SMS Verification Easily Bypassed for Pennies, Increasing Risk of Online Disinformation

Social media’s primary defense against fake accounts can be circumvented for mere pennies, according to groundbreaking research from the University of Cambridge that exposes alarming vulnerabilities in digital identity verification systems.

The study, published in the prestigious journal Science, reveals that SMS verification—widely considered a fundamental safeguard against fraudulent accounts—can be easily bypassed using inexpensive disposable phone numbers available through various online services.

Researchers analyzed a year’s worth of data from four major SMS activation services: SMSActivate, 5Sim, SMShub, and SMSPVA. These platforms offer temporary phone numbers specifically designed to receive verification text messages, with prices as low as a few cents per number.

“The costs are absolutely trivial,” explained Jon Roozenbeek, a Cambridge lecturer and co-author of the study. His team found that creating fake accounts across multiple platforms costs significantly less than most people would expect, with U.S. phone numbers available for just 20 to 30 cents each.

To validate their findings, the researchers conducted practical tests, successfully creating accounts using these disposable numbers. In some cases, account creation was successful 100% of the time, demonstrating the reliability of these verification bypass methods.

The investigation uncovered significant price variations based on geography and platform requirements. While U.S. numbers typically cost 20-30 cents, British, Russian, and Indonesian numbers were even cheaper—available for 10 cents or less. Conversely, countries with stricter telecommunications regulations, such as Japan and Australia, commanded higher prices of approximately $5 and $3 per number, respectively.

Platform-specific differences were also notable. A U.S. phone number for WhatsApp verification cost around $3, while the same number for X (formerly Twitter) was available for just eight cents. Roozenbeek attributed this disparity to varying levels of security scrutiny, with direct messaging platforms like WhatsApp implementing more rigorous verification systems compared to other social media services.

When contacted for comment, WhatsApp acknowledged the challenges posed by these verification bypass services but emphasized that phone verification is just one component of their multi-layered security approach. “We also rely on a variety of technical and behavioral signals to detect and prevent fraudulent activity,” a company representative stated. X did not respond to requests for comment.

SMSPVA, one of the services analyzed in the study, disputed being characterized as a “gray market” operator. The company asserted it operates legally, serving marketers, software testers, and privacy-conscious individuals. The other three services did not respond to inquiries.

Samuel Woolley, a University of Pittsburgh academic who reviewed the paper, emphasized the significance of the findings, noting that SMS verification remains a “central standard for vetting” online accounts across the digital landscape. “It makes sense to follow the money,” Woolley commented, highlighting how the study effectively exposes the economic dynamics fueling disinformation campaigns.

The research provides critical insights into how easily digital manipulation campaigns can be orchestrated at scale. With minimal financial barriers to creating numerous fake accounts, bad actors can potentially launch coordinated disinformation efforts or manipulate online discourse with limited resources.

This revelation comes at a time when social media platforms face mounting pressure to combat false information and artificial amplification of content. The study suggests that current verification methods may be insufficient against determined actors with even modest financial resources, raising important questions about the effectiveness of existing safeguards in maintaining digital platform integrity.