Receive SMS online: who reads the code and who refuses it

How these sites work

A receive-SMS site publishes a list of phone numbers, and the texts that arrive on a number are shown on a web page. receive-smss.com describes the steps as choosing a number and a country, entering it where a registration asks for a phone number, waiting for the response to appear on its site, and pressing a button labelled Update Latest SMS if it does not. It says a message may take 2-180 seconds. instant-sms.com says “most codes land” in the inbox “within 10-30 seconds” and that the inbox refreshes by itself.

Both describe the numbers as short-lived. receive-smss.com says every number it displays becomes inactive after some time and that new ones are added daily. instant-sms.com says public numbers are shared and may be recycled when inactive. VeePN, a VPN vendor with a page of its own on the subject, answers the question of how long a temporary number stays active by saying it depends on the provider and that a disposable number is usually active for minutes or a few hours.

The number-site pages we read do not use the word VoIP; instant-sms.com calls what it offers a short-term virtual phone line. Twilio’s documentation for its Lookup service separates two kinds of virtual number. A fixed VoIP number is a virtual number associated with a physical device, with Comcast and Vonage as its examples. A non-fixed VoIP number is a virtual number obtained online without a physical device, with Google Voice and Enflick as examples. The pages we read do not say which kind any listed free number is. The difference matters in a later section, because the second kind is the one Twilio says its customers usually filter out.

Who else reads the code

instant-sms.com says every inbox on its site is public and shared: anyone viewing the same number can read the messages that arrive on it. It gives that as the reason to read a code immediately, and says the numbers on its grid cost nothing while paid plans exist for a private dedicated number.

The receive-smss.com text reads differently. It says the service is accessible to anyone worldwide and that it does not retain messages longer than 24 hours, and it lists the services the numbers can be used for. It does not use the word public, and the text we read does not say who can open a number’s inbox. Of the two pages, instant-sms.com is the one that spells the sharing out.

A 2019 paper by Berenjestanaki, Conti and Gangwal of the University of Padua, whose abstract we read, collected over 900K unique SMS messages received “upon request of other users” on 18 SMS receiving websites. The abstract reports that 82.34% of the messages included a one-time password and that 52.47% of the verification codes were six characters long. It also says accounts for several messaging and social networking apps were created and verified using these services. We read only the abstract, and the paper is from 2019, so it describes the sites as they were then and not as they work now.

Put together: instant-sms.com says a code on its numbers is visible to whoever opens the same number, and its own advice follows from that: low-risk, one-time verifications only.

Why the code often does not arrive

instant-sms.com says success varies by app and by number: apps that send one-time passwords by SMS can accept temporary numbers, but some platforms, especially high-security services, block shared or virtual lines. It says delivery is not guaranteed because upstream services filter disposable numbers, and that a service rejecting virtual numbers is a platform restriction the site cannot override. The pages we read do not give a count of the apps that refuse such numbers or a list of them, beyond the examples below.

WhatsApp has two help pages that apply, one for the standard app and one for WhatsApp Business. Both say a number must be one you own and must be able to receive SMS or calls. Both list VoIP among unsupported numbers, together with toll-free, paid premium and universal access numbers. The Business page adds personal numbers and says unsupported numbers cannot be registered; the standard-app page adds landlines, which it says only WhatsApp Business supports. The number sites describe WhatsApp differently. instant-sms.com says you can try a temp number but WhatsApp may block shared virtual lines, receive-smss.com names WhatsApp among the services its numbers are usable for, and VeePN says it sometimes works, depending on whether WhatsApp accepts that specific number, with a number already blocked or used too many times by other users possibly not delivering the code.

Twilio, a company that sells verification services, gives a developer’s view. Its blog post on filtering VoIP before an OTP says VoIP numbers are often correlated with bots and lack the same assurance of a real and unique user. It says a fixed VoIP number needs a physical address, so it is generally tied to a specific user or company and a developer may decide not to filter it, while a non-fixed VoIP number, the kind Google Voice or Twilio allocates programmatically, is the type its customers usually filter out. Its example check refuses a non-fixed VoIP number before a code is sent.

NIST’s guidelines changed on VoIP. Version 3 of SP 800-63B, which its page says was superseded by version 4 as of 1 August 2025, said methods that do not prove possession of a specific device, such as VoIP or email, shall not be used for out-of-band authentication. The changelog for revision 4 lists the removal of the prohibition on the use of VoIP phone numbers for that purpose. These are rules for services that verify people, and the NIST pages we read do not mention the free-number sites.

