Your Phone Number Is an Identifier

Treat your mobile number the way you treat your home address. Give it to your bank, your doctor and your family. Keep it off signup forms, contest entries, delivery apps and any site that asks for it before showing you a price. Once a number is in a marketing database, you cannot pull it back out, and it links every record that carries it.

The short answer in four moves

1. Stop giving the personal SIM to services that only want it for signup. Use email where email is accepted.
2. Move account recovery to an authenticator app or passkeys where the service supports it, so losing or changing a number does not lock you out.
3. Keep one secondary number for accounts you want to keep but do not want tied to your SIM.
4. Use a rented number for one-time verification on services you are testing, comparing or using once. MarioSMS rents real mobile numbers starting at $0.04, one verification per number, with the code showing in the app usually within a minute.

Four moves, roughly twenty minutes of setup, and the personal SIM stops appearing in databases you never chose to join.

What a phone number actually identifies

A number is not a login. It is a join key. Data brokers, ad networks and fraud vendors use it to merge records that have nothing else in common: a loyalty card from 2019, a food delivery account, a gym membership, a leaked forum dump. Email addresses change and get aliased. Numbers stay with people for years, survive device changes, and often carry the carrier and rough region with them.

That is also why a breach involving numbers hurts more than a breach of usernames. The number is the thread that ties the other rows together, and it doubles as an SMS OTP destination, which makes it a target for SIM swap attempts. More background on the mechanics is in why protect your phone number.

Three numbers, three jobs

Number	Used for	Where it lives
Personal SIM	Bank, government, employer, family, doctor	Your physical device, never on public forms
Secondary number	Marketplaces, social accounts, long-lived logins you want separated	Second SIM, eSIM or a long-term virtual number
Rented number	One-time signups, price checks, QA and OTP testing	Rented per activation, discarded after the code

The split works because each number carries a different blast radius. A leak of the rented number costs you nothing. A leak of the secondary number costs you a few account migrations. Only the personal SIM is worth defending hard, and it is the one that never touches a signup form.

Why does a phone number work as an identifier at all?

An email address is something you create. A phone number is something assigned to you by a carrier, tied to a SIM, and in many countries tied to an ID document at the point of sale. That combination makes it useful to companies that want to know whether two accounts belong to the same person. The number is scarce, hard to mint in bulk, and it survives most of the changes you make to your online life.

Where a phone number ends up after you type it in

Where you give it	Who keeps it	What it becomes
Loyalty and store sign-ups	The retailer and its marketing platform	A marketing list, often sold on
Contests and giveaways	The organiser and lead brokers	A cold-call list
Free wifi portals	The venue and the wifi provider	Location history tied to a person
App sign-ups	The app and its analytics vendors	A join key across apps
Marketplace listings	Anyone who reads the listing	A public contact point, forever

Mechanisms, not accusations about any one company.

Portability makes the number outlive the carrier

Number portability was designed to stop carriers holding customers hostage. It also removed the last natural expiry date on a phone number. You can change carrier, plan, handset and country of residence and keep the same digits for twenty years. Meanwhile the email you used in 2012 is dead, the username is abandoned, and the address on file is three moves out of date.

An audit you can finish in an evening

Step	Where to look	What to do
1	Password manager, list every account	Note which use SMS for login or recovery
2	The accounts that matter	Move the second factor to an authenticator app
3	Marketplace and classifieds listings	Remove the number from public listings
4	Old shopping and loyalty accounts	Delete the account or clear the number field
5	New sign-ups from now on	Use a rented number where SMS is only a gate

So a number becomes the most stable field in any customer record. When a data broker merges two purchased lists, the number is the join key that produces the fewest false matches. Names collide, emails churn, but a number that has followed you since university links the gym signup, the loyalty card and the forum account into one profile.

Hashed matching and how numbers join databases

Ad platforms rarely trade raw numbers. They normalize a number to E.164 format, hash it, and upload the hash. Two companies that never share plaintext can still discover that hash a3f... appears in both files, which means the same person is in both. Hashing protects the data in transit. It does nothing to stop matching, because matching is the entire point.

