2

I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.

My goal was to have a dedicated DID/number which I don't publish publicly that receives SMS messages, such that socially engineering access to my primary mobile phone number won't grant an attacker access to my 2FA SMS.

(And yes, I would rather use TOTP. Sadly, some vendors only offer SMS, and won't SMS to a VoIP number)

How do online services determine if a number is VoIP or a true mobile provider? If I port a Canadian VoIP number to a mobile carrier will I be able to receive such messages or will I permanently limit my options by continuing to use this number?

1

In a manner similar to how some online services detect VPNs based on known VPN IP address databases, VoIP numbers come in batches that have known prefixes within each area code. Certain providers choose not to allow VoIP numbers for verification because they can be obtained and accessed from anywhere in the world, and are harder to tie to real people, locations or accounts, and are easier to change or dispose of. Some service providers also do not want to be liable for fraud committed by intercepting SMS messages while they are in the IP domain. Intercepting a text message on a cellular network is much more difficult than on a hijacked VoIP account. An attacker does not have to physically obtain the device (like stealing a mobile phone) on a VoIP account, just obtain login credentials.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.