# `disposable` (phone): published by an SMS-receiving website

The Spaw phone risk signal disposable adds 70 points to risk_score when an SMS-receiving website publishes the number, so anyone can read a code sent to it: the open lists Spaw merges every day carry it and saw it recently (dataset disposable-phone-numbers).

- Weight: +70
- Dataset: `disposable-phone-numbers`
- Read from: `is_disposable`, `disposable_seen_at`
- Default SMS policy: blocks it: disposable is one of the default block_signals (fictional, disposable, reported_abuse, reported_abuse_widely, premium_rate).

SMS-receiving websites rent numbers and print every message that reaches them on a public page, so a verification code sent there is readable by anyone who opens it. Spaw merges two open lists, from iP.1 Networks and Castle (both MIT), into one table every day and keeps the date each number was last seen in disposable_seen_at.

A listing is fresh, and scores this weight, while the lists still carry the number and it was seen within the last 365 days (an undated listing counts as fresh), or, once every list has dropped it, for 90 days after it was last seen. After that it scores disposable_stale (+40) instead; the two never fire together. A number the lists dropped is kept at its last-seen date for 730 days, so it ages rather than vanishing.

**What it cannot tell you.**

- It cannot tell you that the number is still rented out. The sites recycle numbers, and one they stopped showing may belong to a real subscriber today, which is why the weight drops once a listing is stale.
- It knows only the numbers the open lists publish. Many SMS-receiving numbers are never scraped into a list, so is_disposable false means not listed, not safe; disposable_range covers the unlisted neighbours of listed numbers.

**What to do.** Refuse it for a one-time code or an account recovery number and ask for another. The default SMS policy blocks on it: an answer carrying it is ok_to_send false whatever the score.

The SMS policy is set per account with `PUT /api/v1/phone/policy` (https://spaw.co/docs/api/update-phone-policy) or the dashboard's SMS policy tab, and its `block_signals` may list any signal, this one included.

The sandbox answer for the test number +1 202-555-0103, cut to the fields that matter here. Test numbers are free on every key and name the dataset test-numbers; a live lookup names disposable-phone-numbers.

```json
{
    "valid": true,
    "e164": "+12025550103",
    "country": "US",
    "line_type": "mobile",
    "is_disposable": true,
    "risk_score": 70,
    "risk_level": "high",
    "risk_signals": [
        {
            "signal": "disposable",
            "weight": 70,
            "dataset": "test-numbers"
        }
    ],
    "ok_to_send": false,
    "blocked_by": "disposable"
}
```

Related:

- [`disposable_stale`](https://spaw.co/docs/signals/phone/disposable_stale): published by an SMS-receiving website, but not recently
- [`disposable_range`](https://spaw.co/docs/signals/phone/disposable_range): not listed, but in a range crowded with SMS-receiving numbers
- [The weights table in the phone guide](https://spaw.co/docs/phone-intelligence#signal-disposable)
- [Stop OTP abuse with block data and disposable numbers](https://spaw.co/guides/stop-otp-abuse-with-block-data-and-disposable-numbers)
- [Glossary: SMS policy](https://spaw.co/glossary/sms-policy)

Reference: https://spaw.co/docs/signals/phone/disposable