Phone numbers make bad hash inputs for privacy purposes. The space of valid numbers in one country is small enough to enumerate, so a hash can be reversed by brute force in a short time on ordinary hardware. Treat a hashed number as a pseudonym, not as anonymity. The guide on reducing what apps know about you covers the upload side of this, where an app reads your contacts and ships hashes of everyone you know.

The spam economics: cost per send versus response rate

SMS spam works because the send cost is a fraction of a cent and the response only has to happen occasionally. A campaign with a very low conversion rate still clears if the list is large and the numbers are valid. That is why validated numbers, ones that answered a call or clicked a link, sell for more than raw scraped lists. Every time you confirm you exist, your entry moves up a tier.

Confirming includes replying STOP to an unsolicited text from an unknown shortcode, answering a robocall, or filling a form to claim a prize. Silence is cheap and effective. The number that never reacts drifts down the list.

SIM swap and why recovery numbers are the target

Attackers do not need your password if the number is the recovery path. A SIM swap moves your number to a SIM the attacker controls, usually through a carrier support agent who accepts a plausible story and a few personal details. Every SMS code then arrives on their device. Accounts that use SMS verification as the sole recovery factor fall in sequence, email first, then everything the email can reset.

Two changes reduce the damage. Move high-value accounts to app-based two-factor authentication or hardware keys, and remove the phone number as a recovery option once the authenticator is working. Add a port-out PIN with your carrier so a support agent cannot move the number on a phone call alone.

Number recycling and the stranger who inherits your account

Disconnected numbers go back into the carrier pool and get reassigned, often within months. The new owner receives your password resets, your bank alerts and your two-factor codes, and can sometimes take over an account by requesting a reset they did not initiate. If you have ever changed numbers and left old accounts pointing at the old digits, someone else can already read those codes today.

How do you audit and clean up the numbers you already gave out?

Set aside two hours this week. The goal is a written list of every account that holds your personal number, a smaller list after you finish, and a carrier account that a stranger cannot move to another SIM.

Step 1 to 4: inventory every account tied to the number

1. Search your email archive for the strings “verification code”, “your code is”, “one-time”, “security code” and “we sent a text”. Sort by date, oldest first. Every sender is an account that once had your number and probably still does.
2. Open the saved passwords list in your browser or password manager and export it to CSV. Most people find 120 to 400 entries. Mark every entry where the login is a phone number rather than an email.
3. Scroll your SMS inbox back as far as it goes. Short codes you do not recognize are usually loyalty programs, delivery apps and old marketplaces. Add each one to the list.
4. Sort the list into three buckets: money and identity (bank, tax, government, email, primary cloud), social and commerce, and disposable (one order, one signup, one trial). Work top down. The third bucket rarely deserves your real number and is the easiest place to switch to a temporary phone number next time.

Step 5 to 8: move recovery off SMS where possible

5. Start with the email account that receives everyone else’s password resets. Add an authenticator app or a hardware key, confirm it works by logging out and back in, then remove the SMS fallback if the service allows it. Some do not, which is a service limitation rather than your mistake.
6. Save the backup codes. Ten codes in a password manager entry, printed once and stored offline. Without them, removing SMS is how people lock themselves out.
7. Repeat for the money bucket. Banks often keep SMS for fraud alerts even after you add an app. Leave alerts on and move the login factor to the app. Read the difference between the two in two-factor authentication.
8. For the social and commerce bucket, check whether the number is a recovery method or a public field. Facebook and similar platforms have separately controlled discoverability settings, so a number can stay on the account while no longer letting strangers search you by it.

Step 9 to 12: carrier lock, PIN and port-out protection

9. Call your carrier or open the account portal and set a port-out PIN or transfer PIN. This is a separate value from your voicemail PIN and your account password. Six digits, random, stored in your password manager.
10. Turn on the carrier’s number lock or port freeze if one exists. It blocks any transfer request until you lift the lock yourself from an authenticated session.
11. Ask what a store employee needs to swap your SIM. If the answer is a name and a date of birth, escalate to a higher security tier on the account, usually called account protection or extra security.
12. Remove your number from the voicemail greeting and from any auto-reply that quotes it. Recorded greetings are readable by anyone who dials.

