MediumDisposable Phone Numbers: How VoIP Numbers Get Traced | Medium
Sitemap
Open in app

Sign in

Medium Logo
Write
Search

Sign in

Who Is Really Behind That Text? How Disposable Phone Numbers Work, and How Police Trace Them

29 min readOct 13, 2026

--

A plain-English investigation into VoIP numbers, SIP trunks, free texting apps, 911 blind spots, and the long legal road from a scam text to a real name

Press enter or click to view image in full size
Image of a VoIP phone in a server Data Center
Image of a VoIP phone in a server Data Center

Who is really behind that text?

In 2024, Americans reported losing $470 million to scams that started with a text message. That is five times more than in 2020.

Now here is the part most people never think about. The number that sent that text probably cost the sender less than a dollar a month. They rented it in seconds, used it, and threw it away.

So when you walk into a police station with a screenshot, what actually happens next? Who owns that number? Can the police find a real name behind it? And why does it sometimes take almost a year?

I wanted real answers, not guesses. So I dug into carrier pricing pages, law enforcement guides, federal rules, and peer-reviewed research. I also asked investigators from the Montreal police cybercrime unit (SPVM) how these cases play out on the ground. What they told me surprised me, and I think it will surprise you too.

The short answer: A disposable phone number is usually a VoIP number, called a DID, that an app or company rents from a wholesale carrier for roughly $0.50 to $1.15 a month. It can be traced, but only through a chain of court orders: from the carrier that owns the number, through every reseller in between, to the app that assigned it, and finally to the internet provider or VPN behind the user’s IP address. Inside one country that can take weeks. Across borders it usually requires a Mutual Legal Assistance Treaty (MLAT) request, which averages about 10 months. And by then, the data may already be gone.

In this guide, you will learn:

  • What a disposable number and a DID really are
  • How North American phone numbers are built, and what the digits reveal
  • How SIP and SIP trunking move calls over the internet, in plain English
  • What Twilio, Bandwidth, and Bird charge per number, and how bulk pricing works
  • How free texting apps like TextNow and TextFree get their numbers
  • Why 911 can ring in the wrong city when you call from a VoIP app
  • The exact legal path police follow to unmask a sender, including MLATs
  • How phones are physically located, from tower triangulation to GPS
  • How SIM farms power the “receive SMS online” business
  • What to do in the first 24 hours if a disposable number targets you

No IT background needed. If you can send a text, you can follow this.

What is a disposable phone number? (And what is a DID?)

A disposable phone number is a real, working phone number that you can get instantly, use for a while, and drop without changing your SIM card or your phone. Most of them are VoIP numbers, which means they live on the internet instead of on a physical phone line or SIM card.

In the telecom world, these numbers have a more technical name: DID, which stands for Direct Inward Dialing.

Here is where the name comes from. Decades ago, a company would rent a bundle of phone lines from the phone company. Instead of paying for a separate line for every employee, the company got a block of numbers that all arrived on the same bundle. When someone dialed one of those numbers, the call went straight to the right desk without passing through a receptionist. Direct. Inward. Dialing.

Today, a DID simply means a phone number that points to an internet-based phone system. The number has no wire and no SIM attached to it. It is basically a pointer in a database that says “when someone calls or texts this number, send it to this server.”

That is what makes it disposable. Changing where a number points takes a few milliseconds and one line of code. Releasing it takes one more.

SIM number vs VoIP number: what is the difference?

What it is tied to

  • Mobile number (SIM): A physical or eSIM card in one phone
  • VoIP number (DID): A software account on a server

How fast you can get one

  • Mobile number: Minutes to hours, often in a store
  • VoIP number: Seconds, through an app or an API

Typical cost

  • Mobile number: A monthly phone plan
  • VoIP number: About $0.50 to $1.15 per month wholesale, free in ad-supported apps

Location data the network sees

  • Mobile number: Which cell tower the phone is using
  • VoIP number: Only an IP address, unless the app collects GPS

How many one person can hold

  • Mobile number: Usually a few
  • VoIP number: Hundreds or thousands

Line type in a carrier lookup

  • Mobile number: Mobile
  • VoIP number: VoIP (sometimes labeled non-fixed VoIP)

That last row matters more than you might think. Many banks and social networks check the line type before they accept a number for verification. If it comes back as VoIP, they block it. Keep that in mind, because it explains why SIM farms exist. We will get there.

