Thousands of Britons are running the risk of having their personal data harvested by using Russian and Chinese companies while shopping online or using dating apps, The i Paper can reveal.
These firms offer temporary UK phone numbers to consumers looking to protect their privacy online, allowing people to obtain verification codes to open or use accounts with online brands such as Amazon or services such as dating websites – while remaining anonymous.
But officials warn that data gleaned from Russia-based temporary phone number sites could provide Moscow with another tool in its escalating “grey zone” war against Britain and its allies by enabling cyber attacks and disrupting the digital economy.
Shorts
Incidents including arson attacks on infrastructure and defence manufacturing sites, and a Russian warship firing warning shots at a British yacht in the English Channel, form part of a multi-layered Russian campaign aimed at eroding support for Kyiv.
Among the tactics is the widespread use of fake or hijacked social media accounts to spread disinformation – and even to recruit low-level criminals who may not know they are being hired to carry out acts of sabotage.
The lucrative trade in temporary phone numbers, which is estimated to be worth about £2bn a year, is dominated by providers in Russia and China and centred on the bulk buying of mobile SIMs.
The “virtual” numbers they create are then rented out to multiple users for as little as 20 minutes at a time to receive text messages containing online verification codes. The price of the service can be as low as 3p per verification text, with some providers also offering numbers for free.
Data vulnerable to Russian ‘grey zone’ tactics
The system, which is entirely legal in the UK, has drawn warnings that it is widely used by scammers to create fake social media profiles and other online identities used for fraud and misinformation.
But it also increasingly attracting people who want to avoid providing their personal mobile phone number – and thereby avoid unwanted spam text messages – when signing up to websites from clothes shops to gambling portals, as well as loyalty apps for high-street cafes and food outlets.
Several of the websites providing the disposable numbers make a selling point of allowing users to conceal their identity from online platforms. One states its service allows customers to “maintain anonymity on social networks, instant messengers and forums”.
The practice is thought to be particularly useful for dating websites where users do not want to provide their established contact details.
But security sources and experts warned that rather than protecting the identity and personal data of users, the information being transmitted risks being harvested by unscrupulous providers or used to hijack accounts after they have been set up by resetting passwords.
One recent University of Cambridge study found that of the 12 most heavily used temporary phone number websites, seven were based in either Russia or China, or rely on Russia or Chinese payment systems. Other large-scale providers are based in countries including Belarus, Nigeria and Vietnam.
A UK digital security official said: “These virtual numbers are inherently unsafe when they are hosted by providers based in authoritarian, hostile or poorly-regulated jurisdictions. The numbers can be easily reallocated to different users who can reset account passwords and access conversations, data or files.
“The fundamental issue is that any data which passes through a Russian or Chinese-owned entity is subject to surrender to the state. There is a trove of personal information waiting to be weaponised by Moscow or Beijing should they wish to do so.”
Lukasz Olejnik, a specialist in cyber security at King’s College London, said a key problem arose when the temporary number used to set up an online account remained linked to it but was no longer controlled by the user.
He said: “If a temporary number remains linked to an account […] the user may lose control of that account, including saved data once they lose access to the number. A subsequent user of such a service could also potentially obtain verification or recovery messages intended for the original account holder.”
Olejnik pointed out it was also likely that number vendors would be able to see the messages being sent on their systems and link that to other information available about users.
How many people are using temporary numbers?
It is a burgeoning industry which has seen the number of authentication messages sent globally from temporary phone numbers rise from thousands per year a decade ago to hundreds of millions.
Analysis earlier this year by GSMA, a London-based cyber security company, found more than 200,000 disposable numbers were in operation at any one time, receiving an average of 1,000 verification codes per day – implying a capacity for as many as 200 million authentication messages a day.
Disposable UK mobile numbers are among the cheapest available on vendor sites, and industry sources told The i Paper it is estimated that up to 25 per cent of messages originate from authentic users who are exploring a service or seeking to protect privacy.
One executive with a verification software provider said this would translate to tens of thousands of individuals per year in a market such as the UK.
Some UK-based subscribers are thought to be using the temporary numbers for “discount farming”, whereby individuals sign up to the same brand with differing credentials to repeatedly benefit from inducements such as introductory price reductions, free delivery and free bets offered by gambling sites.
Sites examined by The i Paper offered the ability to generate verification texts for dozens of UK platforms ranging from eBay and WhatsApp to SkyBet and Tinder and online ordering for Greggs and upmarket bakery Gail’s.
While such practices may contravene the terms and conditions of providers, they are unlikely to be illegal unless being used to commit large-scale fraud or deception. None of the companies named responded to requests for comment.
People use codes to access NHS and benefits
An analysis of traffic on one temporary phone number site by The i Paper, which handles some 200,000 verification messages on UK numbers a month, suggested some customers are also using the service to attempt to access NHS apps and the benefits system, as well as setting up bank accounts.
Messages sent via one Russia-based provider included authentication codes for the NHS and the gov.uk website, as well as apparent codes for universal credit applications.
A recent study by Spanish academics at Madrid’s Carlos III University, which looked at 70 million messages generated by 29 number vendors in multiple countries, said it had also found evidence of disposable numbers being used “for registering to medical services such as the British NHS”.
The analysis found “sensitive information being sent over [text message] after the user has registered for the service”, including some cases where names and surnames had accompanied messages.
NHS England declined to comment on the findings but sources underlined that the use of authentication codes was just one part of a layered security system. Health service guidelines state that health records and personal information cannot be accessed where only a phone number or email are provided.
A spokesperson for the Department for Work and Pensions said: “DWP has a range of checks and verification processes in place to confirm eligibility before benefits are awarded. We also continually review and respond to evolving risks to help protect customer accounts, services and public money.”
A gateway to criminality
However, there is evidence that SIM card verification is also a gateway to serious criminality.
Late last year, police in Latvia arrested members of a gang operating two virtual phone number websites – gogetsms.com and apisim.com – whose services were then used to commit more than 3,000 online frauds across Europe netting more than €5m (£4.3m).
Europol said the group had generated as many as 49 million fake online accounts which were then sold to other online crooks to carry out a wide array of offences from defrauding users of online second-hand market places through to migrant smuggling.
The ability to post videos using fake online identities has proved vital to criminal activity targeting the UK, including the use of TikTok accounts to advertise small boat migrant routes across the English Channel.
Other uses of the temporary phone number system include the establishment of multiple social media accounts, some of them curated over several months to thwart algorithms used to detect automated accounts. These are then sold as “bot” networks used in online influence operations to spread misinformation.
Jon Roozenbeek, who heads Cambridge’s Influence and Technology Lab, said it appeared that the SIM card system was being used for a wide spectrum of purposes. “We are still investigating what is going on here. More than likely it’s a mixture of relatively innocent opportunism, fraud or unethical behaviour, and influence operations. But we cannot really say yet in what proportion.”