Step 13 to 15: opt out of directories and people-search sites

13. Search your own number in quotes on two search engines, plus your name and city. Write down every result page that shows the number. Screenshot each one, since removal forms often ask for the exact URL.
14. Submit the opt-out on each site. Most take 3 to 30 days and several will relist after a data refresh, so recheck in 90 days. Some countries give you a legal deletion right that speeds this up, covered in privacy and the law.
15. Finish the disposable bucket from step 4. Delete those accounts outright where you can, and where deletion is not offered, replace the number field with a rented number so the record no longer points at your SIM.

What to use where, once the audit is done

Account type	Number to give	Second factor
Bank, government, employer	Your own line	App-based, with the carrier line as backup
Main email and password manager	Your own line	App-based or a hardware key
Messengers you use daily	Your own line, or a line you keep	App-based where offered
Shops, trials, contests, wifi	A rented number	Not applicable
Marketplace selling	A rented number, or in-app chat	Not applicable

Which services and countries actually make this hard?

Not every signup treats a phone number the same way. Some ask once and never check again. Others tie the number to your login, your recovery path and your device list, and re-verify every time you switch phones. Knowing which is which saves you from putting a rented number where a permanent one belongs.

What can go wrong, and how much it depends on your number

Risk	How the number is used	What reduces it
Spam calls and texts	Sold between marketing lists	Give new forms a rented number
Account linking	The same number joins profiles across services	A different number per throwaway account
SIM swap	Your carrier line is ported by an attacker	App-based 2FA on the accounts that matter
Password reset abuse	SMS recovery is the weakest link	Recovery email plus an authenticator app
Deanonymising	A number in a listing ties to your name	A number you can drop

Service categories: messengers, marketplaces, ride-hailing, banking

Messengers are the strictest group. The number is the account, so a re-verification months later goes to whatever number is on file. If you cannot receive that second code, the account is gone. Rented numbers work for a throwaway messenger account you do not plan to keep, not for a primary one.

A few dollars covers a year of throwaway sign-ups

Marketplaces sit in the middle. Most want a number for buyer contact and listing limits, and they rarely re-check it. Ride-hailing is tighter because the driver needs a working contact at pickup time, so a number you no longer control creates real friction on the trip.

Banking, brokerage and government portals should always use a number you own on a physical SIM. They re-verify on device changes, wire transfers and password resets, and many refuse VoIP numbers outright at signup.

Country rules: SIM registration, number formats, MNP

Country behavior varies more than most people expect. Several markets require ID at SIM purchase, which means your prepaid SIM is already linked to a name in a registry. Others sell prepaid SIMs anonymously at a kiosk.

Number format matters for filters. Some services keep a list of prefixes they treat as virtual and reject them at signup, so a non-VoIP number from a mobile range passes where a landline-format number does not. Mobile number portability also means a number can move between carriers, so the prefix no longer proves which network you are on. Services that rely on prefix lookups get this wrong regularly.

Comparison table: what each service does with your number

Category	Re-verifies later	Number is the login	Rejects VoIP ranges	Rented number fit
Messengers	Often, on device change	Yes	Usually	Throwaway accounts only
Social networks	Sometimes, on suspicious login	No, email or username	Sometimes	Good for a second profile
Marketplaces	Rarely	No	Sometimes	Good
Ride-hailing	On new device	Yes in most apps	Usually	Poor, driver needs contact
Food delivery	Rarely	Sometimes	Sometimes	Fair
Banking and brokerage	Constantly	No, but tied to 2FA	Almost always	Never use one
Dev and API tools	Once at signup	No	Sometimes	Good, ideal for QA

When a landline, VoIP or eSIM is the better fit

Pick by what the account needs over its lifetime, not by what gets you past the first screen.

1. One code, no future re-verification: rent a number for a single activation. MarioSMS prices start at $0.04, the code lands in the app or dashboard usually within a minute, and if nothing arrives before the timer ends the activation cancels and the balance is refunded automatically.
2. A number you will answer calls on for years: a second physical SIM or eSIM. Dual-SIM phones make this cheap, and the number survives app policy changes.
3. A business line with routing, voicemail and multiple agents: a VoIP number, accepting that some signups block those ranges.
4. Long-lived accounts holding money or identity: your primary SIM, with an authenticator app as the second factor instead of SMS.