Numbers get recycled

One more thing most people do not know: disposable numbers do not disappear when you are done with them. They go back into a pool and get handed to someone else. TextNow, for example, says it recycles numbers to new customers after a holding period.

This creates a real investigative headache. The same number can belong to three different people in a single year. That is why police requests must always include an exact date, time, and time zone. Without them, the company cannot tell which user the police are asking about.

A 2023 Princeton study found that 66% of recycled phone numbers were still linked to the previous owner’s online accounts.

How North American phone numbers work: NPA-NXX explained

Every phone number in Canada, the United States, and much of the Caribbean follows the same pattern, called the North American Numbering Plan (NANP). It is shared by 20 countries, all under country code +1.

The official format is written as NPA-NXX-XXXX, where N is any digit from 2 to 9 and X is any digit from 0 to 9. In plain English, a number like (212) 555–0147 breaks down like this:

First 3 digits: 212

  • Official name: NPA (Numbering Plan Area)
  • What it tells you: The area code. 212 is Manhattan.

Next 3 digits: 555

  • Official name: NXX (Central Office Code)
  • What it tells you: The exchange, also called the prefix. Tied to a rate center (a town or district) and originally to one carrier.

Next 1 digit: 0

  • Official name: Thousands block
  • What it tells you: In many areas, numbers are handed to carriers in blocks of 1,000. So 212–555–0 can belong to a different company than 212–555–1.

Last 4 digits: 0147

  • Official name: Line number
  • What it tells you: The individual subscriber.

Fun fact: 555–0100 through 555–0199 are reserved for movies and books, which is why I used one here. Nobody will get a call.

What the prefix reveals (and what it hides)

Because each NPA-NXX block is assigned to a specific company and place, the first six or seven digits are the very first clue an investigator checks. A free tool I recommend is Local Calling Guide’s area code and prefix search. Type in the first digits and it shows the rate center, the region, the thousands block, and the company (OCN) the block was assigned to. It works for both the United States and Canada.

But there is a catch. Since number portability arrived, people can take their number to another carrier. So the block owner tells you who the number started with, not who has it today. To find the current carrier, investigators query the porting database (in the US and Canada this is run through the Number Portability Administration Center, or NPAC).

And every country is different. The UK, France, and Brazil all use their own lengths and structures. The only global rule comes from the ITU’s E.164 standard: a full international number, including the country code, cannot be longer than 15 digits. So the NPA-NXX method above only works for +1 numbers. For anything else, investigators need that country’s own numbering authority.

SIP and SIP trunking, explained like you are 12

SIP (Session Initiation Protocol) is the language internet phone systems use to start, ring, and hang up a call. SIP trunking is the connection that links an internet phone system to the regular phone network, so it can reach any normal phone number in the world.

That is the definition. Now let me make it click.

SIP is the envelope, not the letter

Think of a phone call like mailing a package. SIP is the shipping label and the delivery notifications: who is calling, who is being called, “it’s ringing,” “they picked up,” “they hung up.” It is defined in an open standard, RFC 3261, so any company can build with it.

The actual voice travels separately, in small audio packets (using a companion protocol called RTP). SIP only arranges the meeting. It does not carry the conversation.

A SIP trunk is the on-ramp to the highway

The traditional phone network (engineers call it the PSTN, the Public Switched Telephone Network) is like a huge highway system that every phone company is connected to. An app or business that speaks SIP still needs a way onto that highway. That on-ramp is the SIP trunk.

In the old days, a “trunk” was a physical bundle of copper phone lines coming into an office building. A SIP trunk is the virtual version: the same idea, delivered over an internet connection. You pay for how many calls can run at once and for the minutes you use, and you attach as many DIDs (phone numbers) to it as you want.

So put the three pieces together:

  • SIP is the language.
  • The SIP trunk is the on-ramp.
  • The DID is the street address people use to reach you.

Follow a single text from a free app to your phone

Here is what happens when someone sends you a message from a free texting app:

  1. The sender types a message in the app. It leaves their phone as ordinary internet data, over Wi-Fi or mobile data.
  2. The app company’s servers receive it and look up which DID belongs to that account.
  3. The servers hand the message to a wholesale carrier, the company that actually owns that number on the phone network.
  4. The wholesale carrier passes it into the public network, toward your mobile carrier.
  5. Your carrier delivers it to your phone. On your screen, it looks like any other text.

