What a public SMS inbox cannot be used for

Every site offering free temporary numbers carries a line about not using them for sensitive accounts. It is usually buried and vague. It deserves to be specific, because the failure mode is not "slightly less private" — it is total loss of the account.

The threat model in one paragraph

A public inbox displays every message it receives to every visitor. If you register an account using that number, then anyone who can find the number can trigger a password reset on that service, read the code from the public page, and take the account. They do not need your password. They do not need to know anything about you except which service you used and which number you used. On a site that lists its numbers publicly, the second half is free information.

This is not theoretical or unusual. It is the ordinary consequence of the design, and it applies from the moment you register.

Accounts that must never use one

• Anything holding money. Banking, payment apps, crypto exchanges, remittance services. Recovery flows are built around SMS and the attacker's path is one step long.
• Government and identity services. Tax portals, benefits, immigration, health records. The data is not replaceable and the account often cannot be re-created.
• Your primary email. Email is the recovery route for everything else. Losing it loses the rest by cascade.
• Anything tied to your legal identity. Once a name and address are attached to an account whose recovery channel is public, the exposure is not limited to the account.
• Work accounts. Beyond your own risk, this is usually a policy breach.

The second failure: rotation

Services rotate their public numbers, typically daily. When the number changes, you permanently lose the ability to receive anything at the old one. Any account whose only recovery channel was that number is now unrecoverable — not by an attacker, just by you.

So a public number fails in both directions. Someone else can get in, and you can get locked out. An account you intend to keep needs a number you control.

What they are legitimately good for

The genuine use case is narrow and real: a one-time signup you do not intend to keep, where the service demands a phone number it has no business asking for. Reading a marketplace listing, downloading a file behind a gate, trying an app once, avoiding a marketing list. You want the code, you use the service, you never return.

That is worth something. Handing over a real mobile number to every service that asks has its own costs — marketing SMS, data-broker aggregation, and exposure in the next breach. For a throwaway interaction, a throwaway number is the right instrument.

Where the numbers themselves come from

One thing worth checking about any service in this category: whether the numbers it publishes are real people's numbers.

Many sites generate plausible-looking digits, and plausible-looking digits usually land in live carrier blocks. When that happens, the site is publishing a stranger's number as a public inbox — and every code it "receives" is either fabricated, or is somebody else's traffic. The person on the end of that number gets signup attempts from a service they have never used.

A service handling this properly draws from ranges regulators reserve for fiction — Ofcom's 07700 900xxx, the NANP's 555-0100–0199, ARCEP's 0639 98 block — or from ranges built to be undiallable. We wrote up the full list and the verification method in which phone number ranges are actually safe to publish.

The short version

Use a public number when losing the account would cost you nothing. Use your own number when it would cost you anything. There is no middle case worth the risk, because the middle case is where people put their email.