How SMS Verification Actually Works — A Plain-English Guide

You click "Send code," a text arrives, you type six digits, you're in. Ever wonder what actually happens in those 12 seconds? Here's the whole pipeline — and why some SMS codes never arrive.

The 30-second summary

When an app sends you a verification SMS, seven different systems have to cooperate: the app's backend, an SMS gateway, a carrier network, a routing hub, your carrier, your SIM, and finally your phone's OS. Any one of them can silently drop the message. When a virtual number "doesn't work," it's almost always one specific link in this chain — and knowing which one tells you how to fix it.

Step 1: The app decides you need a code

Your favourite app (Telegram, WhatsApp, Google, Instagram) doesn't send the SMS itself. It hands the job to an SMS gateway provider — Twilio, Vonage, MessageBird, Sinch. These are companies whose job is exactly one thing: accept "please send this text to this number" requests over an API and deliver the SMS worldwide.

The gateway does its own fraud checks first. Is the destination number on a known-abused list? Is the sender's app hitting rate limits? Is the number a virtual number (VoIP, provisioning-only, non-mobile)? If any check fails, the gateway can silently drop the message or return an error to the app. Some apps show you "please try again in a moment" — that's often the gateway saying no.

Step 2: The gateway routes to a carrier network

Gateways don't have their own cell towers. They have contracts with hundreds of mobile network operators (MNOs) — Vodafone, T-Mobile, AT&T, Orange, Bite, Tele2, thousands more globally. To send you a text, the gateway picks the shortest path to a carrier that can reach your number.

This routing decision is quality-differentiated. Premium routes use direct connections to your carrier and cost the app more (think €0.05 per SMS). "Grey" routes bounce through intermediaries and cost €0.005 but arrive later or occasionally not at all. Apps choose which route to use based on you — the destination country, the app's tier of user, and fraud signals.

Step 3: The SS7 network moves the message

Between carriers, SMS moves over a decades-old signalling protocol called SS7. Think of it as the cellular equivalent of email's SMTP. When Vodafone UK needs to hand off a text destined for a Tele2 Lithuania subscriber, they don't push it directly — they hand it to an SS7 exchange, which routes it based on the destination number's country code and prefix.

SS7 is famously insecure (there's a whole field of exploits around it) and famously slow when overloaded. If the SS7 hub between two carriers is congested (usually early morning European time when many services flush their overnight queues), an SMS can be delayed 5-30 seconds. Sometimes hours. Sometimes forever if a hub retries fail.

Step 4: Your carrier delivers to your SIM

Your local carrier gets the message and sees which SIM to deliver it to. The SIM is the actual identifier — the phone number is just a friendly label attached to it. If the SIM is switched off, the carrier holds the message for up to 72 hours and retries. If the SIM has been reassigned or ported to another carrier, delivery routing has to update — this is why porting phone numbers sometimes breaks 2FA for a few days.

For virtual numbers, "your SIM" is really a database entry at the virtual-number provider's platform. When a text arrives, their backend records it and exposes it via API to whoever paid for that number (that's how sms.1mail.lt shows you your code — we poll the upstream API on your behalf).

Step 5: Fraud filters at the last mile

Even if the SMS made it all the way to the recipient's carrier, one last filter can block it: the recipient's own carrier fraud filter. If a virtual-number range has been used for spam, phishing, or A2P abuse, the carrier might silently drop incoming messages to that range. From the sender's side, everything looks fine — "message delivered." From the recipient's side, nothing arrives.

This is the single most common failure mode for virtual-number SMS verification. It's why we constantly rotate our number pool and why some countries in our stock deliver 90%+ of the time while others hover around 60%. Countries where carriers have aggressive filtering (US, Vietnam, Nigeria for WhatsApp) drop virtual-number SMS regularly. Countries with lighter filtering (UK, Netherlands, Lithuania) reliably deliver.

Why virtual numbers get "used up"

Every time a virtual number is used to sign up for a service, that service adds the number to its internal registration ledger. If you try to sign up for Telegram with a number that's already registered a Telegram account, Telegram will tell you "this number is already in use." That's why the same number can't be used twice for the same service.

Providers work around this by cycling numbers — we recycle a number back into the pool after ~24 hours of not being used, and services eventually clear the internal ledger (Telegram does after a few months of account inactivity). But there's a lag. Which means some numbers you buy will hit "already in use" collisions. Every reputable provider refunds these automatically.

What about 2FA codes for existing accounts?

The pipeline above describes first-time verification. For 2FA codes on an account you already own, the flow is identical but with one big change: the SMS is triggered by your login attempt, not a new registration. So the carrier fraud filters see a normal usage pattern (established account, moderate frequency) rather than a signup-spike pattern.

This is why virtual numbers work better for signup than for long-term 2FA. If you plan to keep an account long-term, transition off SMS 2FA as soon as possible: enable authenticator-app 2FA (Google Authenticator, Authy) or a backup PIN. If the app doesn't support those (some regional apps don't), you'll need to keep the same real phone number available.

Common myths

"Virtual numbers are illegal"

False. Virtual numbers are just phone numbers hosted at a service provider instead of on a physical SIM. Businesses use them for call centres, hotlines, testing environments, and many other legitimate purposes. Buying one to receive an SMS is legal in every country we operate in.

"If I use a virtual number, my account is more likely to get banned"

Not because of the number itself. Accounts get banned for behaviour (spam, ToS violations, abuse). Legitimate accounts with virtual-number signups have the same standing as SIM signups. What does get you banned: creating 50 accounts in an hour using virtual numbers, which is the pattern actual spammers use.

"Free tempsms sites are the same thing"

Different. Free tempsms services show public inboxes — any incoming SMS to their number is visible to anyone on the site. Fine for a signup you don't care about; disastrous if someone else grabs your code first, or if the code contains personal info. Paid virtual numbers give you an exclusive session — the incoming SMS is only visible to you.

The takeaway

SMS verification is a 7-hop pipeline where any hop can silently fail. When "your code didn't arrive" happens, the failure is usually invisible to you — it happened somewhere upstream between the app and your number. The fix is almost always: try a different country, try a different provider, or transition to a non-SMS 2FA method as soon as the account is active.

For SMS-based signups where the code just needs to work once, virtual numbers are the fastest, cheapest, most privacy-preserving option. If you're on this article because you need to sign up for something today, our Telegram, WhatsApp, and Telegram guides have specific tips for each service.