I've been dabbling with VoIP carriers which offer SMS with relatively mixed results when trying to use VoIP numbers to receive 2FA messages.

My goal was to have a dedicated DID/number which I don't publish publicly that receives SMS messages, such that socially engineering access to my primary mobile phone number won't grant an attacker access to my 2FA SMS.

(And yes, I would rather use TOTP. Sadly, some vendors only offer SMS, and won't SMS to a VoIP number)

How do online services determine if a number is VoIP or a true mobile provider? If I port a Canadian VoIP number to a mobile carrier will I be able to receive such messages or will I permanently limit my options by continuing to use this number?

1 Answer 1


In a manner similar to how some online services detect VPNs based on known VPN IP address databases, VoIP numbers come in batches that have known prefixes within each area code. Certain providers choose not to allow VoIP numbers for verification because they can be obtained and accessed from anywhere in the world, and are harder to tie to real people, locations or accounts, and are easier to change or dispose of. Some service providers also do not want to be liable for fraud committed by intercepting SMS messages while they are in the IP domain. Intercepting a text message on a cellular network is much more difficult than on a hijacked VoIP account. An attacker does not have to physically obtain the device (like stealing a mobile phone) on a VoIP account, just obtain login credentials.

  • It's worth noting that this doesn't really answer the question. For example, I ported a number from a VoIP IP range to a mobile and have never had any issues getting services to accept it as a mobile number, while the same number +1 (same NPA-NXX) is refused. Similarly when I ported a number from a mobile provider to VoIP, services already registered typically still could send SMS (but not always), but I could not add that number anymore.
    – TheDave
    Jul 13, 2023 at 17:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .