How Public SMS Numbers Undermine OTP Verification

Executive Summary

Digital onboarding flows have historically relied heavily on SMS one-time passwords (OTPs) for possession-based checks. However, OTP verification merely confirms access to a communication endpoint at a specific moment in time; it does not, by itself, prove that the party controlling that endpoint is the claimed identity. The rise of publicly available, web-hosted phone numbers creates a critical vulnerability in this model. Fraudsters leverage these public SMS gateways to pass basic possession checks, enabling synthetic identity creation and widespread promotion abuse. 

In this blog, Prove’s Fraud Strategy and Data Science teams provide an analysis of research into repositories of public numbers to demonstrate how integrating multi-layered risk signals with a comprehensive fraud policy helps close key detection gaps during digital onboarding.

The Hidden Risk of Public SMS Numbers

Many enterprises rely on SMS possession checks as a primary trust signal during onboarding. However, temporary and disposable phone numbers hosted on public SMS-receiving platforms create significant exposure. Malicious actors use these public gateways to receive verification codes online, enabling two primary threat vectors:

• Synthetic Identity Fraud: Fabricated or stolen personally identifiable information (PII) is paired with a public phone number to establish accounts that mimic legitimate consumers.
• Promotion Abuse: Automated or rotating public numbers are used to exploit sign-up incentives and new-user discounts, draining marketing budgets and distorting acquisition metrics.

To counter these risks, our evaluation has examined ingestion pipelines that track publicly accessible phone numbers. By proactively identifying when numbers surface on public SMS platforms, organizations can flag and restrict high-risk transactions before account creation occurs.

Operational Framework Overview

Prove’s multi-layered signal architecture evaluates interaction legitimacy to flag high-risk activity and streamline authorized traffic. Successful API responses return two-character "Reason Codes" that provide granular insight into risk profiles, identity matching precision, and policy outcomes. Since a single transaction may trigger multiple indicators, these codes offer critical contextual defense beyond numerical scoring to mitigate identity theft and fraud.

Data Scope

This investigation evaluated a baseline cohort of 803 unique public phone numbers flagged in November 2025, observing their transaction footprints from December 2025 through March 2026. Across active traffic, 22,000 transactions associated with these numbers were identified. Of these 22,000 transactions, approximately 50% (11,000 transactions) involved real-time Trust Score evaluations requiring possession checks, forming the primary analytical population for this study.

‍

Core Definitions & Signals:

• Trust Score: A real-time numerical rating (0–1,000) that assesses phone number reputation, lifecycle events, and historical risk patterns.
• Global Fraud Policy (GFP): A rule-based evaluation layer combining identity matching, behavioral signals, and risk guardrails to evaluate interaction safety.
• Pass Cohort: Transactions where the Trust Score met or exceeded the standard threshold (Trust Score ≥ 630).
• Fail Cohort: Transactions where the Trust Score fell below the target threshold (Trust Score < 630) or triggered explicit risk indicators.

Findings & Analysis

Evaluation of the total transaction population revealed clear performance metrics across detection layers:

• Initial Reputation Filtering (Trust Score): 78.80% of transactions involving these public numbers failed the baseline Prove Trust Score threshold (< 630) or returned high-risk public phone indicators, correctly identifying the majority of high-risk activity upfront
• Secondary Policy Evaluation (GFP): 21.20% of transactions initially passed the standalone Trust Score threshold. However, when evaluated against secondary risk signals within the Global Fraud Policy, 9.64% of total transactions flagged additional risk indicators, reducing unflagged exposure down to 11.56% of total transactions.

The analysis demonstrates why successful OTP delivery should not be interpreted as proof of legitimate possession, or legitimate identity. A public SMS number may be technically capable of receiving a verification code while providing none of the exclusivity, continuity, or accountability normally associated with a consumer-controlled phone.

The first detection layer identified most of this exposure. Among the evaluated transactions, 78.80% failed the standard Prove Trust Score threshold or returned a high-risk public-phone indicator. This suggests that phone reputation, lifecycle history, and known exposure signals can identify a substantial share of public-number activity before an account is opened.

The more consequential finding, however, is what happened to the transactions that initially appeared acceptable. A standalone Trust Score evaluation allowed 21.20% of transactions to pass. When those transactions were evaluated using the additional identity, behavioral, and risk signals incorporated into Prove’s Global Fraud Policy, another 9.64% of the total population surfaced risk indicators.

Put another way, the secondary policy layer identified risk in approximately 45% of the transactions that had passed the initial Trust Score threshold. That reduced the remaining unflagged population from 21.20% to 11.56%.

This does not necessarily mean that every flagged transaction represented confirmed fraud, or that every unflagged transaction was legitimate. Rather, it demonstrates that no single score or signal provides a complete view of risk. Public SMS numbers can vary in their history, reputation, and observed behavior, and some will not appear immediately suspicious when evaluated through one lens. Layered policy controls provide the additional context needed to expose activity that a standalone possession or reputation check may miss.

By combining intelligence on publicly accessible numbers with multi-layered reputation and policy guardrails, organizations closed substantial detection gaps that standalone possession checks would have missed.

Key Takeaways & Recommendations

The proliferation of web-hosted public phone numbers highlights a fundamental flaw in relying solely on OTP verification. Because public gateways allow anyone to view incoming SMS messages without exclusive device control, possession alone cannot be treated as a binary trust event. To build resilient onboarding controls, organizations should evaluate possession in combination with reputation, ownership, behavioral signals, and real-time intelligence on publicly exposed endpoints.