Forem: Josh Mellow

VoIP Numbers and SMS Verification: Why Codes Never Arrive

Josh Mellow — Fri, 20 Feb 2026 15:00:58 +0000

# VoIP Numbers and SMS Verification: Why Codes Never Arrive

A developer sets up an account verification flow using Twilio or Firebase. The code works perfectly in testing with a personal phone number. Production launch day arrives, and 30% of users report never receiving their verification code. Support tickets pile up. The verification funnel bleeds conversions.

The problem is not the verification API. The problem is the phone numbers.

What Happens Before the Code Sends

Most developers assume SMS verification is a simple pipeline: user enters number, API sends code, user enters code. In practice, a classification step runs between "user enters number" and "API sends code" that determines whether the message ever leaves the platform's servers.

Verification services query carrier lookup APIs that return metadata about every phone number. The most important field in that response is line_type. It returns one of five values: MOBILE, VOIP, LANDLINE, PREPAID, or UNKNOWN. Platforms use this classification to make a binary decision about whether to proceed with the verification.

A number classified as MOBILE on AT&T or Verizon passes through immediately. A number classified as VOIP on Bandwidth.com or a generic VoIP aggregator gets blocked, deprioritized, or silently dropped. The user sees nothing. No error message, no rejection notice. The code simply never arrives.

// Carrier lookup response - VoIP number
{
  "line_type": "VOIP",
  "carrier": "Bandwidth.com",
  "risk_score": "elevated"
}

// Carrier lookup response - Mobile number  
{
  "line_type": "MOBILE",
  "carrier": "T-Mobile USA",
  "risk_score": "normal"
}

This lookup adds roughly 100-200ms to the verification flow and costs fractions of a cent per query. For the platform, that cost is negligible compared to the fraud prevention value. For users with VoIP numbers, it is an invisible wall.

Why VoIP Numbers Carry Higher Risk Scores

The classification itself is not the only factor. Risk engines layer additional signals on top of the line type check.

VoIP number ranges get recycled across thousands of users on the same provider. When even a small percentage of those users engage in spam or abuse, the entire number block accumulates negative reputation. A fresh VoIP number inherits that block-level reputation on day one.

Routing patterns differ as well. SMS messages to real mobile numbers traverse carrier SS7 or IMS infrastructure with predictable latency (typically 400-600ms end to end). Messages to VoIP numbers route through SIP relays and soft-switch infrastructure that introduces variable latency, sometimes 2-4 seconds, with occasional delivery failures. Platforms that track delivery timing can distinguish between these routing profiles.

Number tenure is the third factor. A mobile number that has existed on a carrier network for 6 months with regular voice and SMS activity has a fundamentally different risk profile than a VoIP number provisioned 10 minutes ago with zero history. Fraud detection systems weight number age and activity texture when scoring verification requests.

The combination of these signals means VoIP numbers face compounding disadvantages. Even on platforms that do not outright block VoIP, the elevated risk score can trigger additional friction: CAPTCHA challenges, email verification fallbacks, or manual review queues.

The Pass Rate Gap in Practice

The performance difference between number types is not marginal. VoIP numbers classified as VOIP in carrier lookups typically achieve 20-40% pass rates on platforms with standard verification screening. On platforms with aggressive fraud detection like Instagram, WhatsApp, and financial services, VoIP pass rates drop below 15%.

Numbers classified as UNKNOWN (which includes some VoIP providers that mask their routing) perform slightly better at 30-50% but still face elevated friction.

Real SIM-based mobile numbers classified as MOBILE consistently deliver 95-98% pass rates across all platform categories. The carrier metadata returns a named carrier, the routing follows standard paths, delivery timing is consistent, and the number carries legitimate network tenure.

For development teams building verification flows, these numbers translate directly to conversion rates. A 40% pass rate on VoIP means 60% of users hitting a dead end in the signup funnel. Switching to SIM-based numbers recovers most of that lost conversion.

Common Failure Patterns and Root Causes

Several specific failure modes account for the majority of VoIP verification problems.

