Temporary phone number for SMS: limits and private options

Say a supplier portal wants your cell number, and you'd rather not hand it over. A temporary phone number for SMS is a number you use briefly to get a text, often on a public web inbox.

We'll cover whether that's safe, why sites refuse virtual numbers and why recovery hurts most. Then Google Voice, a second line or eSIM, which number fits which sign-up, and keeping your real number safe.

Is a free temporary number safe for verification codes?

For anything you plan to keep, it isn't. A public inbox shows every text on an open web page with no sign-in, so the number works like a bulletin board that anyone passing by can read. The code meant for you sits in plain view next to everyone else's, and the site that sent it can't tell who typed it.

The rules for one-time codes make that worse. NIST SP 800-63B-4, the digital identity guideline federal agencies follow, says a code sent this way is "invalid unless completed within 10 minutes" and valid "only once." The 2017 version, NIST SP 800-63B, used the same 10-minute window. So the code belongs to whoever types it first inside that window. On a shared number, that may not be you.

NIST is wary of texted codes in general, too. Its current version, revision 4, names exactly one restricted authenticator, "the use of the PSTN for out-of-band authentication," meaning codes sent by text or voice call. The 2017 version went further for internet phone numbers. It said methods that don't prove you hold a specific device, "such as voice-over-IP (VOIP) or email, SHALL NOT be used" for these codes.

We wanted to see that first-come rule play out, so we ran it on a laptop with made-up data and no real phone numbers.

What we tested

On October 30, 2026, we ran a mock public inbox, a mock private inbox and a code checker with NIST's 10-minute, one-use rules on 127.0.0.1. Person B opened the public page with no sign-in, read person A's code among 4 listed, and typed it first: "accepted." A's own try then got "already used."

The private inbox refused an anonymous request with 401. A code typed 10 minutes and 1 second late came back "expired."

Some sites spot and refuse virtual numbers

That's the stolen-code risk, but often the code never arrives. Google's own Google Voice texting help says, "Some websites, such as banks or subscription services, won't send text messages to Google Voice numbers." If a verified Google number gets turned away, a number shared on an open web page is unlikely to do better. Sites can check what kind of number you typed before they send anything. Twilio, a texting provider, documents a line type lookup that sorts numbers into mobile, landline, fixed VoIP and more. One label is "nonFixedVoip," a number "obtained online without requiring a physical device. For example, Google Voice." Twilio's own example filters out landlines before sending texts.

Google names banks and subscription services as the senders that say no.

That refusal comes from the sender, not from a weak signal, so retrying the same number won't change it. A second or third public inbox can hit the same line-type check, and each try leaves another one-time code sitting on another open page that anyone can read.

Recovery is where a borrowed number hurts most

A refused code costs you a sign-up. A number you can't reach later can cost you the account when the reset code goes to the number on file.

Some services still send recovery codes by text. CISA's mobile communications guidance, updated November 24, 2025, warns that "some online services may default to SMS during account recovery flows." Microsoft says it "will start phasing out SMS" for sign-in and recovery on personal accounts, so text is still in use there today.

If the number on file was a public inbox, the reset code lands on a page you don't control, and a stranger can use it before you notice.

Google applies the same logic to its own product. Its recovery options help says, "Do not use a Google Voice number as a recovery phone number. If you do, you could lock yourself out of your account."

The code to get back in would go to a Voice inbox behind that same Google login, so being locked out of one locks you out of the other.

Numbers also change hands even when nobody shares them. In a 2018 order on reassigned numbers, the FCC said "approximately 35 million numbers are disconnected" and made available to new customers each year. A number you drop, or only borrowed, can end up with a stranger who then gets your codes.

Google Voice: a free second number, with limits

That leaves numbers only you can read. Google Voice is the obvious no-cost choice. It gives you a separate US number for calls and texts, and Google's setup notes describe calling from a web browser as well as from mobile devices. Texts to US, Canadian and Puerto Rican numbers go out "at no charge," per Google's texting page. Google's Voice plans page also offers "a basic plan at no cost," both as of October 2026.

The catch is setup. Google Voice setup needs a phone that "can get texts" for a check code, so it adds a second number rather than replacing your first.

New numbers need identity verification too, and Google asks you to "have a valid government-issued ID ready." It's a US-only service, and Google says "Google Voice is only available in the US" on its legacy Voice page.

Then there's upkeep. Google's Voice Acceptable Use Policy says it may reclaim a number left idle "for a period of 3 months."

Google's reclaim page gives you 45 days after that date to get it back, and your old messages stay in the account even while calls and texts stop. Moving your mobile number into Voice costs $20, per Google's porting help as of October 2026.

We'd use Google Voice for a public business line, a classified ad, a directory listing or a store loyalty sign-up, where a stranger seeing the number costs you nothing. We'd keep it off your bank, your main email account and anywhere Google's own warning applies.

A second line or eSIM from your carrier

When a site refuses virtual numbers, a real mobile line gets through. Apple's Dual SIM with an eSIM page says Dual SIM lets an iPhone hold "two active phone numbers." Models from iPhone 13 on can hold two eSIMs at once.

Apple's Dual SIM guide lists "one number for business and another number for personal calls" as a standard use.