Notice what just happened. At least four different companies touched that message, and each one only knows its own piece of the story. Your carrier knows which carrier sent it. The wholesale carrier knows which app it sold the number to. Only the app knows which account sent it. And only the internet provider knows which home or phone that account connected from.

That is the whole investigation problem in one picture. Keep it in mind for the rest of this article.

Who sells the numbers? Twilio, Bandwidth, Bird, and what they charge

A US phone number rents for about $0.50 to $1.15 a month from the big communications platforms, before any calls or texts. There is no purchase price. You never own the number. You lease it month to month.

These companies are called CPaaS providers (Communications Platform as a Service) or wholesale carriers. App makers, call centers, and startups plug into them through an API, which is just a way for software to order things from other software. One request, one new phone number.

Here is what the three names you hear most often publicly list for a US number, as of October 2026:

Twilio (pricing page)

  • Local number per month: $1.15
  • Toll-free per month: $2.15
  • Sending one text (US): $0.0083 plus carrier fees
  • Notes: Bring your own number: $0.50 a month. Volume and committed-use discounts through sales.

Bandwidth (pricing page)

  • Local number per month: Quote based (directories list about $0.35)
  • Toll-free per month: Quote based
  • Sending one text (US): From $0.004
  • Notes: Owns its own nationwide network. Volume-based pricing.

Bird, formerly MessageBird (pricing page)

  • Local number per month: $0.50
  • Toll-free per month: $0.50
  • Sending one text (US): Separate SMS pricing
  • Notes: Setup and registration fees are separate. No monthly minimum, release any time.

The Bandwidth number price comes from public software directories such as Capterra, since Bandwidth itself asks buyers to request a quote.

There are many other wholesalers you may see in a carrier lookup, including Telnyx, Vonage, Plivo, and Onvoy (part of Sinch). Same model, different price lists.

Is there a bulk price?

Yes, but not in the way most people imagine. You will not find a “1,000 numbers for $X” button. Instead:

  • Per-number rent stays flat, so 1,000 numbers on Bird’s list price run about $500 a month and about $1,150 on Twilio.
  • Usage gets cheaper with volume. Twilio advertises volume discounts and committed-use contracts. Bandwidth’s whole pricing page is built around volume tiers.
  • Big buyers negotiate. A company ordering hundreds of thousands of numbers, like a free calling app, signs a custom contract with prices that are never published.

Can you rent a number for just a few days?

You can release a number any time, but numbers are billed by the month. Bird, for example, says its numbers are billed per month and can be released whenever you like. In practice, keeping a number for one afternoon usually costs the same as keeping it for 30 days.

For a scammer, that is still nearly free. For an investigator, it means a number can be born and abandoned long before anyone files a police report.

One detail that helps investigators: 10DLC registration

In the United States, businesses that send texts from ordinary 10-digit numbers now have to register their brand and their messaging campaign, a system known as A2P 10DLC. Twilio lists the registration fees right on its pricing page. That paperwork creates a record of who is behind business messaging traffic. It does not cover person-to-person apps, but it closes one easy door for bulk spammers.

How do free texting apps like TextNow and TextFree work?

Free texting apps are VoIP services. They rent phone numbers in bulk from wholesale carriers, give one to each user, and pay for it mostly with ads and optional paid plans.

TextNow describes itself as a VoIP service that lets you call and text any number in the US and Canada over Wi-Fi at no cost, with a real phone number that works on a phone, tablet, or computer. When you sign up, you pick an area code, and the app offers you an available number from that region. In its own words, TextNow purchases phone numbers from wholesale providers.

Which providers? TextNow does not publish a list. But three clues point the same way:

  • Bandwidth, one of the largest wholesale VoIP carriers in North America, is a long-time supplier to this exact kind of app. Its own case study explains how it supplied the numbers when Pinger launched TextFree with calling in 2010. Pinger used every number Bandwidth delivered.
  • In investigations, TextNow numbers are commonly traced back to wholesale carriers such as Bandwidth before the request ever reaches TextNow itself.
  • Public carrier lookups on TextNow numbers return either TextNow or its wholesale partner, such as Onvoy, depending on the number block. Twilio’s carrier fee table even lists “Enflick (TextNow)” as a carrier in its own right, Enflick being the company’s original name.