Keep the rented-number use inside acceptable use, meaning privacy hygiene, second accounts for legitimate reasons and OTP testing. With 35+ countries in stock, the practical question is usually which country’s numbers a given service accepts, not whether a number is available.

What do you do when verification fails or a code never arrives?

Most failed verifications fall into four patterns, and each one has a different fix. Work through them in order instead of retrying the same number three times.

Pick a service and a country: the sign-up never sees your own number

No SMS inside the activation window

Every rented number runs on a timer. The activation starts when you take the number, and if no SMS lands before the timer ends, the activation cancels and the price returns to your balance automatically. Codes usually arrive within a minute, so a blank two minutes in is a signal, not bad luck.

Three things to check before you retry:

1. You pasted the number in full international format, including the country code, with no spaces or leading zero.
2. You picked the right service. A number in stock for one app is not always routed for another.
3. You pressed “send code” on the service after taking the number, not before.

If all three are correct and the timer still runs out, change country on the next attempt rather than repeating the same one.

Code arrives but the service rejects the number

You get the SMS, you enter it, and the form says the number cannot be used. That is a range block, not a delivery problem. Services keep lists of number ranges tied to virtual routes, and some reject VoIP ranges outright while accepting mobile ranges from the same country. Switch to a non-VoIP number or a different country, and treat that service as strict for future signups.

Account asks for re-verification months later

Some services re-check a number long after signup, usually after a login from a new device or IP. A number you rented for one code is gone by then, so the check cannot pass. The fix is upstream: on any account you plan to keep, move the second factor to an authenticator app right after the first login, and keep a recovery code stored offline. If the account already sits behind a number you no longer hold, use email recovery before you trigger the phone check.

Locked out because the old number is gone

Changing carriers or dropping a SIM breaks every account still pointing at that number. Recover in this order:

1. Email-based reset, if the account has a confirmed address.
2. Recovery codes from the authenticator setup.
3. The service’s identity form, which usually takes several days.

Then update the number field on every account you recover, so the same lockout does not repeat next year.

Refunds, timers and how to retry without burning money

The refund on an unused activation is automatic, so a failed attempt costs nothing but time. Numbers start at $0.04 and vary by service and country, which means testing two countries is cheaper than most people expect.

Symptom	Wait before acting	Change on retry
No SMS at all	Let the timer expire	Different country
Code arrives, rejected	Do not retry same range	Non-VoIP range
Service says “too many attempts”	30 to 60 minutes	Same number if still active
Wrong service selected	Cancel immediately	Correct service listing

Keep retries inside acceptable use. If a service is blocking you because of a ban, more numbers is the wrong answer.

How should developers and teams handle OTP testing?

Signup flows that send an SMS are hard to test end to end because the last step happens outside your stack. You can mock the provider and cover the happy path, but the parts that break in production (delivery delay, code format, expiry, resend throttling) only show up when a real message lands on a real handset range. Rented numbers give you that final leg without handing out staff mobiles.

The code arrives in the app, not on your SIM

QA flows that need a real inbound SMS

Four cases justify a real inbound message instead of a mock:

1. First-time signup on a fresh account. Verifies the full path from your API call to the delivered OTP and back into your session logic.
2. Resend and expiry behaviour. Send, wait past your expiry window, then request a new code and confirm the old one is rejected.
3. Carrier and country formatting. A number that renders correctly in E.164 for one country can fail length validation in another. Test with numbers from the countries you actually serve.
4. Two-factor enrolment and recovery. Enrol, then step through the recovery path with a second number.

Everything else (rate limit counters, retry backoff, template rendering) belongs in unit tests with a stubbed provider. Real numbers cost money and take a minute each, so spend them where mocks lie.

Automating with the REST API in Python, Node.js, Go or PHP

The MarioSMS REST API covers the four calls a test harness needs: request a number for a service and country, poll for the code, cancel, and check balance. Examples are published for Python, Node.js, Go and PHP, so wiring it into pytest, Jest, go test or PHPUnit is a matter of a helper function.

