SMS verification, and how the code actually reaches you

It is a possession check. The site is not establishing who you are; it is establishing that you are holding something only you should be holding. That is why the same mechanism shows up in three different places — proving a number is real at signup, proving it is still yours at password reset, and standing in as a second factor at login.

It is also why the check is only as strong as your grip on the number. A code sent to a line you no longer control protects nobody, which is the reasoning behind every recommendation further down this page.

1. You submit a number. The site normalises it to international format — +1 208 555 1234 — and rejects anything that cannot be parsed.
2. It may run a carrier lookup. This returns the carrier and the line type. A number that fails here is refused before any message exists, which is why you see "invalid number" rather than a delivery failure.
3. It generates the code. Usually six digits, stored as a hash with a short expiry — five to ten minutes is typical — and handed to an SMS provider.
4. The provider routes it. Through an aggregator, onto the destination carrier, over whichever interconnect the two have agreed.
5. The carrier delivers it to whatever holds the number.
6. You type the code back in. The site compares it against the stored hash and checks it has not expired.

Six steps, four organisations, and only the second one produces an error message you can read. Everything after it either arrives or quietly does not.

In rough order of how often each is the real cause:

• The number was refused at lookup. The line type came back voip and the message was never sent. This is the single most common reason a virtual number fails, and it looks like a formatting error rather than a rejection.
• The carrier filtered it. High-volume application traffic gets scored for spam, and a filtered message is dropped silently rather than bounced.
• The number is already registered. Many services allow one account per number and will not send a second code to one they have seen.
• The route does not exist. Not every sender delivers to every destination country, and a missing route fails without notice.
• It arrived, and expired. A code queued for eleven minutes against a ten-minute window is delivered and useless.
• You are being rate limited. After several requests in quick succession, some services stop sending and keep showing the same confirmation screen.

Retrying immediately helps with exactly one of these. For the rest, changing something — the number, its line type, or the service — is the only thing that does.

There are ordinary reasons to verify with a number that is not your personal one:

• Testing your own signup or password-reset flow against a real carrier path rather than a mock.
• Keeping a work account off a personal line, or the reverse.
• Registering with a service that requires a US number when you are not in the US.
• Not handing a permanent number to a site you have no history with, given where marketing lists end up.

And one that is not: creating accounts a service has told you it does not permit. A rented number does not change what its terms say, and an account built on one is the account that disappears.

Which number you need comes down to what the site checks and how long you need to hold it. Non-VoIP numbers covers the line-type filter that stops most virtual numbers. Virtual phone numbers sorts out the four different products sold under that one name. SMS verification numbers covers what one costs here and how an order runs.