Silent delivery failure is the most common. The platform's carrier lookup returns VOIP, the system decides not to send the code, but no error propagates back to the user interface. The user stares at a "code sent" message that is technically false. Developers can catch this by checking the delivery status callback from their SMS API rather than assuming success on send.

Delayed delivery affects VoIP numbers that make it past the initial classification check. The message routes through cheaper aggregator paths that queue messages during peak traffic. The code arrives 45-90 seconds after the user expected it, by which point they have already retried (triggering rate limits) or abandoned the flow.

Sender ID mismatch occurs when VoIP routing changes the originating number or shortcode that appears on the received message. Some platforms verify that the sender ID matches their expected format. If the VoIP route substitutes a different sender, the platform may discard the code even though it technically delivered.

Post-verification flagging is subtler. The code delivers and the user enters it successfully, but the platform flags the account for additional review because the phone number carries VoIP classification. This manifests as delayed account activation, restricted features, or forced re-verification days later.

Provider Comparison for SIM-Based Verification

Three services handle SMS verification with real SIM-based numbers, each targeting different use cases.

TextVerified specializes in US non-VoIP numbers at $0.25 per verification with automatic refunds on failed deliveries. The service offers both one-time codes and number rentals starting at $1.50 for longer-term use. A Chrome extension streamlines the verification process for manual workflows. Coverage is US-only, and stock availability fluctuates on high-demand services.

SMSPool operates a marketplace model covering 100+ countries with pricing starting around $0.10-0.50 depending on the target service and region. The platform supports dedicated SIM rentals for 30-day periods alongside single-use verifications. The broad geographic coverage makes it suitable for international operations, though shared pool numbers carry higher failure rates than dedicated allocations.

VoidMob runs dedicated SIM devices rather than shared number pools. Each number maintains exclusive assignment to a single user, which eliminates inherited abuse history from other customers on the same number block. The service also provides mobile proxies on matching carrier networks, allowing the verification number's geographic and ASN context to align with the user's browsing session. That coherence between number and network identity reduces the behavioral mismatches that trigger fraud detection on platforms with advanced screening.

Building Verification Flows That Account for Number Type

Developers implementing SMS verification should build line type awareness into their flows rather than treating all phone numbers identically.

Before sending a verification code, run a carrier lookup on the submitted number. If the line type returns VOIP or UNKNOWN, present the user with an alternative verification method (email, authenticator app) rather than sending a code that will likely never arrive. This costs pennies per lookup and saves significant support overhead from users reporting missing codes.

For applications where SMS verification is mandatory, document the number type requirement clearly in the UI. A simple note stating that virtual phone numbers are not supported prevents users from wasting time with numbers that cannot pass verification.

Monitor delivery rates by carrier and number type in production. Aggregate delivery success data over time to identify which carrier blocks show degrading performance. Some number ranges that pass today may get flagged tomorrow as platforms update their risk databases.

FAQ

Why does the same number work on one platform but fail on another?

Platforms use different verification providers with different carrier lookup databases and risk thresholds. One platform might only check line type while another checks line type, carrier name, number tenure, and porting history. A number that squeaks past a basic check will fail a comprehensive one.

Can porting a VoIP number to a mobile carrier fix the classification?

Sometimes, but not reliably. Carrier databases may retain the number's VoIP history even after porting. The line type might update to MOBILE eventually, but the porting history itself can be a negative signal on platforms that track port events.

Is there a free way to check if a number is VoIP?

Several services offer limited free lookups. Twilio Lookup provides carrier data on a pay-per-query basis at fractions of a cent. Free alternatives like NumVerify exist but may have less accurate or outdated carrier databases.

What about eSIMs? Do they classify as MOBILE?

Yes. eSIMs provisioned through legitimate carriers (AT&T, Verizon, T-Mobile) carry the same MOBILE classification as physical SIMs. The carrier infrastructure is identical. The form factor is different but the metadata is the same.