A workable shape for a test fixture:

1. Request a number for the target service and country.
2. Feed it into the signup form or API under test.
3. Poll for the code on a 3 to 5 second interval until it arrives or the activation window closes.
4. Assert on the code, finish the flow, release the number.
5. On failure, cancel the activation so the timer does not run down.

Each number handles one verification, so a suite that creates 20 accounts requests 20 numbers. Build that into your fixture teardown rather than reusing a value across tests.

Cost control for a test suite

Numbers start at $0.04 and vary by service and country. If no SMS arrives before the timer expires, the activation cancels and the amount returns to your balance automatically, so failed runs do not silently drain the account.

Practice	Effect on spend
Mock everything except the four real-SMS cases	Cuts number count per run
Nightly full run, mocked SMS on every commit	Real numbers used once a day
Cancel on assertion failure	Refund lands back on balance
Pick the cheapest country your service accepts	Lower per-number price

Team hygiene: shared balance, logs and acceptable use

Top up one shared balance by card or crypto and give CI its own API key so you can tell automated spend from manual QA. Log the service, country and activation ID for every request, not the number itself, and rotate keys when someone leaves. Keep the practice inside acceptable use: QA, OTP testing and legitimate second accounts, never mass account creation against a service that forbids it.

When is a rented number the right tool, and what are the limits?

A rented number solves one problem well: you need to receive a code once, and you do not want that code tied to the SIM you have carried for ten years. It does not solve identity problems, and it should not be used to get around a decision a service already made about you.

What a throwaway sign-up costs

Service	Cheapest country	Price	Numbers in stock
Instagram	Sweden	$0.06	2,675
Facebook	United Kingdom	$0.06	40,448
Tinder	United Kingdom	$0.09	293,933
eBay	Serbia	$0.15	1,105
Amazon	Uzbekistan	$0.02	12,015

Source: MarioSMS catalog, 2026-09-10. Price per number, stock in brackets.

Legitimate cases: privacy hygiene, second accounts, QA

Three patterns cover almost everything worth doing.

Privacy hygiene: a marketplace listing, a food delivery signup, a trial you expect to abandon, a conference wifi portal. These want a number so they can identify you later, and there is no reason to hand them the one your bank uses. More on the reasoning in why protect your phone number.

Second accounts for legitimate reasons: a work account separate from a personal one, a seller profile separate from a buyer profile, a regional account you use while living abroad. The rule is that the service allows more than one account, and you are not pretending to be someone else.

QA and OTP testing: your own signup flow, your own staging environment, your own SMS verification path across countries you actually ship to.

Hard limits: no ban evasion, no impersonation, no fraud

Some uses are off the table, and no provider will help you with them.

• Getting back onto a platform that banned your account.
• Creating accounts in another person’s name, or claiming to be a business you do not run.
• Mass registration against a service whose terms forbid it.
• Anything involving payment fraud, resale of stolen accounts, or harassment.

The acceptable use policy is the short version. Local rules also vary, and privacy and the law covers how that plays out in practice.

Questions to ask any number provider

Ask these before you top up a balance anywhere.

Question	Why it matters
Is the number reused, and after how long?	A number recycled the same hour may already carry someone else’s account
What is stored about each activation?	Message bodies, timestamps and IP addresses have different retention answers
Who else can see the inbox during my window?	One verification at a time is a different model from a shared public inbox
What happens if no SMS arrives?	Refund policy separates a real service from a coin flip
Is the number VoIP or mobile?	Many services reject VoIP numbers outright

If a provider cannot answer the retention question in one sentence, treat that as the answer.

How MarioSMS works: one verification, timer, auto refund

MarioSMS rents a real mobile number for one verification at a time. You pick a service and a country, the number is yours for that single activation, and the code lands in the app or dashboard, usually within a minute.

Every activation runs on a timer. If no SMS arrives before the window closes, the activation cancels and the price returns to your balance automatically, so a silent number costs nothing.

