Every time an app blocks you for using a virtual number, one fraud scheme is sitting behind the decision. It's called SMS pumping, and once you understand it, the blocks stop looking random.
SMS pumping is when attackers flood a company's "send verification code" button with fake requests aimed at phone numbers they quietly profit from. The business pays the messaging fee. The attacker takes a cut. Run that thousands of times an hour and you've got a fraud that steadily drains real money. It's also the reason free shared numbers, including the ones on SMSS.net, get rejected by WhatsApp, Google, and banks.
What is SMS pumping?
SMS pumping goes by a couple of other names, SMS toll fraud and artificially inflated traffic (AIT). All of them describe an attack on the one-time passcode (OTP) systems businesses use to confirm a phone number. Sending a verification code isn't free. Each message travels through a chain of carriers, and every hop takes a fee. Attackers worked out how to turn that fee into income.
Here's the setup. The fraudster controls, or shares revenue with, a mobile operator that owns premium-rate number ranges. Then they trick a victim's app into firing thousands of OTP messages at those ranges. Nobody types the codes in. Nobody was ever meant to. The prize is the per-message fee, split between the fraudster and the cooperating operator.
What is a premium-rate number?
A premium-rate number costs more to reach than an ordinary call or text, and that surcharge flows back to whoever runs it. Legitimate versions exist, donation lines, paid support desks, weather hotlines. In a pumping attack, the fraudster aims OTP traffic at premium-rate mobile ranges so every delivered message earns them money. Because the abuse clusters in specific, identifiable ranges, apps get an obvious countermeasure: treat whole ranges as suspect.
How an SMS pumping attack works
The attack is cheap, trivial to automate, and needs no real hacking skill, which is why it spread so fast. A typical run:
- Find an open endpoint. The attacker hunts for a signup or login form that sends an SMS code with no rate limits, no CAPTCHA, no fraud checks.
- Script the requests. They feed in thousands of phone numbers from ranges tied to a carrier they profit from.
- The app sends the codes. The victim's system trusts the requests and dispatches a verification SMS to each one.
- The traffic lands on a high-cost carrier. Those messages terminate on the premium-rate ranges the fraudster set up.
- The fraudster gets paid. The cooperating operator shares out the inflated termination fees.
No account gets stolen. No password gets cracked. The business pays purely for sending messages, and the attacker earns on every one. That's what makes it slippery. There's no smoking gun, just a fatter invoice.
Why SMS pumping costs businesses so much
The bill climbs fast because the whole thing runs on autopilot, day and night, at machine speed. Industry estimates put the average loss for an unprotected business at roughly $127,000 a month. A single exposed form can chew through a messaging budget in days. And since the traffic looks identical to normal "send code" requests, plenty of teams don't catch on until the invoice arrives.
Hold onto that number, because it explains everything that follows. Blocking isn't hostility toward privacy tools. It's self-defense. When your OTP system can be turned into a money pump, you have every reason to slam the door on any number that smells like an attacker.
Why apps block virtual numbers
Here's what most explanations tiptoe around. Apps block virtual and VoIP numbers because that's where pumping traffic concentrates, full stop. It isn't a stance against privacy. The ranges fraudsters abuse overlap heavily with the ranges that online-only, virtual, and shared services hand out, so blocking them wholesale is the cheapest, most reliable defense a platform has.
That also explains why strictness varies so wildly from one service to the next. A small forum has almost nothing to lose and might wave through whatever number you give it. A platform pushing millions of codes a day, WhatsApp, Google, OpenAI, a bank, is hugely exposed and blocks hard. Want the mechanics of the codes themselves? See how OTP codes work. The short version: the block you hit is collateral from an anti-fraud rule, not a verdict on you personally.