What the sites say it is for, and what it is not for

instant-sms.com says to use a temporary number for a low-risk, one-time check such as an app trial, a marketplace sign-up or a privacy-conscious test, without sharing your personal line. It names trying new apps, confirming a shopping account and automated onboarding tests through its API as legitimate uses. It says never to use these numbers for banking, cryptocurrency, government services, healthcare or personal account recovery, and not to use the service for spam, fraud, impersonation or anything that breaks an app’s terms of service or the law.

receive-smss.com lists Gmail, Facebook, WhatsApp and Tinder among the services its numbers are usable for, with social media platforms, chat apps, dating apps and email services in a longer list. It gives its advantages as avoiding sales calls and texts and keeping your number from being associated with every digital account you create. The text we read does not mention banking or account recovery. Of the two, instant-sms.com sets the limits in words, while the receive-smss.com text lists uses.

Read side by side, instant-sms.com says the inbox is shared and puts accounts you might want back out of bounds, while receive-smss.com describes the same kind of service as a way to keep a personal number private. For how a text code behaves on an account you own, see codes by text message.

When the code is the real lock

NIST’s SP 800-63B-4 says the use of the public switched telephone network for out-of-band authentication, meaning a code sent by SMS or voice, is restricted. At the time of publication, it says, that is the one restricted authenticator, a less secure approach that remains necessary for some government-to-public applications. It says services must make alternative authenticator types available to all subscribers, and should consider risk indicators such as a device swap, a SIM change or number porting before using the telephone network to deliver a code.

Two United States agencies describe what those risk indicators look like. The FTC, in a consumer alert of 23 October 2019, says that in a SIM card swap the scammer who controls your number gets the text messages, including the verification codes needed to log in to accounts that use text messages as a second factor. It says text message verification may not stop a SIM card swap, and advises an authentication app or a security key for accounts with sensitive information, plus a PIN or password on the cellular account. The FCC describes the port-out version, in which the number is moved to the scammer’s device and used to try to reset the credentials of financial and social media accounts, and advises a PIN or password with the phone company (page updated 4 March 2025). The carrier steps and the first signs of a swap are on SIM swap and codes by text message, which already cover the FTC, FCC and NIST material in full, so this page keeps only what bears on public receiving sites.

Those are cases of a number taken from its owner by fraud. On a public receiving site, instant-sms.com says every inbox is public and shared, so the number is not one person’s. The FTC and FCC pages do not mention the free-number sites. Trend Micro’s report of 15 February 2022 is about a third thing, SMS PVA services, which sell verification codes so accounts can be opened in bulk. It says at least one operator built its service on a botnet of thousands of infected Android phones that receive and report codes without the owners’ knowledge, and that government portals and financial services often enforce one account per person with SMS confirmation alone. It points to the inadequacy and insufficiency of one-time SMS verification as the primary means of validating an account. The report is about paid services, and we use it as context, not as a description of the free sites.

What the sources say, in four lines. The second and third are advice for a code that guards something; the first and the fourth are context, not advice for a guarded account:

• WhatsApp says a registration code confirms that you own the number, and that it comes by SMS or phone call. Its WhatsApp Business help page adds: “Never share your 6-digit registration code with anyone.” instant-sms.com says its inboxes are public, so a code sent to one of those numbers is visible to whoever opens the same number.
• The FTC advises an authentication app or a security key where text verification may not be enough.
• The FTC and the FCC both advise a PIN or password on the phone account; the FCC adds email and text notifications.
• instant-sms.com says a private number plan may work better for messaging apps, and sells one; the pages we read do not compare it with a number of your own. For what a SIM swap looks like when it happens, see SIM swap.

What we did not use

We tested no number and name none, and we did not check whether any listed number works today. The four questions at the foot of this page come from the question-and-answer blocks on instant-sms.com and veepn.com. Both are sellers, so we use them only for what they say about their own products. The pages we read give no count of the apps that refuse these numbers, and the receive-smss.com text does not say who can open an inbox. None of them says what happens to an account if its number is recycled and passes to another user: instant-sms.com says only that public numbers may be recycled when inactive. We read only the abstract of the 2019 study, so this page has no figures on how the sites are used today. The NIST, FTC and FCC pages we read do not mention the free-number sites.