A second plan is a real carrier line, so it gets the same texts your main number does and nobody else reads them. Apple adds one condition. A plan from a second carrier needs a phone that isn't locked to the first one, unless both plans share a carrier. We haven't listed prices here. They vary by carrier and plan. None of the carrier pages we tried opened for our checker, so your carrier's own US plan page is where to find a real monthly figure.

Most sign-up forms want an email address as well as a number. Apple's Hide My Email, included with an iCloud+ subscription, makes "unique, random email addresses" that forward to your real inbox. Our 10 Minute Mail guide covers the throwaway-inbox side of email.

Which number to use for which sign-up

Two rows need a caveat. The carrier line has no dollar figure because no carrier page opened for our checker. "Rarely refused" for a mobile line is our reading of Google's warning, which names Google Voice numbers, not carrier lines.

Read it from the bottom row up for anything you'd miss. Banking, email, payroll and your website host belong on your main number or a second line, because those are the accounts you'd most need to recover.

Google Voice fits the middle ground. A public inbox only fits a one-off sign-up you'd never try to recover, like a coupon you'll use once and forget about.

Keep your real number safe too

Once your main number carries the accounts that matter, the number itself becomes the target, so guard it the way you'd guard your bank password. CISA's guidance says most carriers let you set an extra PIN or passcode. It's needed for "sensitive operations, such as porting a phone number," which CISA calls "a critical step in countering" SIM swapping.

The FCC has acted as well. On November 15, 2023, it adopted rules against SIM swap and port-out fraud. They require "secure methods of authenticating a customer before redirecting a customer's phone number to a new device or provider." The SIM-change duty sits in 47 CFR 64.2010(h) and the port-out duty in 47 CFR 52.37. As of October 30, 2026, though, 64.2010(h) says compliance "will not be required until this paragraph is removed or contains a compliance date." Section 52.37 carries the same note, and neither lists a date yet.

Until a date appears, the PIN is yours to ask for. CISA says the carrier requires it for logging in to your account as well as for porting the number out.

Then move your most important logins, starting with email and banking, off texted codes wherever the service lets you pick a stronger second step. Google's 2-Step Verification help says codes "sent by texts or calls can be vulnerable to phone number-based hacks." CISA goes further: "do not use SMS as a second factor," since SMS messages "are not encrypted." That guidance mainly targets senior government, military and political figures, though CISA calls it "applicable to all audiences." An authenticator app or a passkey takes the phone number out of the attack. Print Google's backup codes too, since Google says, "If you lose your phone, you can use a backup code for the second step."

Codes also leak through people. Google Voice warns, "Don't share your verification code with anyone." Our notes on what to do after clicking a phishing link and how to avoid phishing cover the messages that ask for one. Scammers try it on social apps too, as our Snapchat account security guide shows.

Our take: keep a public inbox for nothing you'd want back, and use Google Voice for low-stakes sign-ups where a refused text wouldn't cost you anything important. Put the accounts that run your business on a carrier line with a PIN. Each one still needs a long, unique password, and our free password generator makes one in a second. Our cybersecurity tips for small businesses and simple steps to better online security cover the rest.

Does your shop's own sign-up form text codes to customers? The DigitalTreed web development team can add app-code or passkey logins. That's paid work, so weigh this tip knowing we sell it.

Temporary phone number questions

How we made this guide: Our test used a local server, a made-up line and made-up texts, so no real number or inbox site was touched. We read official pages signed out, and a script matched every quote to our saved copies. Facts checked by the DigitalTreed team on October 30, 2026.

First published November 2023 as a list of free public SMS inbox sites. Rewritten October 30, 2026: no inbox site is named or linked; the post explains why those numbers fail and compares private options.

Sources

• NIST SP 800-63B-4: Authentication and Authenticator Management
• NIST SP 800-63B (2017 revision): Authentication and Lifecycle Management
• CISA: Mobile Communications Best Practice Guidance (v2.0, November 24, 2025)
• FCC 23-95: Protecting Consumers from SIM Swap and Port-Out Fraud (November 2023)
• eCFR: 47 CFR 64.2010, Safeguards on the disclosure of CPNI
• eCFR: 47 CFR 52.37, Number Portability Requirements for Wireless Providers
• FCC 18-177: Advanced Methods to Target and Eliminate Unlawful Robocalls, Second Report and Order (December 2018)
• Google Voice Help: Send and get text messages
• Google Voice Help: Set up Google Voice
• Google Voice Help: Identity verification for Google Voice users
• Google Voice Help: The end of legacy Google Voice for personal accounts
• Google Voice Acceptable Use Policy
• Google Voice Help: Reclaim your Voice number
• Google Voice Help: Port your Google Voice number
• Google Voice Help: Delete your Google Voice number
• Google Voice Help: Protect your verification code
• Google Workspace: Google Voice plans
• Google Account Help: Set up recovery options
• Google Account Help: Turn on 2-Step Verification
• Microsoft Support: Two-step verification with your Microsoft account
• Apple Support: Using Dual SIM with an eSIM
• Apple Support: Using Dual SIM with two nano-SIM cards
• Apple Support: Hide My Email with iCloud+
• Twilio Docs: Line Type Intelligence