Key barrier to online fraud can be bypassed for pennies, say researchers

Audio By Carbonatix

WASHINGTON, Dec 11 (Reuters) – A central barrier to the creation of bogus social media accounts can be bypassed for as little as a few cents at a time, researchers at the University of Cambridge determined, a sign of just how low the barriers are to online disinformation efforts.

Digital platforms have a variety of defenses against fake accounts and scammers, but a key one is the practice of sending a code via text message, or SMS, to a phone number. These activation texts are meant to ensure that each account is connected to a genuine phone, but researchers mapped out an array of SMS activation services that offer throwaway phone numbers, typically for less than 30 U.S. cents apiece.

The findings, published Thursday in the journal Science, show that a central roadblock to account fraud is easily bypassed, said one of the study’s co-authors, Cambridge lecturer Jon Roozenbeek.

“The costs are absolutely trivial,” he said.

The researchers said they collected a year’s worth of data from four providers of on-demand text message verification – SMSActivate, 5Sim, SMShub, and SMSPVA – to come up with figures for the costs associated with creating a fake account on various social media platforms across the globe. 

SMS activation does not guarantee an account will not get blocked, but Roozenbeek, who researches propaganda, said he and his colleagues validated their findings by, in some cases, creating accounts using the throwaway numbers. He said that while they were occasionally stymied, with at least one service “we succeeded every time we tried.”

In an email, SMSPVA disputed the researchers’ description of the firm as a “gray market” operator.

“We are an official, legally operating company fully compliant with all applicable regulations,” the company said, adding that its service was used by testers, marketers and “ordinary individuals concerned about protecting their personal data.” SMSActivate, 5Sim, and SMShub did not return messages seeking comment.

The researchers’ findings, available through a freshly launched online dashboard, show that phone number verification associated with many countries – including the United States – can be acquired for between 20 and 30 cents apiece. British, Russian, and Indonesian numbers were among the cheapest, at 10 cents or less, the researchers said. They found that Japan and Australia, where SIM cards are more expensive and regulations around their purchase are more stringent, were among the most expensive – at around $5 and $3, respectively.

Shopping for throwaway numbers to use for different services yielded different results. Getting a U.S. number for use on WhatsApp costs about $3, according to the researchers’ dashboard. Getting one for use on X, the social network formerly known as Twitter, costs 8 cents.

Roozenbeek said SMS activations for direct-messaging apps like WhatsApp in general commanded higher prices, potentially due to more stringent vetting, while “Twitter or X is quite lax compared to others.”

WhatsApp said in a statement that it welcomed the research into an industry it said was “aiming to mislead internet services.” It added that, in addition to phone numbers, WhatsApp employed an array of “technical and behavioral signals” to screen users and police fraud. X did not return messages seeking comment.

University of Pittsburgh academic Samuel Woolley, who was one of the paper’s reviewers, said that SMS verification was a “central standard for vetting” online accounts and that the methodology used to measure the cost of bypassing it was sound.

“Researchers in this space have for a long time been calling for more attention to the economic side of disinformation,” Woolley said. “It makes sense to follow the money.”

(Reporting by Raphael Satter in Washington; Editing by Stephen Coates)