DEV Community: Bota P

What Is the Difference Between a VoIP Number and a Mobile Number?

Bota P — Sat, 10 Oct 2026 07:54:18 +0000

When people search for a number to receive SMS verification codes at sites like Tell A Bot, one question comes up again and again: Should I use a VoIP number or a real mobile number?

The answer depends on the service you are trying to verify. Some platforms strongly prefer mobile numbers. Others accept both mobile and VoIP numbers without much difference. In some cases, VoIP numbers can perform even better than mobile numbers.

What Is the Difference Between a VoIP Number and a Mobile Number?

The difference is actually quite simple. A mobile number is issued by a mobile carrier such as AT&T, Verizon, or T-Mobile and is associated with a SIM card or eSIM. A VoIP number is managed over the internet rather than through a SIM card, and can be used with both software apps and hardware-based devices. Calls and messages are delivered through internet based systems and can be accessed through a website, mobile application, or API.

From the user's perspective, both types of numbers can receive SMS messages. The important difference is how apps and services classify them during verification. Some platforms check whether a number is mobile or VoIP before sending a verification code. Depending on the service, this information may influence whether the registration is accepted.

Mobile Numbers Explained

Mobile numbers are issued by licensed mobile carriers. In the United States this usually means AT&T, Verizon, T-Mobile, or one of the many providers that use their infrastructure, such as Mint Mobile, Visible, or Cricket.

For SMS verification, two characteristics matter:

Carrier Information
Every mobile number belongs to a recognized mobile carrier. Many verification systems can see this information and may use it as one of their trust signals.
SMS Delivery
Messages are delivered through the carrier's mobile network and arrive directly on the SIM card or eSIM associated with the number.

Because mobile numbers come from established carriers, some services prefer them during verification.

VoIP Numbers Explained

VoIP stands for Voice over Internet Protocol. Instead of being connected to a SIM card, a VoIP number is managed through software. Messages can be delivered to:

a web interface
a mobile application
a hardware device
a desktop application

Popular examples include Google Voice, TextNow, Hushed, and many business phone systems.

Behind these services are wholesale telecom providers such as Bandwidth, Telnyx, Lumen, Peerless, and others that actually own the number ranges. This is why carrier lookup tools sometimes display a carrier name that most users have never heard of.

Why Does This Matter for SMS Verification?

Because many services check what type of number you entered before sending a verification code. A platform may:

accept both mobile and VoIP numbers
prefer mobile numbers
reject certain VoIP providers
ignore line type entirely

This is why a number that works perfectly for Telegram may fail on WhatsApp, and a number that works on Apple may be rejected on WeChat. The important point is that the outcome depends on the service being verified, not on whether VoIP is "good" or "bad."

How Do Services Detect VoIP Numbers?

Most major platforms perform a carrier lookup when a phone number is submitted. The lookup usually returns information such as:

carrier name
country
line type

Common line types include:

mobile
landline
fixedVoip
nonFixedVoip

Many services use this information as one of several verification signals. Some platforms place significant weight on line type. Others care much more about factors such as:

IP reputation
device history
account behavior
previous account activity
device fingerprint

This is why the same VoIP number may be accepted by one service and rejected by another. Please make sure to read our post about most common reasons for SMS verification failure.

How Important Is Line Type?

Not as important as many people think.

Over the years, many companies have started using carrier information as part of their verification systems. However, line type is usually only one factor among many. A mobile number does not automatically guarantee success. Likewise, a VoIP number does not automatically guarantee failure.

Our own verification statistics show that some services strongly prefer mobile numbers, while others show little difference between mobile and VoIP performance. The only reliable way to know is to look at the results service by service.

Frequently Asked Questions

Why does WhatsApp sometimes reject mobile numbers?

Phone number type is only one factor. WhatsApp may also consider device history, IP reputation, previous account activity, and other signals when deciding whether to allow verification. We have published a separate article on how to verify WhatsApp with a temporary number, please take time to read it.

Are Google Voice numbers VoIP?