Python vs Go vs Java vs Ruby: Picking the Right Language for Production Web Scraping

Josh Mellow — Tue, 10 Feb 2026 17:54:36 +0000

Every scraping tutorial starts the same way: install BeautifulSoup, fetch a page, parse the HTML, done. Twenty minutes from zero to working prototype. What none of them cover is what happens when that script needs to process 100,000 pages daily, rotate through paid mobile proxies, and stay running without memory leaks for weeks at a time.

Language choice barely matters for a proof of concept. It matters a lot for production infrastructure.

The Comparison Nobody Makes

Most language comparisons for scraping focus on syntax and library availability. Python has BeautifulSoup and Scrapy, Go has Colly, Java has Jsoup, Ruby has Nokogiri. All of them can parse HTML. That part is solved.

The real differences show up in concurrency models, memory behavior under sustained load, and how each language handles proxy connection pooling across tens of thousands of requests. These are the things that determine whether a scraper runs reliably at scale or falls apart after a few hours.

Here's the summary before the details:

	Python	Go	Java	Ruby
Concurrency	Threading / Asyncio	Goroutines	Threads / Virtual Threads	Threads (GIL limited)
I/O throughput	Baseline	4-5x faster	2-3x faster	Similar to baseline
Memory at 10k pages	800-900 MB	200-250 MB	1-1.5 GB	700-800 MB
Best fit	Prototyping, ML pipelines	High-volume production	Enterprise compliance	Rails-integrated automation

Python: Fastest to Build, First to Break at Scale

Python is the default for a reason. Scrapy handles retries, middleware, and pipelines out of the box. Selenium covers JavaScript-heavy sites. The ecosystem is massive and well-documented.

The problem is the GIL (Global Interpreter Lock). It limits Python to executing one thread of Python code at a time, which means true parallelism requires multiprocessing, not threading. Asyncio helps with I/O-bound workloads when configured correctly, but CPU-bound HTML parsing still runs single-threaded.

At moderate scale, around a few thousand pages daily, this doesn't matter much. Past the 10,000 page threshold, memory creep becomes visible. Long-running Scrapy jobs tend to climb in RAM usage over extended sessions. Running 20 concurrent Selenium instances for JavaScript rendering eats 6+ GB of memory.

Python is the right choice when the priority is getting a scraper working quickly, when the team includes data scientists who need direct access to the output, or when the volume stays under 10k pages daily. Past that, the optimization effort starts to outweigh the development speed advantage.

Go: Built for Exactly This Problem

Go's Colly framework combined with goroutines handles high-concurrency scraping with minimal resource overhead. Goroutines are cheap to spawn, thousands of them can run simultaneously without the thread overhead that Python or Java would require.

The performance difference at scale is significant. Go typically delivers 4-5x the throughput of Python for I/O-bound scraping workloads while using roughly 75% less memory. Processing hundreds of thousands of pages, memory stays flat where Python's would climb steadily.

c := colly.NewCollector(
    colly.Async(true),
    colly.MaxDepth(2),
)

c.Limit(&colly.LimitRule{
    DomainGlob:  "*",
    Parallelism: 100,
    RandomDelay: 2 * time.Second,
})

c.SetProxyFunc(func(_ *http.Request) (*url.URL, error) {
    return url.Parse("http://proxy.example.com:8080")
})

c.OnHTML("div.product", func(e *colly.HTMLElement) {
    // Parse product data
})

Go's connection pooling also handles proxy rotation more efficiently than Python's requests library, which tends to create new connections unless sessions are configured carefully. Over 10k+ requests, that connection overhead adds up in both latency and wasted proxy bandwidth.

The tradeoff is development speed. Go takes more time upfront, but that time comes back in reduced operational overhead later.

Java: The Enterprise Option

Java gets dismissed for scraping because of boilerplate verbosity. Fair point for small projects. For enterprise environments that need audit trails, structured logging, and integration with existing JVM infrastructure, it's a different conversation.