So when you get a text from a TextNow number, the phone network sees a VoIP number owned by a wholesale carrier. The wholesale carrier sees TextNow as its customer. And only TextNow sees the actual user.

What the app knows about you

This is the part people underestimate. “Free and anonymous” is rarely anonymous.

When you create an account, the app typically records:

  • Your IP address at sign-up and at each login. Yes, mobile data has an IP address too, not just home Wi-Fi.
  • Your email address, or the account you used to sign in with Google or Apple.
  • The name and date of birth you typed, real or fake.
  • When the number was assigned to you and when you lost it.
  • Device details such as the phone model and app version.

This is not speculation. In a subpoena response published by the Ohio Attorney General, the records TextNow returned included the username, phone number, name, email, date of birth, registration date, registration IP, and the dates the user held the number.

Signing in with Google or Apple adds another layer. Now a second company holds even richer data: a verified recovery phone number, other devices, payment methods, and its own login history. That is a second door investigators can knock on.

A quick word about mobile IP addresses

Here is a detail even many tech people miss. Mobile carriers often put thousands of customers behind one shared public IP address, a technique called carrier-grade NAT. So an IP address alone may point to a whole neighborhood of phones. To identify one person, the carrier usually needs the IP address, the exact port number, and the exact second the connection happened. If the app did not log the port, that trail can go cold right there.

Why can a VoIP 911 call ring in the wrong city?

A VoIP 911 call is routed to the address you registered with your provider, not to where you are standing. If that address is wrong or out of date, your call can land at a 911 center hundreds or thousands of kilometers away.

Let me show you with a real-world scenario.

You live in New York. Years ago you got a VoIP number while living in Los Angeles, and the address on file was never updated. Tonight you dial 911 from that VoIP line in your Brooklyn apartment.

With a regular landline, the call would go to the 911 center that serves your street, because the phone company knows exactly where that copper line ends. With a cell phone, the network knows which tower you are connected to and the phone can send its GPS location.

With VoIP, there is no copper line and no tower. The internet does not carry a street address. So the provider routes your call based on the registered location in your account. In our scenario, that is Los Angeles.

The call-taker in Los Angeles answers. They are trained and they want to help. But they cannot send LAPD to Brooklyn, their screen may show the wrong address or none at all, and if the call drops they may have nothing but a callback number. Their only option is to ask you where you are and transfer you to the right center in New York. In an emergency, those are minutes nobody has.

The FCC says this plainly in its consumer guide on VoIP and 911: VoIP 911 calls may not connect to the center that serves your current location, may ring to an administrative line that is not staffed after hours, may arrive without your number or location, and may not work at all during a power or internet outage.

What the law now requires in the US

Things have improved, thanks to two federal laws: Kari’s Law and Section 506 of RAY BAUM’S Act. Under the FCC’s dispatchable location rules:

  • Fixed VoIP (a desk phone that never moves) must send an automatic, verified address with every 911 call. That rule has applied since January 6, 2021.
  • Non-fixed VoIP (an app on your phone or laptop) must send an automatic dispatchable location when technically feasible. Otherwise it must send your registered location, and it must detect when you call from somewhere new and either ask you to update the address or update it for you. That rule has applied since January 6, 2022.
  • Providers must give you 911 as a mandatory feature, collect your address before activating service, and get your acknowledgment of any limits.

How Canada handles it

Canada takes a different approach for “nomadic” VoIP. Under CRTC Telecom Circular 2008–2, those 911 calls typically go first to a third-party call centre. An operator verbally confirms where you are, then transfers you to the right local 911 centre. If the call drops before they learn your location, the operator must try to call you back.

How to protect yourself

  • Update your 911 address in every VoIP app you use, every time you move.
  • Keep a regular cell phone available for emergencies. It is still the most reliable way to be located.
  • Always say your address out loud first when you call 911 from any internet-based line.
  • Remember that the area code means nothing for 911 routing. A 213 number can work perfectly in New York if the registered address is right, and a 718 number can send you to the wrong state if it is not.

Disposable numbers and phone fraud: the statistics

The numbers below show why this topic matters: phone-based fraud keeps growing, phone numbers are cheap and reusable, and cross-border investigations are slow. Every figure links to its original source.

