The inbox is public by design
These sites publish phone numbers and show every incoming message on an open web page. Anyone who opens the page sees the same messages you do, at the same time, including the code that unlocks your new account.
Researchers have measured this. A peer-reviewed study first presented at IEEE Security & Privacy in 2016, and extended in ACM TOPS in 2018, analysed more than 900,000 text messages sent to public online SMS gateways over 28 months. It found services sending sensitive security messages through this unencrypted channel, one-use codes that were easy to guess, and that public gateways are mainly used to evade account rules that require a verified phone number.
Many strangers share one number
A 2023 study of disposable phone numbers monitored 17,141 numbers on 29 public sites for 12 months, covering more than 70 million messages for over 200 services. It concluded that the ecosystem is used worldwide to support fraudulent account creation and access.
For you, it means the account you open shares its phone number with people you don’t know.
Whoever reads the code can take the account
A verification code is a key. The US Federal Trade Commission puts it bluntly: anyone who asks you for your account verification code is a scammer. On a public inbox, nobody even has to ask.
The risk doesn’t end after sign-up. Telegram says whoever has the number has the account, and where a service lets you sign in or recover access with an SMS code, anyone who later reads the same public number can request a new one. LINE goes further: registering a number that is already tied to a LINE account deletes the original account.
Recycled numbers carry old accounts
Even private numbers are reused. Princeton researchers obtained 200 recycled numbers and found that 19 still received security codes meant for previous owners within a week. Public inbox numbers are shared on purpose, so the same problem is built in.
Never use a code or an account that isn’t yours.
SMS shouldn’t stay your only key
The US Cybersecurity and Infrastructure Security Agency (CISA) advises against using SMS as a second factor, because SMS messages are not encrypted. It notes that some services fall back to SMS during account recovery, and recommends turning SMS off for each account once an authenticator is set up.
Whatever number you verify with, free, paid or your own, move the account’s sign-in to an authenticator app or a passkey, plus a recovery email you control, as soon as the account is set up.
How a private one-time number differs, and where it doesn’t
A DualLine one-time number is issued to your order for one attempt, and the code appears only in your DualLine account. It is paid for with credit; if no code arrives, the credit comes back to your balance automatically.
It is still temporary. After the code arrives or the window closes, the number is released and may be used by someone else later, and no service is obliged to accept it. Treat it as a way to complete one verification, then secure the account as described above.
| Question | Free public SMS site | DualLine one-time number |
|---|---|---|
| Who can read the code | Anyone who opens the page | Only you, in your DualLine account |
| Who else uses the number | Many strangers, often at the same time | Issued to your order for this attempt |
| After your attempt | The number and its messages stay public | Released; may be reused later |
| Cost | Free | Shown in the app before you pay |
| If no code arrives | Nothing was paid | Credit returned to your balance automatically |
| Service acceptance | Not guaranteed | Not guaranteed |
Your take-away checklist
- Never use a code from a page anyone can open.
- Don’t sign up for an account you care about with a public number.
- Prefer email, a passkey or an authenticator app where offered.
- After using any temporary number, set up an authenticator or passkey.
- Add a recovery email you control.
- Never use a code or an account that isn’t yours.
Common questions
Can other people really see my code on a free SMS site?
Yes. The inbox is public by design: anyone who opens the page sees the same messages, including your code.
Is a paid temporary number completely safe?
No number you don’t keep is. A private one-time number keeps the code away from others, but the number is released afterwards and may be reused. Secure the account with a passkey, an authenticator app or a recovery email.
Why do some services refuse these numbers?
Studies found that public numbers are mostly used to evade rules that require a verified phone number, and to create accounts fraudulently. Several services, including Viber, LINE and Microsoft, also refuse virtual numbers altogether.
I already used a public number. What now?
Change the account’s phone number to one you control, set up an authenticator app or a passkey, add a recovery email, and check which devices are signed in to the account.
Sources and support
The figures on this page come from peer-reviewed studies and from US government guidance listed below. The comparison with DualLine describes how one-time codes work in the app.
- Reaves et al. — Sending Out an SMS (IEEE S&P 2016)
- Reaves et al. — Characterizing the security of the SMS ecosystem with public gateways (ACM TOPS 2018)
- Moreno et al. — Your Code is 0000: the disposable phone numbers ecosystem (TMA 2023)
- Princeton CITP — Phone number recycling risks
- US FTC — What’s a verification code and why would someone ask me for it?
- US CISA — Mobile Communications Best Practice Guidance
- Telegram FAQ — My phone was stolen
- LINE Help — Creating a new LINE account