The Virtual Phone Farms Scammers Use to Set Up Fake Accounts

When a scammer wants to set up an account on Amazon, Discord, or a spread of other online services, sometimes a thing that stands in their way is SMS verification. The site will require them to enter a phone number to receive a text message which they’ll then need to input back into the site. Sites often do this to prevent people from making fraudulent accounts in bulk.

But fraudsters can turn to large scale, automated services to lease them phone numbers for less than a cent. One of those is 5SIM, a website that members of the video game cheating community mention as a way to fulfill the request for SMS verification.

“I used 5 sim too. I have every region number,” one member of a Telegram group focused on online video game cheating wrote. Video game cheaters sometimes need to either buy or create accounts so once a game bans them, they can quickly switch to a new account. Some people also sell phone verified accounts in bulk.

On its website, 5SIM says “Today a lot of sites require SMS verification code for registration account. If you do not want to use your personal phone number to verify or activate account, use phone number 5SIM. Thus, there is no need for a SIM card in your mobile phone, only need access to the Internet.” Users can select phone numbers from all over the world.

Various YouTube videos uploaded by the company explain how people can use its service explicitly for getting through the SMS verification stage of various sites. The videos include instructions specifically on PayPal, Instagram, Facebook, Telegram, and dating site Plenty of Fish.

Instagram told Motherboard it is concerned by sites that suggest people can use services to bypass Instagram’s measures to then abuse the platform. Instagram said it uses SMS verification to prevent the creation of fake accounts and to make account recovery possible.

“We have many measures in place to protect against scripted account creation and block millions of fake accounts at registration every day,” an Instagram spokesperson said.

A Discord spokesperson said in an email that “Discord uses phone verification as an anti-abuse tool, particularly for spam reduction.”

“We are aware that the type of service you refer to can be used for abuse, and we usually block them when we become aware of them,” the spokesperson added.

Some online services don’t allow users to perform SMS verification with VoIP numbers, presumably in an effort to mitigate against fraud. 5SIM’s numbers, however, are just like ordinary phone numbers, the site claims. Discord said it requires a valid mobile number.

“Real numbers,” one of the YouTube videos says. “No VoIP,” adds another.

When people buy 5SIM’s services, they must only use it for receiving texts related to an online account. “Different SMS will [be] rejected,” the website adds. 5SIM also offers an API to automate parts of the service.

5SIM’s rules say that customers are “Forbidden to use the service for any illegal purposes as well as not to take actions that harm the service and (or) third parties.” The website also includes a denylist of words that its service may block.

5SIM told Motherboard in an email that “5sim service is prohibited to use for illegal purposes. In cases, where fraudulent operations with registered accounts are detected, restrictions may be imposed on the 5sim account until the circumstances are clarified. 5sim is used by those who want to get a discount or bonus, webmasters, SMM specialists, owners of business for advertising and increasing business loyalty.”

Subscribe to our cybersecurity podcast, CYBER. Subscribe to our new Twitch channel.