Are free receive-SMS sites safe?

What the free sites say about themselves

The sites are open about it. They list shared numbers, and each number has an inbox page that shows every text it receives to whoever opens it. Their own warnings, read on the date at the foot of this page:

• quackr, which also sells private numbers, labels its free ones “Public numbers anyone can read. Fine for a quick test.”
• receivesms.co: “Messages to public numbers are not private.” It advises a private number for long-term or sensitive accounts.
• freephonenum.com tells visitors that every text received is public and to be careful with sensitive information.
• receive-sms-online.info calls itself a public site and masks texts from social networks with ### “for security reasons”, which leaves texts from every other sender in view.

None of this is hidden: the sites do what they say. The risk is in what the public page lets other people do with your texts.

How an account gets taken over through a public number

Once you verify an account with a number, the app treats a text to that number as proof that you are you. On a public number, that proof is available to everyone. Two things follow.

• Password resets. Many apps let you reset a password with a code sent by text. A stranger who knows or guesses your username or email can start a reset, then read the reset code on the public page. The app sees a correct code and hands over the account.
• Codes you never used. Texts stay on these pages after they arrive. A code you requested and didn’t use can still be read, and the text usually names the app it came from, which tells a stranger where the number is in use.

Researchers at the University of Florida described both in a 2016 study of public SMS gateways. They collected nearly 400,000 texts sent to public numbers over 14 months and found password-reset messages that, with the account’s username, would let someone take complete control of it. They also noted that because messages may stay readable for weeks or months, an unclaimed code could be used by anyone able to work out which account it belongs to. Their data is from 2014 to 2016 and names no site in use today; the mechanism hasn’t changed.

If you already used a free number for an account you care about

Move the account off the public number while you can still sign in.

1. Sign in and open the account’s security settings

   Look for “phone number”, “recovery phone” and “two-step verification”. Some apps keep these separately.

2. Add a way to sign in that nobody else can read

   An authenticator app or a passkey is best. Add a recovery email you control. See why a text is the weakest second step.

3. Replace or remove the public number

   Put in a number you own or rent privately, or remove the number if the app allows it.

4. Change the password

   If a reset code could have been read, assume the old password is not safe either.

Why free numbers often don’t work on popular apps

A public number is shared with everyone who visits the site, so by the time you find it, others have usually tried it on the same apps. Several apps say in their help pages that one number can verify only a few accounts, and many refuse numbers whose line type looks like VoIP; this table lists what each app says. quackr says its free list mixes VoIP and non-VoIP numbers and that some services block VoIP.

The 2016 study found the same pattern from the other side: public gateways were mainly used to get around sign-up rules that ask for a verified phone number, and the numbers didn’t last. Their median life was 20 days, and only a quarter were still in use after a month. quackr says its free numbers rotate at least every 30 days. A number that disappears from the list is a number you can no longer use to get back into your account.

What a private number changes, and what it doesn’t

A private number fixes the problem on this page: its texts go only to you, so nobody else can read your codes or use the number to reset your password while you have it. Ours is a non-VoIP US number, rented from 1 day for $3.99 to 1 year for $34.99; the help page covers how it works.

It doesn’t fix everything.

• It still ends. A rented number is yours only for the time you pay for. Afterwards it can be given to someone else, who would receive any code the app sends. Read what happens when a number ends before you use one for an account you’ll keep.
• An app can still refuse it. Apps also turn numbers away for reasons other than line type. No number is accepted everywhere.
• It only receives. It can’t reply to a text or take a code read out by voice call.

Questions people ask

Can anyone see my code on a free number?

Yes. Free receive-SMS sites show every text sent to a listed number on a public web page, and anyone can open that page without signing in. The sites say so themselves.

Are free receive-SMS sites scams?

The ones we read do what they say: they show texts to shared numbers on a public page, and they warn that the texts are not private. The danger is not that the site cheats you but that everyone else can read what arrives.

Is it safe to use a free number to sign up for something once?

It is reasonable for a sign-up you would not mind losing, such as trying an app with nothing of yours in it. Assume anyone can take the account over, and don’t save payment details, messages or files in it.

Why didn’t my code arrive on a free number?

Usually the app refused the number before sending anything: it has been used on too many accounts, or the app blocks its line type. Asking again on the same public number won’t change either.

Can I get my account back if a free number was used to take it over?

Use the app’s account recovery and choose a route that doesn’t go through that number, such as your email address. Once you are back in, replace the number and add an authenticator app or passkey.