The study shows that SMS verification can be easily bypassed
Researchers say disposable numbers can be bought for pennies
Japanese numbers among the most expensive; Great Britain is among the cheapest
WASHINGTON, Dec 11 (Reuters) – A central obstacle to creating fake social media accounts can be bypassed for just a few cents at a time, University of Cambridge researchers have found, a sign of how low the barriers are to online disinformation efforts.
Digital platforms have various ways to defend against fake accounts and scammers, but the key is the practice of sending a code via text message or SMS to a phone number. These activation texts are meant to ensure that each account is linked to a real phone, but researchers have mapped a number of SMS activation services that offer disposable phone numbers, typically for less than 30 US cents each.
The findings, published Thursday in the journal Science, show that a major obstacle to account fraud is easily circumvented, said one of the study’s co-authors, Cambridge lecturer Jon Roozenbeek.
“The cost is absolutely trivial,” he said.
The researchers said they collected a year’s worth of data from four on-demand text message verification providers – SMSActivate, 5Sim, SMShub and SMSPVA – to come up with figures on the cost of creating a fake account on various social media platforms around the world.
SMS activation doesn’t guarantee an account won’t be blocked, but Roozenbeek, who researches propaganda, said he and his colleagues confirmed their findings by creating accounts using scrapped numbers in some cases. He said that while they were overwhelmed at times, with at least one service “we succeeded every time we tried.”
In an email, SMSPVA disputed the researchers’ description of the firm as a “grey market” operator.
“We are an official, legally operating company in full compliance with all applicable regulations,” the company said, adding that its service has been used by testers, marketers and “ordinary individuals who are concerned about protecting their personal data.” SMSActivate, 5Sim and SMShub did not return messages seeking comment. The researchers’ findings, available through a newly launched online dashboard, show that verification of phone numbers associated with many countries – including the United States – can be obtained for 20 to 30 cents apiece. British, Russian and Indonesian numbers were among the cheapest, at 10 cents or less, the researchers said. They found that Japan and Australia, where SIM cards are more expensive and the regulations surrounding their purchase stricter, are among the most expensive – around $5 and $3 respectively.
Shopping for single purpose numbers for different services has yielded different results. It costs about $3 to get a US number to use on WhatsApp, according to the researchers’ dashboard. It costs 8 cents to get one to use on X, the social network formerly known as Twitter.
Roozenbeek said SMS activations for direct messaging apps like WhatsApp generally command higher prices, potentially due to stricter vetting, while “Twitter or X is pretty lax compared to the others.”
WhatsApp said in a statement that it welcomed industry research that it said was “aimed at misleading internet services”. He added that in addition to phone numbers, WhatsApp used a number of “technical and behavioral signals” to screen users and police fraud. X did not return messages seeking comment.
University of Pittsburgh academic Samuel Woolley, who was one of the paper’s reviewers, said that SMS verification is a “central standard for vetting” online accounts and that the methodology used to measure the cost of bypassing it is correct.
“Researchers in this space have long called for greater attention to the economics of disinformation,” Woolley said. “It makes sense to follow the money. (Reporting by Raphael Satter in Washington; Editing by Stephen Coates)