Virtual threads in Java 21 changed the concurrency story significantly. Handling 50,000+ concurrent connections is now practical without the memory overhead of traditional thread pools. For teams already running JVM-based systems, adding a scraping layer that plugs into existing monitoring and compliance infrastructure is more practical than spinning up a separate Go or Python service.

Java's Selenium implementation is also more mature than most alternatives, with better resource management for long-running browser automation tasks. The throughput sits at roughly 2-3x Python's baseline for I/O-bound workloads.

It's the right pick when compliance, audit logging, and JVM ecosystem integration matter more than raw development speed.

Ruby: Fine Until It Isn't

Nokogiri parses HTML cleanly. If a Rails application already exists and moderate-scale scraping needs to feed data into it, Ruby makes sense. The syntax is clean, integration with ActiveRecord is direct, and developer productivity is high.

The ceiling is low though. Ruby has its own GIL, and performance plateaus around 8,000 pages daily regardless of how many threads get thrown at it. Only one thread executes Ruby code at a time, so additional concurrency adds overhead without proportional throughput gains.

Ruby works for Rails-integrated automation at moderate volume. It's not a contender for high-throughput production scraping.

Proxy Rotation: The Part That Actually Determines Success Rate

Language performance is secondary if the proxy layer is slow or gets detected. A scraper running on datacenter IPs from AWS or GCP will hit rate limits within minutes on any major e-commerce site, regardless of how fast the language processes responses.

Mobile carrier proxies from real 4G/5G networks perform better because the traffic is indistinguishable from legitimate smartphone users. CGNAT means the IPs are shared with thousands of real mobile users, so platforms can't block the ranges without blocking actual customers.

How proxy rotation gets configured matters too. Sticky sessions (holding the same IP for 10-30 minutes) work better for sites that track session behavior. Rotating per request reduces rate limiting risk but triggers more CAPTCHA challenges. The interaction between rotation strategy and language-level connection pooling is where performance differences compound.

Go and Java handle connection pooling natively and efficiently. Python's requests library needs explicit session management to avoid creating new connections on every request. Over tens of thousands of requests, poor connection handling wastes proxy bandwidth on failed connections and retries.

Enterprise proxy providers like Bright Data and Oxylabs offer large shared mobile pools that work well for high-volume data collection. For scraping workflows that need dedicated IPs with longer session stability and programmatic proxy management, smaller specialized providers like VoidMob offer dedicated mobile proxies on carrier infrastructure with MCP server access for agent-level control over rotation and session handling.

Memory Behavior Over Time

This is the factor that kills long-running scrapers silently. A scraper that works fine for an hour can fall apart after twelve.

Python's garbage collector struggles with circular references in complex scraping pipelines. Memory tends to climb gradually during extended sessions before stabilizing at a higher baseline. Multiprocessing sidesteps this but adds complexity managing shared state.

Go's garbage collector is tuned for low-latency workloads. Memory stays flat across hundreds of thousands of pages. This is Go's strongest argument for production scraping, not raw speed, but predictable resource usage over days and weeks of continuous operation.

Java's GC is configurable but requires tuning. Default settings can cause occasional pauses that disrupt request timing on strict rate-limited targets.

Ruby's memory profile grows steadily during long scraping sessions, likely from how string allocations accumulate during HTML parsing.

When to Pick What

Go when throughput and resource efficiency are the priority. Scrapers running 24/7 processing 100k+ pages justify the steeper learning curve through lower infrastructure costs and predictable memory behavior.

Python when rapid prototyping matters, when the team includes data scientists, or when volume stays under 10k pages daily. Scrapy's ecosystem is mature and the development speed advantage is real.

Java when the scraper needs to integrate with existing enterprise JVM systems, when compliance and audit logging are requirements, or when virtual threads can replace what would otherwise be a complex async architecture.

Ruby when there's an existing Rails application and the scraping volume stays moderate. Don't try to scale it past 8k pages daily.

The language gets the data. The proxy infrastructure determines whether the data keeps flowing. Both decisions matter, but most teams spend too long on the first one and not enough on the second.