  Short Message Service (SMS) is a popular channel for online service providers
to verify accounts and authenticate users registered to a particular service.
Specialized applications, called Public SMS Gateways (PSGs), offer free
Disposable Phone Numbers (DPNs) that can be used to receive SMS messages. DPNs
allow users to protect their privacy when creating online accounts. However,
they can also be abused for fraudulent activities and to bypass security
mechanisms like Two-Factor Authentication (2FA). In this paper, we perform a
large-scale and longitudinal study of the DPN ecosystem by monitoring 17,141
unique DPNs in 29 PSGs over the course of 12 months. Using a dataset of over
70M messages, we provide an overview of the ecosystem and study the different
services that offer DPNs and their relationships. Next, we build a framework
that (i) identifies and classifies the purpose of an SMS; and (ii) accurately
attributes every message to more than 200 popular Internet services that
require SMS for creating registered accounts. Our results indicate that the DPN
ecosystem is globally used to support fraudulent account creation and access,
and that this issue is ubiquitous and affects all major Internet platforms and
specialized online services.
