How to receive SMS verification codes online — safely

Sooner or later, an app or website asks for your phone number “to verify it's you”. If you'd rather not hand over your personal number, the internet is full of sites promising free numbers to receive SMS online. They work — sometimes. But they come with a risk most people don't see until it's too late.

This guide explains how verification codes actually work, why free public numbers are a bad idea, and how to receive codes online safely.

How SMS verification codes work

A verification code — also called a one-time password or OTP — is a short number, usually 4 to 8 digits, sent by text message to prove that you control a phone number. Services use them for three reasons:

• To fight abuse: phone numbers are harder to create in bulk than email addresses, so asking for one slows down spam accounts.
• To recover your account: if you forget your password, a code sent to your number lets you back in.
• As a second factor: some services send a code each time you sign in from a new device.

The last two points matter: the number you give isn't just used once. It becomes a key to your account for as long as the account exists.

The problem with free “receive SMS online” sites

Free SMS sites publish a list of phone numbers and display every message those numbers receive — on a public web page. That's the whole model, and it's why they're dangerous:

• Everyone sees your code. Anyone browsing the page at the same moment can read it, and anyone can later ask for a password reset to the same number.
• The number isn't yours. Hundreds of people use the same numbers. When you need a new code next month, the number may be gone.
• They're often blocked. Popular services keep lists of public numbers and simply refuse them.

Why some numbers get rejected

When you enter a phone number, many services run a quick “line type” lookup that tells them whether it's a mobile, a landline or an internet (VoIP) number, and which carrier it belongs to. Depending on their rules, they may refuse:

• landlines, which can't receive text messages;
• numbers known to belong to public SMS sites;
• some internet numbers handed out by free calling apps.

That's why the kind of number matters as much as having one. Numbers from a country's real mobile ranges are accepted by the widest range of services.

The safe way: a private number you control

What you actually want is simple: a number that's yours alone, that apps recognise as a mobile number, that you can read from any device, and that you can keep for as long as you keep the account. That's exactly what a private second number gives you.

With HeyNum, for example, every number comes from a real mobile range in one of 19 countries. Codes arrive in a private inbox in your browser, in real time, and nobody else can see them. You don't need an app, a SIM card or an ID document to get one.

Step by step: receiving a code with HeyNum

1. Get a number in the country the service expects — US and UK numbers work with the widest range of global apps.
2. Enter it on the app or website, in international format if you're asked for a country (for example +44 7700 900412).
3. The code appears in your inbox within seconds, with a notification if you've allowed them. Copy it in one click.

When a code doesn't arrive

• Check the format. A missing or extra digit, or the wrong country code, is the most common cause.
• Wait a minute, then resend. Some services queue their messages.
• Ask for a call instead. Many services offer to read the code out loud in a phone call — which you can answer in your browser.
• Short codes. Messages sent from 5–6 digit “short codes”, mostly used in the US, may not reach online numbers.
• Service rules. Some banks and payment apps only accept numbers from traditional carriers. If a service refuses your number, it's their policy, not a fault on your line.

Keep your accounts safe

• Keep the number while you keep the account. If you cancel it, you lose the ability to receive codes for that account.
• Prefer an authenticator app or a passkey for your email, your bank and your work accounts. They're safer than any SMS.
• Never share a code. No genuine buyer, delivery driver or support agent will ever ask you for one. Anyone who does is trying to take over an account.

Written by the HeyNum team. We build HeyNum, a service that gives you a real mobile number in your browser. We write about privacy, second numbers and staying reachable — and we're upfront when we mention our own product.