Cambridge Study: Disposable SMS Numbers Let Fake Accounts Be Created For Pennies

Researchers at the University of Cambridge have found that a widely used barrier against fake social media accounts—SMS-based phone verification—can be bypassed for just a few cents per number. The study, published in Science, analysed a year of pricing data from four on-demand SMS verification providers and launched a public dashboard that breaks down costs by country and by platform.

Key Findings

The team looked at data from SMSActivate, 5Sim, SMShub and SMSPVA and found that disposable phone numbers for receiving activation texts typically sell for under $0.30 each. In many cases, U.S. numbers were available for about $0.20–$0.30, while numbers tied to Britain, Russia and Indonesia were often priced at $0.10 or less. By contrast, Japan and Australia—where SIM purchases are more tightly regulated and more expensive—were among the priciest sources at roughly $5 and $3 respectively.

Costs also varied by platform. For example, the researchers’ dashboard showed that a U.S. number for activating WhatsApp was about $3, while a U.S. number for activating X (formerly Twitter) was about $0.08. The authors suggest that messaging apps with stronger vetting protocols tend to command higher prices for successful activations.

Method And Validation

The researchers compiled a year of transaction and pricing records from the four providers, then validated those figures in some cases by attempting to create accounts using the disposable numbers. Co-author Jon Roozenbeek, a Cambridge lecturer who studies propaganda, said the team was occasionally blocked but that with at least one provider they "succeeded every time we tried." He summarized the overall finding succinctly: "The costs are absolutely trivial."

"The costs are absolutely trivial," — Jon Roozenbeek, co-author and Cambridge lecturer.

Responses And Context

SMSPVA disputed being described as part of a "gray market," telling the researchers via email that it is "an official, legally operating company fully compliant with all applicable regulations" and that its service is used by testers, marketers and people protecting personal data. SMSActivate, 5Sim and SMShub did not respond to requests for comment.

WhatsApp welcomed the study, describing the industry examined as one that "aims to mislead internet services," and noted that phone verification is only one of many signals it uses—technical and behavioural—to detect fraud. X did not respond to requests for comment.

Implications

The research highlights how inexpensive it can be to scale the creation of throwaway accounts, underlining the importance of platform-level defenses beyond simple SMS checks. Samuel Woolley of the University of Pittsburgh, who reviewed the paper, said the methodology for estimating the cost to bypass SMS verification was sound and emphasized the importance of studying the economics of disinformation: "It makes sense to follow the money."