Get Daniel Absi’s stories in your inbox

Join Medium for free to get updates from this writer.

Losses reported to the FBI’s Internet Crime Complaint Center in 2025

Losses to scams that started with a text message, 2024

Estimated open rate of text messages

Robocalls received by US consumers in 2025

Average time to answer a foreign MLAT request sent to the US

Recycled phone numbers still linked to the previous owner’s online accounts

Text messages studied on public “receive SMS” websites

SIM cards seized in one SIM farm network near New York, September 2025

  • Figure: More than 100,000 cards in 300+ SIM servers
  • Source: The Register

How long US carriers must keep toll call billing records

Countries that share the +1 North American numbering plan

Required accuracy for wireless 911 location in the US

  • Figure: Within 50 meters for 80% of calls; floor level within 3 meters
  • Source: FCC

Monthly rent for one US phone number from major platforms

One pattern jumps out. Text scam losses rose fivefold while the number of reports went down. Fewer people are reporting, but each report involves far more money. That is what happens when criminals can test cheap numbers until something works.

Can police trace a VoIP number? Here is the real process, step by step

Yes, police can trace a VoIP number, but never in one jump. Each company in the chain needs its own legal order, and each one only hands over the next clue. Here is how a typical case unfolds when a victim in Canada or the US reports threatening or fraudulent texts.

1. The victim reports it. The victim brings screenshots showing the full sending number, the exact date and time, and their time zone. The texts stay on the phone. Deleting them can destroy evidence.

2. Investigators identify the carrier of record. Using the NPA-NXX block and the porting database, they find which company currently controls the number. For an app number, that is usually a wholesale carrier, not the app.

3. They send preservation requests right away. Before any court order, police ask each company to freeze the records so they are not deleted. In the US this is a preservation letter under 18 U.S.C. 2703(f). In Canada it is a preservation demand under the Criminal Code. This step is the most time-sensitive of all, for reasons I will explain shortly.

4. They ask a court for authorization. A judge decides whether the evidence justifies forcing a company to reveal who is behind the number. In the US, basic subscriber records can be obtained with a subpoena, while message content needs a warrant. In Canada, a production order is needed, and the Supreme Court has ruled that people have a reasonable expectation of privacy in both their subscriber information (R v Spencer, 2014) and their IP address (R v Bykovets, 2024).

5. The order goes to every relevant phone provider. If the attacker’s number is in the same country, the order is served directly. Most providers reply “this is not our customer.” One answers “this number belongs to a wholesale customer of ours.”

6. The wholesale carrier points to its customer. Bandwidth’s own law enforcement guide explains why: it mostly sells numbers wholesale to other companies, so its customer is the only one that can identify the end user and how the number was used. Investigators now need a new order addressed to that customer.

7. The app finally answers. Say the trail ends at TextNow. TextNow states that it accepts legal orders from Canada and the United States and requires the number, a specific list of data, and the exact date range and time zone, because numbers get recycled. The response can include the name, email, date of birth, sign-up IP, login IPs, and the dates the user held the number. If the user turned on two-factor authentication with another phone number, that number shows up too.

8. The IP address opens a new branch. If it belongs to a home internet provider or mobile carrier, one more order reveals the account holder at that time. If it belongs to a VPN or hosting company, often located in another country, investigators need yet another order, and frequently an MLAT. If it leads to Tor, the trail usually ends.

9. The email opens another branch. A Gmail or Apple account can reveal a recovery phone number, other logins, and payment details. Another order, another wait.

10. The pieces get stitched together. When the name, the payment method, the IP history, and the recovery number all point to the same person, investigators finally have a suspect.

The chain runs left to right until the app hands over an IP address and an email, then splits into three branches that each need their own order before the clues meet.

Now you see why a scammer who used a fake name, a throwaway email, and a VPN is not invisible. They are just expensive to find. Each fake detail adds another company, another order, and another delay.

The three things that slow every case down

In theory, the process above is clean. In real life, three problems turn weeks into months: reseller chains, borders, and the data retention clock.

1. The reseller of a reseller of a reseller

Phone numbers are resold like wholesale goods. A big carrier sells a block of numbers to a platform. The platform resells some to a smaller company. That company packages them into a “virtual number” service and sells them to someone else. Nobody in the chain is doing anything wrong. That is just how the business works.

