read the messages that arrive, including your code, and with it someone else can take over the account you just created. If the service matters to you, use a second SIM or eSIM, a paid virtual number that only you control, or verify by email when the site allows it.

What is a temporary or virtual phone number?

A virtual number is a phone number that doesn't depend on a SIM card in your pocket: it lives on a server, and messages show up on a website or in an app. It's called "temporary" because it's used once or for a short period. In practice there are three types:

• Free public numbers: a website publishes a list of numbers and shows every SMS they receive on an open page.
• Paid virtual numbers: an app or an internet phone provider assigns you a private number for as long as you pay for the subscription.
• Secondary mobile lines: a prepaid SIM or an additional eSIM from a carrier, which works like any other line.

How do public "receive SMS online" sites work?

They work like an inbox in plain view. The site has a handful of numbers, displays them on its page, and publishes every incoming SMS with the sender, time, and full text. There's no username or password: anyone who opens the page sees exactly what you see. The numbers are shared among thousands of visitors and recycled, so many services have already flagged them and the message never even arrives.

According to a University of Florida study presented at the IEEE Symposium on Security and Privacy (2016), researchers collected 386,327 messages sent to more than 400 public numbers in 28 countries over 14 months. They found services sending sensitive information by SMS in plain text, such as passwords and card numbers, and concluded that these sites were mainly used to get around sign-up rules that require a verified phone number.

Why is using a public number risky?

The main risk is that your code is published and someone else can use it. If that number can also be used to log in or recover the account, anyone who visits the page can request a new code, read it, and get in. On top of that:

• You lose access going forward. If the site asks you to verify the number again in a few months, you no longer control it.
• You're exposed alongside everyone else. The message list reveals which services were registered with that number, which makes targeted attacks easier.
• Your account may get blocked. Many platforms treat these numbers as a sign of abuse and suspend the accounts tied to them.

At most, they're good for something you don't mind losing and that contains no personal data.

Why do so many services block virtual or VoIP numbers?

Because SMS is used as proof that there's a person with a physical phone behind the account, and a virtual number doesn't prove that. There are lookup services that tell whether a number is mobile, landline, or VoIP, and many sites use them to reject non-mobile numbers at sign-up.

The U.S. NIST digital identity guidelines, in the 2017 version of SP 800-63B, put it in writing: methods that don't prove possession of a specific device, such as VoIP or email, shall not be used for out-of-band authentication, and the verifier should confirm that the phone number is associated with a physical device.

If a service rejects your virtual number, don't try to get around it with a number from a public site: that's exactly what the rule is meant to prevent, and it usually violates the terms. Use one of the alternatives in the next section.

What legitimate alternatives do you have?

The most solid alternative is a second real mobile line that only you control. These are the reasonable options:

• Second SIM or eSIM: many phones support two lines at once. A prepaid line gives you a real, private mobile number that you keep as long as you keep it active under your carrier's rules.
• Paid virtual number: several apps and carriers offer private numbers by subscription. Only you see the messages, although some services still reject them because they're VoIP.
• Email verification: on some sites the phone number is optional, or you can choose email as the verification method. Check the options before giving out a number.
• Non-SMS second factor: if the service offers an authenticator app, a security key, or a passkey, use it. They're more secure than SMS and don't expose your number.

Keep in mind that in some countries prepaid lines are registered in the owner's name. A second SIM gives you privacy from the sites you sign up for, not from your carrier.

Comparison of options for receiving a code

When is a temporary email enough instead of a phone number?

It's enough when the site only asks you to confirm an email, which is common for forums, downloads, newsletters, coupons, or app trials. You don't need a number there: a temporary email receives the link or code and your personal inbox stays clean. If the idea is new to you, start with what a temporary email is and when to use one.

With Mawlio you get an address that lasts 1 hour, and you can extend it with credits. Verification codes are highlighted so you can copy them with one tap, and your inbox is tied to your account, not published on an open page. Mawlio doesn't offer phone numbers or receive SMS. You'll find the step-by-step in how to receive verification codes without giving out your personal email.

An honest warning: a temporary email isn't right for accounts you'll need to recover either. Once the address expires it can be assigned to someone else, and a "reset your password" email could end up with them. For banking, work, government services, or shopping, use your regular email.

Is it legal to use a temporary phone number?

In general, having a virtual number or a second line is legal; what matters is what you use it for. Creating accounts in bulk, evading a ban, or repeating a free trial with another number usually violates the service's terms, and if it involves fraud or identity theft it can be a crime. If you want to try a service without cluttering your inbox, read how to sign up for free trials without spam, and if you're worried about how much you reveal when creating accounts, see what signing up anonymously does and doesn't protect.

Frequently asked questions

Are free numbers for receiving SMS safe?

No. Messages are published on an open page, so anyone can read your code and use it to log in or recover the account. On top of that, the numbers are shared and recycled, so you lose access as soon as the site asks for verification again.

Can I use a temporary phone number for a messaging app?

It's not a good idea. Your account is tied to that number; if it's public, anyone can request the code and register your account on another phone, and if it's virtual, the app may not accept it. For messaging, use a line you control, such as a second SIM or an eSIM.

Is a paid virtual number the same as a public one?

No. A paid virtual number is private: only you see the messages, and you keep it as long as you keep the subscription. Its limitation is that some services reject VoIP numbers at sign-up.

Does Mawlio offer temporary phone numbers?

No. Mawlio is a temporary email service and doesn't offer phone numbers or receive SMS. It's for sign-ups that verify by email, which covers most forums, newsletters, and app trials.

If what you need is to confirm an email without giving out yours, get a free address from Mawlio, no sign-up required, and have it ready in seconds.

Sources

• Reaves et al., University of Florida, "Sending out an SMS: Characterizing the Security of the SMS Ecosystem with Public Gateways", IEEE Symposium on Security and Privacy (2016)
• NIST, SP 800-63B Digital Identity Guidelines: Authentication and Lifecycle Management (2017)