Why a number with a verified owner keeps working for codes

What a service is really asking

A phone number on an account is a promise: this is a real person, and they'll still be reachable here when they get a new laptop or forget their password. Services have learned which kinds of numbers tend to keep that promise and which don't.

Why services filter VoIP and rented numbers

Internet numbers are cheap and quick to create, so they show up wherever fake accounts do. Twilio, which sends codes for a lot of companies, tells its customers: “VoIP numbers are often correlated with bots and don't have the same assurance that you're interacting with a real and unique user” (Twilio).

Security guidance points the same way. NIST's earlier digital identity guidelines said methods “that do not prove possession of a specific device, such as voice-over-IP (VOIP) or email, SHALL NOT be used” (NIST). The current revision tells verifiers they “SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior)” (NIST).

Rented and shared numbers have a different problem: reuse. A number that changes hands every week receives codes for whoever held it before, and ends up attached to accounts nobody intends to keep. Services don't publish their fraud rules, so we can't tell you exactly what each one checks. But from the outside the logic is plain: a number with a long line of strangers behind it is the opposite of the promise above. How line-type checks work.

What recycled numbers do

Even ordinary mobile numbers get passed on. The FCC puts it at “Approximately 35 million numbers are disconnected and made available for reassignment to new consumers each year”, and it set “a minimum aging period of 45 days” before a disconnected number goes to someone new (FCC). For residential numbers the rule is a floor and a ceiling: they “may be aged for no less than 45 days and no more than 90 days” (eCFR).

In 2021, Princeton researchers Kevin Lee and Arvind Narayanan sampled numbers that two major carriers offered to new customers (Princeton):

• Princeton, on accounts

  “171 of 259 numbers we sampled were vulnerable to account hijackings at six popular websites”

  https://recyclednumbers.cs.princeton.edu/

• Princeton, on codes

  “still receiving sensitive communication meant for previous owners, such as authentication passcodes”

  https://blog.citp.princeton.edu/2021/05/03/phone-number-recycling-creates-serious-security-and-privacy-risks-to-millions-of-people/

That second finding was 19 of the 200 numbers they watched, in a single week (Princeton CITP). Their main advice to people changing numbers was to “park the number” as a cheap second line rather than let it go. The lesson for anyone relying on SMS codes is the same one: the number matters less than who holds it, and for how long.

Why Cleat asks every line owner to verify

We can't control how a service scores numbers. We can control who is behind ours. So a Cleat line shows its texts to nobody until the person who owns it has verified their identity. One line, one known person, for as long as they subscribe.

• No stream of strangers. A line isn't passed around by the week or shared with the public, so its history stays one person's history.
• No verifying for someone else. We can refuse, pause or remove access when a check fails, looks fraudulent, or was done on someone else's behalf. Our rules.
• Clear limits on use. Our Terms rule out fraud, impersonation, receiving texts meant for someone else, and reselling lines.

And the honest limits of it:

• A service never sees your ID. It sees a US mobile number. Verification keeps our numbers clean over time; it doesn't hand you a pass.
• It isn't a guarantee. Most services that turn away VoIP accept a real mobile line. No provider can promise that every service accepts every number.
• Your number may have had an owner before. Like almost every US number, a Cleat number is assigned from available inventory, and we can't promise it's never been used.
• Ours get recycled too. If billing ends, we hold your number for 30 days, then release it, and it may later go to someone else. Move your accounts off it first.

What we keep, and what we don't

Your ID document and selfie go to Stripe, which checks them. Cleat receives the outcome and a reference to the check, not copies of your ID or selfie, and doesn't store ID images. If you choose the ID-only option, a person at Cleat reads Stripe's result live, such as the document type, issuing country and expiry date, before approving it. Stripe handles that data as our service provider under its privacy policy.

For the line itself, we keep what it takes to run it: the texts your line receives (sender, message, time and any code we detect), transcripts of calls to it, your account details and your settings. Texts are visible only to members of your workspace. Everything is in our Privacy Policy, including how long we keep it.

What it means if you're buying a line

1. 01You verify once, in about two minutes, with a government ID and a selfie through Stripe. Rather not take a selfie? Choose ID-only and a person reviews it.
2. 02You can pay first. Your texts wait until you've verified.
3. 03The line is in your name, so buy it for yourself or your company, not for someone else. If a client wants an account in their own name, they should own the line.
4. 04Teammates don't verify. They accept an invite and see the codes. Cleat for teams.
5. 05Keep the line as long as accounts depend on it. That's the Princeton lesson in practice. Yearly billing is $249.90, two months free; see pricing.

If you'd rather not show an ID to anyone, Cleat isn't the right product for you, and that's a fair choice. Google Voice next to Cleat covers a free option and what it trades away.