But for investigators, every link is a separate company, often with its own lawyers, its own address for legal service, and sometimes its own country.

When I spoke with the SPVM, Montreal’s police service, its cybercrime investigation unit confirmed to me that it has seen chains of eight resellers. A reseller of a reseller, eight levels deep, before investigators finally reached the original provider. Each level meant a new legal order and a new wait.

Remember Bandwidth’s own explanation: its wholesale customer is the only one who can identify the subscriber, and that customer may buy numbers from several other wholesalers too. Multiply that by eight and you can see the problem.

2. Borders and the MLAT process

If any link in the chain sits in another country, a local court order is no longer enough. Police need a Mutual Legal Assistance Treaty request, or MLAT.

An MLAT is a formal agreement between two countries to help each other gather evidence for criminal cases. Here is how a request typically travels:

  1. The investigator and a prosecutor draft the request.
  2. It goes to their own country’s central authority. In Canada that is the International Assistance Group at the Department of Justice. In the US it is the Department of Justice’s Office of International Affairs.
  3. That authority sends it to the foreign country’s central authority.
  4. The foreign authority reviews it against its own laws, then asks its own court for an order.
  5. Local police or prosecutors serve the order on the company.
  6. The evidence travels back the same way.

Many people assume Interpol handles this. Interpol is very useful for fast police-to-police contact and early warnings, but the formal evidence request still moves between justice ministries.

And it is slow. The US President’s Review Group found that foreign MLAT requests to the US take about 10 months on average. The SPVM’s experience matches that closely. Investigators told me requests are commonly sent back two or three times, usually without a detailed explanation. The investigator and the legal team adjust the wording, add detail, or reframe it to fit the other country’s legal standard, then resubmit. Around nine months later, the company’s answer finally arrives.

Here is a practical example. TextNow is a Canadian company and accepts orders directly from Canadian and US authorities. Its own page notes that US law enforcement is exempt from the MLAT process. But a police force in France or Morocco would need an MLAT to reach the very same records.

Some countries are building shortcuts. The US CLOUD Act lets it sign agreements that allow certain foreign orders to go straight to US companies, and it has done so with the UK and Australia. The Budapest Convention on Cybercrime also runs a 24/7 contact network to help preserve data quickly. But for most cases, MLAT is still the road.

3. The data retention clock

This is the part that frustrates investigators the most. Time is evidence. Every week of delay is a week in which the logs can disappear.

There is no general law in Canada or the US that forces an app to keep IP logs for a set period. Each company decides. Some keep IP history for about two weeks. Others keep it for months. Even TextNow states that it cannot guarantee the retention of all user data.

The one long US retention rule you may hear about, 47 CFR 42.6, requires carriers to keep toll call billing records for 18 months. It covers billed long-distance calls on traditional carriers. It does not cover an app’s login IP addresses.

At the same time, privacy laws push companies to delete data sooner:

  • In Quebec, section 23 of the private sector privacy act, updated by Law 25, requires a business to destroy or anonymize personal information once the purpose for collecting it has been achieved.
  • In Europe, the GDPR limits how long data can be kept and gives people a right to have it erased.
  • Many services delete accounts after a period of inactivity, or immediately when the user deletes the account.

Put those together and you get a race. The scammer deletes the account the day after the scam. The victim reports it a week later. The court order takes a month. The reseller chain takes three more. By the time the request reaches the right company, the IP log is gone.

That is why preservation requests in step 3 matter so much. They stop the clock while the legal paperwork catches up.

How are phones physically located? Mobile, landline, and VoIP compared

A mobile phone can be located from the cell towers it talks to and from its own GPS. A landline is tied to a known street address. A VoIP line has neither, so it usually can only be placed through its IP address or the address the user typed in.

This is a big reason disposable VoIP numbers are attractive to criminals. Let me walk you through each method.

Mobile phones: from towers to GPS

Cell ID. Your phone is always connected to a nearby tower, and each tower is split into sectors, like slices of a pie. Simply knowing which tower and which slice your phone used puts you inside a wedge-shaped area. In a dense city that can be a few hundred meters. In the countryside it can be several kilometers.

