I tried to set up a web account with the IRS (the American tax bureau) the other day. My perfectly legitimate mobile number, which works with every other two-factor authentication, was not sufficient for the IRS. Apparently you have to have a number with a certain set of major cell phone service providers like ATT and Verizon, not a minor service provider. They also require half of a credit card number or some other financial identifier like a mortgage. I rather wonder if the cell phone service provider requirement has to do with adding more surveillance capabilities to the IRS' already impressive financial surveillance ability.

A few things ...

I had to set up a web account with the IRS in the recent past and I just skipped the entire mobile validation by having them send the auth code to my mailing address. It arrived in two days and worked perfectly. YMMV.

I am, however, interested in what mobile carrier you use that had a "real" (not VOIP) mobile number and can receive SMS from "short codes", but did not work with the IRS ?

That's unexpected - basically every mobile number in the US is one of the big three or an MVNO operating with one of the big three networks ... can you share just a bit more about your setup ?

Republic Wireless mobile numbers often look like voip because it's a MVNO run by Bandwidth.com (a large wholesale voip carrier). It's apparently in the process of being sold to Dish Wireless though, so that may change.

I think the IRS may have access to customer names associated with mobile phone accounts to confirm identity, but not all carriers have identity information for their customers, and I'd guess smaller carriers (or privacy focused carriers, if any exist) may not provide that access.

It's Xfinity mobile and can send and receive SMS from short codes including my banks, Amazon, etc. Also, I cannot use my mailing address for precisely the reason that I wanted to set up a web account: my accountant put the wrong city and zip code on all my tax returns (several EIN/TINs), and the IRS uses the address on the most recent filing for verification purposes.

Do countries really require ID to get a phone number?

I can buy a prepaid sim card in our Hofer (=Aldi) for 2eur, no verification, no nothing,... they even have the same barcode on, so even Aldi does not know which is mine, and I can pay in cash. I can buy a refill there with cash too, but just to receive an sms, I don't need one, because receiving messages is free.

Lots of countries do: https://blog.telegeography.com/liberty-vs-security-the-battl...

You also have to remember carriers will track the approximate position of a phone with an anonymously-purchased SIM-card, so better not take it home.

2€/account is still decent spam protection, and fair/affordable for a lot of the world population.

It's one thing the whole web can take out of the cryptocurrency transaction model. Costs can also be explicitly monetary and not just time-based through captchas.

If you went to a German Aldi on the other hand, they would let you buy a SIM, but before you can activate it you need to provide your personal information including a verification check that involves your Personalausweis in one way or another.

Does the ID get registered or do you just show it like when buying alcohol?

It is registered. The account is fully bound you.

I had to provide my Passport and submit to a check in order to buy a simcard while on vacation in Berlin.

It was a bit of a surprise as I flew through Heathrow and saw simcard packs in vending machines.

I know in Greece and many European countries you must show ID to get a SIM, nationals and foreigners alike.

Does the ID get recorded though?

> functional burner numbers are really hard to get

For SMS verification at least there are quite a few sites dedicated to verify you for a few cents.

AFAIK they buy real prepaid sim cards and allow reuse by different customers on different sites.

But then anyone can reset your account’s password by using the same service?

Technically yes, practically there should be no way to know which account has which phone number.

The bigger problem is if the site requires you to re-verify your phone for whatever reason (for ex. paypal does when you access it from a strange IP or sth) and the number you used may not be available anymore.

> works well

For everyone except the user who now has no privacy, is trivially hacked by SMS interception, can’t create multiple accounts (e.g., to segregate their activities on a chat platform), ... .

>can’t create multiple accounts

This is usually the intent of sms verification. I hate it just as much as you but I admit that there is no better method for preventing ban evasion. When accounts are trivial to create, moderators have no power.

Sms validation costs the spammer about 30c per validation. Maybe less in bulk. So it depends on how valuable the account is. A Nike snkrs account is worth 1-2$ so it’s still quite profitable

> When accounts are trivial to create, moderators have no power.

Sounds ideal! Moderators are just power tripping gatekeepers. Community ranking of content is sufficient to get rid of trolls, spam…

Taking away people’s right to privacy just to empower moderators is quite dystopian.

^This when I run into a site that whats my phone number I simple don't bother anymore.

The sites requiring a phone number are also now excluding VoIP known numbers such as Google Voice.

Problem. I don't have any other type of number. So while I added my older GV number to my Steam account, I can't update my number to my newer GV number because Valve won't accept non-LL or Cellular numbers for 2FA. So I have to keep a number I've changed from everywhere else... or not have a number on my account anymore.

How do we get all these spam calls in North America then?

The phone company lets them put whatever number they want in their caller ID when they call you. It's a zero-security string. Receiving calls and texts doesn't work the same way.

VoIP