disposable

Published by an SMS-receiving website

The Spaw phone risk signal disposable adds 70 points to risk_score when an SMS-receiving website publishes the number, so anyone can read a code sent to it: the open lists Spaw merges every day carry it and saw it recently (dataset disposable-phone-numbers).

risk weight: +70
dataset: disposable-phone-numbers
reads from: is_disposable, disposable_seen_at
default SMS policy: blocks it: disposable is one of the default block_signals (fictional, disposable, reported_abuse, reported_abuse_widely, premium_rate).

What it means

SMS-receiving websites rent numbers and print every message that reaches them on a public page, so a verification code sent there is readable by anyone who opens it. Spaw merges two open lists, from iP.1 Networks and Castle (both MIT), into one table every day and keeps the date each number was last seen in disposable_seen_at.

A listing is fresh, and scores this weight, while the lists still carry the number and it was seen within the last 365 days (an undated listing counts as fresh), or, once every list has dropped it, for 90 days after it was last seen. After that it scores disposable_stale (+40) instead; the two never fire together. A number the lists dropped is kept at its last-seen date for 730 days, so it ages rather than vanishing.

What it cannot tell you

It cannot tell you that the number is still rented out. The sites recycle numbers, and one they stopped showing may belong to a real subscriber today, which is why the weight drops once a listing is stale.
It knows only the numbers the open lists publish. Many SMS-receiving numbers are never scraped into a list, so is_disposable false means not listed, not safe; disposable_range covers the unlisted neighbours of listed numbers.

What to do

Refuse it for a one-time code or an account recovery number and ask for another. The default SMS policy blocks on it: an answer carrying it is ok_to_send false whatever the score.

The SMS policy is set per account with PUT /api/v1/phone/policy or the dashboard’s SMS policy tab, and its block_signals may list any signal, this one included; the phone guide lists every rule and its default.

Example response

The sandbox answer for the test number +1 202-555-0103, cut to the fields that matter here. Test numbers are free on every key and name the dataset test-numbers; a live lookup names disposable-phone-numbers.

{
    "valid": true,
    "e164": "+12025550103",
    "country": "US",
    "line_type": "mobile",
    "is_disposable": true,
    "risk_score": 70,
    "risk_level": "high",
    "risk_signals": [
        {
            "signal": "disposable",
            "weight": 70,
            "dataset": "test-numbers"
        }
    ],
    "ok_to_send": false,
    "blocked_by": "disposable"
}

A real answer carries every field, listed in the validate-phone reference; the weights of every entry in risk_signals sum to risk_score, capped at 100.

markdown version: /docs/signals/phone/disposable.md

disposable

What it means

What it cannot tell you

What to do

Example response

Related