Full Breakdown
Low-Cost Bypass of SMS Verification Undermines Online Account Security
12/12/2025, 2:03:50 AM
Overview of the Findings
Researchers from the University of Cambridge have revealed that a significant barrier to the creation of fake social media accounts can be circumvented for as little as 30 cents. This finding highlights the vulnerabilities in digital platforms' defenses against online disinformation. The study, published in the journal *Science*, indicates that SMS verification, which is intended to link accounts to genuine phone numbers, can be easily bypassed using throwaway phone number services.
Mechanism of Bypass
The researchers analyzed data from four SMS activation service providers—SMSActivate, 5Sim, SMShub, and SMSPVA—over a year. They discovered that these services offer disposable phone numbers at minimal costs, with prices varying by country. For instance, acquiring a U.S. number for use on WhatsApp costs about $3, while a number for X (formerly Twitter) costs just 8 cents. In contrast, countries like Japan and Australia, where regulations are stricter and SIM cards are more expensive, see costs around $5 and $3, respectively.
Implications for Online Security
Jon Roozenbeek, a co-author of the study, emphasized the trivial costs associated with bypassing SMS verification, stating, "The costs are absolutely trivial." While the use of throwaway numbers does not guarantee that accounts will remain active indefinitely, the researchers successfully created accounts on various platforms using these numbers, demonstrating the effectiveness of this method.
Samuel Woolley, an academic at the University of Pittsburgh and reviewer of the paper, noted that SMS verification is a "central standard for vetting" online accounts. He advocated for increased focus on the economic aspects of disinformation, suggesting that understanding the financial incentives behind these practices is crucial.
Industry Responses
WhatsApp responded positively to the research, acknowledging the importance of addressing the issue of misleading internet services. The company stated that, in addition to phone number verification, it employs various "technical and behavioral signals" to monitor user activity and combat fraud. Conversely, X did not provide any comments regarding the findings.
Criticism of the Research
While the study sheds light on the vulnerabilities of SMS verification, SMSPVA contested the researchers' characterization of its services as part of a "gray market," asserting that it operates legally and complies with regulations. The other providers did not respond to requests for comment, leaving some aspects of the research unchallenged.
Conclusion
The findings from the University of Cambridge underscore the ease with which online disinformation efforts can be facilitated through low-cost services that bypass traditional verification methods. This raises significant concerns about the effectiveness of current security measures employed by digital platforms and highlights the need for more robust solutions to combat the proliferation of fake accounts.