Pricing, coverage and where to run it (iOS, Android, web)

Prices start at $0.04 per number and vary by service and country, since carrier costs are not uniform. Stock covers 35+ countries and hundreds of services.

Run it from the iOS app, the Android app, or app.mariosms.com in a browser. For automated flows there is a REST API with Python, Node.js, Go and PHP examples, and balance top-up works by card or crypto.

Phone number privacy FAQ and a hygiene checklist

Is it legal to use a rented number for signup?

Receiving an SMS on a number you rent is a normal telecom service. What matters is what you do with the account. Privacy hygiene, second accounts for legitimate reasons and QA testing are fine. Evading a ban, impersonating someone or breaking a platform’s terms is not. See /acceptable-use/ and /guides/privacy-and-the-law/.

Can a service tell my number is not a personal SIM?

A service sees the number range and its carrier records. Many risk systems score ranges, and some flag numbers tied to VoIP carriers. MarioSMS rents real mobile numbers, so the routing looks like ordinary mobile traffic. Acceptance still varies by service and by country.

What happens to the number after my verification ends?

The rental covers one verification at a time. Once the activation window closes, the number leaves your session and can go back into the pool for other activations. Treat it as temporary, and never as a recovery contact for an account you plan to keep.

Does a second number protect me from SIM swap?

Partly. A SIM swap targets the number your bank or email uses for recovery. Keeping that primary number off signup forms shrinks the number of places it appears, which shrinks the attacker’s research surface. It does not protect the primary line itself. Carrier-side locks do that.

Should I use an app-based authenticator instead of SMS?

Yes, whenever the service offers it. TOTP codes live on your device and cannot be redirected by a carrier account takeover. Many services still require SMS at signup, so the practical pattern is: verify once by SMS, then switch to an authenticator app under two-factor authentication settings.

What is a port-out PIN and how do I set one?

It is a code your carrier requires before moving your number to another carrier. Set it in the carrier account security settings or by calling support, use digits unrelated to your birthday or address, and store it in a password manager instead of a notes app.

Can I use one rented number for two accounts?

No. Each activation is one number for one verification. For a second account, start a second activation. That separation is the point, since two accounts sharing one number can be linked by the platform later.

Why do prices differ between services and countries?

Prices start at $0.04 per number and vary by service and country. Carrier costs, delivery routes and demand for a given service all differ, so a popular messaging app in one country can cost several times what a quiet service costs elsewhere.

How fast does the code usually arrive?

The code appears in the app or dashboard, usually within a minute. Delivery depends on the sending service and the route, so keep the screen open and avoid requesting a resend in the first 60 seconds.

What if the SMS never comes, am I charged?

No. Every number has a timer. If no SMS arrives before the activation window ends, the activation cancels and the price returns to your balance automatically.

Can I receive calls on a rented number?

The service is for SMS verification. Plan around code delivery by text, and pick a service and country combination that sends SMS rather than a voice call.

Do I need the app, or is the web dashboard enough?

Either works. There are apps for iOS and Android, plus app.mariosms.com in any browser. For scripted flows, the REST API has Python, Node.js, Go and PHP examples.

How do I pay without a card?

Top up the balance with crypto. Card top-up is also available if you prefer it.

Is a burner SIM better than a rented number?

Factor	Burner SIM	Rented number
Setup time	Store visit, ID in many countries	Seconds, in app
Cost per verification	Price of a SIM plus credit	From $0.04
Country choice	Where you are	35+ countries
Failed delivery	Money spent	Refunded to balance
Hardware	Second phone or slot	None

The 12-point phone number hygiene checklist

1. Keep one primary number for bank, email and government accounts only.
2. Set a port-out PIN with your carrier.
3. Turn on an authenticator app wherever it is offered.
4. Remove SMS as a recovery method once TOTP works.
5. Delete your number from old accounts you still use.
6. Close accounts you abandoned rather than leaving the number attached.
7. Turn off contact upload and find-by-phone-number in each app.
8. Use a rented number for newsletters, trials and marketplaces.
9. Start a separate activation for every account.
10. Check the activation timer before requesting a resend.
11. Record which number went to which service.
12. Re-run points 5 through 7 every six months.