Triangulation (more precisely, multilateration). Your phone can usually hear several towers at once. The network can measure how long the signal takes to travel and how strong it is at each tower. Each measurement draws a rough circle of possible locations around one tower. Where three or more circles overlap, there is your phone. Think of three friends in a park who each tell you “I’m about 200 steps from the phone.” Only one spot fits all three.

GPS and assisted GPS. Modern phones calculate their own position from satellites, helped by data from the network to speed things up. This is far more precise than tower math, often within a few meters outdoors.

Hybrid device location. When you call 911 today, Android and iPhone can send a location built from GPS, nearby Wi-Fi networks, and towers combined. In the UK and much of Europe this system is called Advanced Mobile Location. These methods are why the FCC can now require US carriers to locate wireless 911 callers within 50 meters for 80% of calls, and within 3 meters vertically to identify the right floor.

For criminal investigations, police can also request:

  • Historical cell site records: which towers a phone used over past days or weeks. In the US, the Supreme Court ruled in Carpenter v. United States (2018) that police generally need a warrant for this.
  • A tower dump: a list of every phone that connected to a given tower during a given time window. Useful when you know where and when a crime happened but not who did it.
  • Real-time location: in emergencies such as a kidnapping, carriers can “ping” a phone and return its current location.

Landlines: the easiest to locate

A traditional landline ends at one physical address. The phone company keeps that address in the database used by 911, so the call arrives already showing the street, and the switch records show exactly which line placed a call. For investigators, this is the simplest case.

VoIP: the hardest to locate

A VoIP number has no tower and no copper line. Here is what investigators can work with:

  • The IP address, which only gives an approximate city on its own. The internet provider can match it to a subscriber’s service address, but only with a court order and only if the logs still exist.
  • The registered 911 address, which the user typed and can be false or outdated.
  • Wi-Fi network names or GPS, but only if the app collected them with the user’s permission.
  • Billing details, if the user paid for a premium plan.

So a disposable VoIP number does not hide a criminal by magic. It simply removes the two easiest location tools, the tower and the wire, and forces investigators to go through companies and courts instead.

SIM farms and the “receive SMS online” business

A SIM farm is a rack of hardware holding dozens to thousands of real SIM cards, connected to a computer that reads every incoming text automatically. Some operators use them to sell one-time access to real mobile numbers, mostly so customers can receive a verification code and create accounts without using their own phone.

Remember the line type check from earlier? Many platforms reject VoIP numbers at sign-up. A real mobile SIM number passes that check. That single fact created an entire underground market.

How the business works

In simple terms, the setup looks like this:

  • SIM cards, often prepaid, bought in bulk.
  • GSM modems or “SIM banks”, boxes that hold many SIMs at once and act like many phones in one.
  • SMS gateway software that collects every incoming text from every SIM and stores it in one place, a bit like a small private text message center.
  • A website or API where customers pay a few cents or dollars to “rent” a number for a few minutes and see the code that arrives.

The customer gets a fresh, real mobile number for one sign-up. The operator rotates through SIMs and replaces them as platforms catch on.

Academic research has been watching this for years. A study presented at the IEEE Symposium on Security and Privacy in 2016 analyzed nearly 400,000 texts sent to public SMS gateway sites over 14 months. The researchers concluded that these gateways were mainly used to get around account creation rules that require a verified phone number. A later study from NC State, presented at the same conference in 2024, used SMS gateways to map hundreds of SMS phishing operations.

When SIM farms become a national security problem

In September 2025, the US Secret Service dismantled a network of SIM farms around New York City with more than 300 SIM servers holding over 100,000 SIM cards, all within 35 miles of the United Nations. Investigators linked the network to threats against senior US officials and warned it had enough capacity to overwhelm cell towers across the city.

That case is extreme, but the building blocks are the same ones used by small “receive SMS” sites.

The irony for investigators

Here is something most people miss. A SIM farm is often easier to locate physically than a VoIP app user. Every SIM card connects to real cell towers, so the carrier can see where thousands of SIMs are sitting in one spot, day after day. That pattern is a giant red flag.

What is harder is finding the customer who bought a single code from the farm for two minutes, usually paid in cryptocurrency. That is just another reseller chain, only this time the product is a verification code instead of a phone number.

A quick note on the law: owning SIM cards or a GSM modem is not illegal in itself, and many businesses use them for alarms, IoT devices, and testing. But using them to bypass verification breaks carrier and platform terms of service, and in many countries using SIM boxes to reroute calls or commit fraud is a crime.