Yes. Google Voice numbers are generally classified as nonFixedVoip and are frequently rejected by services that strongly prefer mobile numbers.

Can VoIP numbers be used for SMS verification?

Absolutely. Many services accept VoIP numbers without any issues. The outcome depends on the specific platform being verified.

What is the cheapest option for SMS verification?

It depends on the service. For platforms that accept VoIP, VoIP numbers are often the most affordable choice. For services that strongly prefer mobile numbers, using a mobile number usually provides the best results.

The OSINT Dilemma: When Getting Through the Door Becomes Part of the Investigation

Bota P — Fri, 09 Oct 2026 19:30:23 +0000

It started the way many cryptocurrency thefts do now: quietly, and with the victim’s own signature.

A client came to a private cyber-investigation team after losing roughly $25,000 from a self-custodied USDT wallet. There was no stolen password and no SIM swap. Instead, the victim had been directed to a website posing as a legitimate anti-money-laundering checker. After connecting the wallet, the victim signed what appeared to be a routine approval request.

That signature was the attack.

Connecting a cryptocurrency wallet to a website does not, by itself, normally transfer funds. The danger is what happens next. A malicious approval can give another party permission to transfer tokens from the wallet, potentially allowing a substantial portion of the balance to be drained.

But the stolen money was only the beginning of the investigation.

Following the Money

On-chain tracing suggested that the fake AML website was not an isolated operation. Its infrastructure appeared connected to a broader wallet-draining ecosystem, the kind of operation often described as Drainer-as-a-Service.

The model is relatively simple. One group develops the phishing infrastructure and draining tools. Others recruit victims, distribute links and operate campaigns for up to 80% share on every drained wallet. In the scenario examined by investigators, affiliates were reportedly coordinating through private online communities and sharing information about successful drains and payouts.

The blockchain trail eventually led somewhere more interesting than another wallet address: a closed, invite-only community where people involved in the operation appeared to coordinate their activities.

There was just one problem.

The investigators had to get inside.

The Investigation Before the Investigation

Accessing a restricted online community can be surprisingly difficult when you are trying to investigate it professionally.

An investigator cannot simply create an account and behave as though nothing is different. Personal details can expose the investigator. Corporate accounts can connect the research to the organization conducting it. A browser profile, network connection, account history or phone number can also become part of the platform’s anti-abuse assessment.

The team therefore created an isolated research environment, using a dedicated email account, a consistent browser profile and network infrastructure appropriate to the jurisdiction being investigated.

Then they encountered one of the most ordinary barriers on the internet:

Enter your phone number.

A personal number was unsuitable because it could expose the investigator’s identity. Obtaining a dedicated physical SIM would introduce procurement and activation delays. The team ultimately used a temporary mobile number obtained through an SMS verification service to complete the verification step without exposing a personal or corporate line.

Inside the Network

Once access was established, investigators mapped the operation across three layers.

Private messaging channels were used to coordinate affiliates and share information about victim wallet drains and payouts.

Affiliates distributed links disguised as legitimate AML or compliance tools through localized Facebook groups, Telegram communities and cryptocurrency forums.

Investigators also identified suspected P2P counterparties involved in converting the stolen cryptocurrency into fiat. By cross-referencing wallet addresses, Telegram identifiers, affiliate records and on-chain transactions, they were able to build a picture of how the operation moved money from victims to its suspected off-ramps.

The Real OSINT Problem

The difficult part of an OSINT investigation is rarely finding a working proxy, a good temporary phone number or a browser configuration that gets an account through registration. The harder problem is making the research environment consistent enough to survive scrutiny over time.

That includes account history, network and browser state, authentication, evidence preservation and operational security. Social engineering can also become part of the process: investigators may need to interact with targets or communities in ways that produce useful information without exposing the investigation or compromising its boundaries.

None of these techniques guarantees trust, and each introduces its own risks. A temporary number can be reassigned, a proxy can fail, and a research persona can conflict with platform rules or identity requirements.

The goal is not simply to get through the door. It is to build a research process that remains controlled, documented and defensible once the investigation moves beyond the first login.