How apps detect virtual numbers
No platform leans on a single test. They stack signals, score the risk, then decide whether to send a code or reject the number on the spot.
| Signal | What it checks | What it reveals |
|---|---|---|
| HLR lookup | Queries the carrier's Home Location Register in real time | Whether the number is a live SIM on a mobile network, which carrier owns it, and whether it has been ported |
| Number-range / prefix blocking | Matches the number against known VoIP and virtual blocks | That the number came from a range providers hand out for online use |
| Line-type lookup | Classifies the line as mobile, landline, VoIP, or toll-free | That a "mobile" number is actually a virtual or VoIP line |
| Velocity rules | Counts requests per number, IP, and device over time | Automated, high-volume patterns that look like a pumping run |
The HLR lookup does most of the heavy lifting. It asks the mobile network directly whether a number is a real SIM and which carrier it sits on. Anything that resolves to a VoIP gateway or a known virtual provider gets flagged instantly. Layer range blocking and velocity checks on top, and a shared temporary number stands out plainly. Which, of course, is the entire point.
The people caught in the crossfire
Here's the frustrating part. These defenses can't tell a fraudster apart from an ordinary person who just wants some privacy. A range-block treats every number in a range identically, so legitimate temporary number users get swept up right alongside the attackers. You didn't do anything wrong. You drew a number from a range the platform has learned to distrust.
Shared public numbers carry a second limitation on top of the block risk. The inbox is open to everyone, so most services enforce a one-account-per-number reality: once someone registers an app to a given number, the next person usually can't. When a code never arrives, the cause is often that the number was already used, already flagged, or blocked by range. Nothing is broken on your end. For the background on why these numbers are public to begin with, see what a public temporary phone number is.
What this means for your temporary number
Once the fraud economics click, you can predict almost perfectly when a free shared number will work.
It usually works for:
- Low-stakes signups you don't plan to keep
- Testing your own app's SMS flow during development
- Throwaway accounts on forums, deal sites, and smaller apps
- Any verification where losing access later doesn't sting
It usually doesn't work for:
- WhatsApp, which blocks virtual and shared ranges aggressively (the WhatsApp service page has the full breakdown)
- Google, OpenAI/ChatGPT, and other high-value platforms
- Banking, payments, identity checks, or account recovery
One rule I wouldn't bend: never use a public shared number for anything touching money, identity, or an account you can't afford to lose. The inbox is public. The number isn't private. The range could go dark tomorrow. Match the tool to the job and you'll rarely regret it. Throwaway verifications, fine. Anything you'd hate to lose, no. If you're curious where these numbers actually earn their keep, the legitimate use cases guide is worth a read.
Strip the jargon away and SMS pumping is a billing exploit that honest people pay for in blocked signups. Learning the economics won't talk WhatsApp into trusting your number, but it turns every rejection from a mystery into something you can predict. And if the thing you're verifying really is low-stakes, the kind of throwaway these numbers were built for, the country list shows what's currently live.
Frequently asked questions
Why do companies care what number I use?
Because sending SMS verification codes costs them money, and fraud schemes like SMS pumping can turn that cost into a machine-speed money drain. Industry estimates put the average loss for an unprotected business at around $127,000 per month. To defend against it, platforms scrutinize the phone number you provide and reject the ranges most abused by attackers.
How do apps detect virtual numbers?
They stack several signals rather than relying on one test. An HLR lookup queries the mobile network to confirm whether a number is a real SIM and which carrier owns it, while range and line-type checks flag numbers from known VoIP or virtual blocks. Velocity rules add another layer by watching for the high-volume request patterns typical of automated fraud.
What is a premium-rate number?
A premium-rate number costs more than a normal call or text to reach, with the extra fee paid back to whoever operates it. In SMS pumping, attackers route OTP traffic to premium-rate mobile ranges so that every delivered message earns them a share of the fee. That revenue share is the entire motive behind the attack.
Is SMS pumping the same as smishing?
No. Smishing is a phishing attack that sends you a deceptive text to steal information or money from you directly. SMS pumping targets the business, not the recipient — it abuses a company's own send-a-code feature to generate inflated messaging fees. The codes in a pumping attack are never even read.
Does SMS pumping mean my temporary number is unsafe to use?
Not unsafe, just limited. SMS pumping is why virtual and shared ranges get blocked by strict platforms, so a free shared number often will not work for WhatsApp, Google, banks, or account recovery. It remains fine for low-stakes signups and testing, as long as the account is not something you need to keep.
Try it yourself
Receive an SMS code on a free public number in seconds — no sign-up required.