What to do in the first 24 hours if a disposable number targets you

Act fast and keep everything. Because companies delete logs on their own schedule, the speed of your report can decide whether the sender is ever identified.

  1. Do not reply and do not click any link. Replying confirms your number is active.
  2. Screenshot everything. Capture the full sending number, every message, and the date and time. Note your time zone, since the company will need it to match records.
  3. Do not delete the conversation. Investigators may need the original messages on your device.
  4. Report the text to your carrier by forwarding it to 7726 (SPAM), as the FTC recommends. This helps carriers block the same sender.
  5. File an official report. In the US, use ReportFraud.ftc.gov and the FBI’s IC3. In Canada, contact the Canadian Anti-Fraud Centre and your local police.
  6. Go to the police quickly if there are threats, extortion, or money lost. Ask the officer whether preservation requests can be sent to the providers right away.
  7. Lock down your own accounts. Move two-factor authentication away from SMS to an authenticator app or passkey, and ask your mobile carrier to add a port-out PIN so nobody can hijack your number.

Want to know if the number is a VoIP number? Type its first six or seven digits into Local Calling Guide. If the block belongs to a wholesale VoIP carrier rather than a mobile network, you are probably dealing with an app number. That is useful information to include in your police report.

Frequently asked questions

Can a TextNow number be traced? Yes. TextNow keeps account records such as the email, sign-up IP address, login IPs, and the dates a number was assigned, and it releases them to verified Canadian and US law enforcement with a valid court order. Police in other countries usually need an MLAT. Public lookup tools can only tell you that a number is a TextNow or VoIP number, not who owns it.

What is a DID number? A DID (Direct Inward Dialing) number is a phone number that routes calls and texts to an internet-based phone system instead of a physical line or SIM card. Businesses and apps rent DIDs from wholesale carriers and can attach thousands of them to one system.

How much does a disposable phone number cost? Wholesale platforms list US local numbers at about $0.50 to $1.15 per month, plus a fraction of a cent per text. Free apps like TextNow give numbers away and earn money from ads and paid plans.

Can police trace a VoIP call or text? Yes, but it takes a chain of legal orders: the carrier that owns the number, any resellers, the app that assigned it, and finally the internet provider behind the user’s IP address. Within one country this can take weeks. Across borders it often takes many months.

Does a VPN make someone untraceable? No, but it adds a hard step. Investigators must then send an order to the VPN company, which may be in another country and may keep few or no logs. Other clues like email accounts, payment details, and recovery phone numbers often identify the person anyway.

Why did my VoIP 911 call go to another city? VoIP 911 calls are routed using the address registered in your account, not your real location and not your area code. If the registered address is old or wrong, the call can reach a 911 center in another city. Update your address in every VoIP app each time you move.

How long does an MLAT request take? Foreign MLAT requests to the US take about 10 months on average, according to the President’s Review Group. Requests are often returned for changes several times before they are accepted.

What does NPA-NXX mean? NPA is the area code and NXX is the three-digit exchange that follows it. Together they show which rate center and which carrier a block of numbers was originally assigned to.

Is it illegal to use a disposable phone number? No. Many people use second numbers for privacy, online selling, dating, or work. What is illegal is using any number to commit fraud, harassment, threats, or other crimes.

Final thoughts

Disposable numbers are not magic invisibility cloaks. They are cheap leases on a database entry, passed through a chain of companies that each hold one piece of the puzzle.

What protects the people behind them is not technology. It is friction: resellers stacked on resellers, borders, MLAT requests bounced back two or three times, and logs that quietly expire while the paperwork moves.

The best thing you can do as a victim is report fast and keep every detail. The best thing lawmakers and companies can do is shorten that chain, with clear retention rules for identifying data and faster cross-border cooperation.

Have you ever received a threatening or scam text from a number that seemed to vanish? Did your report go anywhere? Tell me in the comments. I read every one.

Sources

Disposable Phone Number
Voip
Sip
Fraud Detection
Fraud Prevention

--

--

Daniel Absi
Daniel Absi

Written by Daniel Absi

11 followers
1 following

Help

Status

About

Careers

Press

Blog

Store

Privacy

Rules

Terms

Text to speech