Introduction
Picture this: You're in Barcelona closing a business deal when your bank's fraud alert triggers—but you can't receive the 2FA verification code because your US number went dark the moment you swapped in that local SIM. Or maybe you listed a dresser on Craigslist last month, and now your personal number rings nonstop with spam calls because some data broker scraped it from the ad.
Both scenarios point to the same underlying problem: staying reachable across borders while protecting your identity from a surveillance economy that treats phone numbers as permanent tracking IDs.
According to the FBI's 2025 Internet Crime Complaint Center report, SIM swap attacks alone caused $17.4 million in losses from just 971 complaints—an average of nearly $18,000 per victim. Legacy SMS protocols built on 1970s-era SS7 signaling infrastructure remain fundamentally insecure, with the National Institute of Standards and Technology officially classifying SMS-based authentication as "RESTRICTED" due to interception vulnerabilities.
This guide breaks down how virtual numbers and eSIM technology actually work together, where SMS security falls short, and what to look for in a service—whether you're a frequent traveler or just done sharing your real number with every app that asks.
TLDR:
- Virtual numbers route calls/SMS via cloud software; eSIMs are hardware chips that activate carrier plans—complementary technologies, not interchangeable
- Most virtual numbers receive SMS via app/email, but major banks block VoIP numbers for 2FA as fraud prevention
- SS7 protocol flaws let attackers intercept SMS globally; SIM swaps cost victims $17.4M in 2025 alone
- Travelers pair virtual US numbers with local eSIM data plans to dodge roaming fees while staying reachable
- Look for SMS-to-email, global call forwarding, robocall blocking, and no-contract flexibility
What Are Virtual Phone Numbers and How Do They Relate to eSIM?
Virtual phone numbers and eSIMs solve different problems in the mobile communications stack, though they're frequently confused in search queries.
Virtual phone numbers are standard phone numbers that aren't locked to physical hardware. When someone dials your virtual number, the call routes through cloud-based software to wherever you've designated—your cell, your office line, or an email inbox for voicemail. Because it runs over VoIP, you can access it from any internet-connected device.
eSIM (embedded SIM) technology, by contrast, is a hardware chip soldered into your device's motherboard. It lets you download and store multiple carrier profiles over-the-air without swapping physical SIM cards. When you "activate an eSIM," you're configuring your device to connect to a specific mobile network—Verizon, Vodafone, or a local carrier abroad. It handles your device's cellular connectivity. It is not a phone number you give out.
The two technologies complement each other well for international use. Pair a US virtual number (which forwards calls globally) with a local European eSIM data plan, and you maintain your US business presence while avoiding $10/day roaming fees. The virtual number manages your inbound communications; the eSIM handles your device's cheap local data connection.
Virtual Number Types and Use Cases
Local numbers give you geographic presence without physical offices. Services like Tossable Digits offer local numbers in 500+ US cities, all 50 states, Canada, and 80+ countries—useful for businesses targeting regional markets or individuals maintaining a hometown area code while living elsewhere.
Toll-free numbers (1-800, 1-888, 1-877 prefixes in the US) project national scale and professionalism. They're the only number type where business SMS (appointment reminders, order confirmations) is permitted under current carrier regulations.
International numbers let you establish local presence in foreign markets. A UK company can offer a New York 212 number for American clients, or a US consultant can maintain a London 020 number for European projects—all without setting foot in those countries.
The "eSIM with Virtual Number" Misconception
Search "eSIM virtual number" and you'll find users expecting one product to do everything. Here's the reality: A virtual number service handles call/SMS routing and privacy through software. An eSIM handles your device's cellular data and carrier access through hardware. You often need both for full international coverage—the eSIM connects you to local data networks cheaply, while the virtual number keeps your US contacts able to reach you without knowing you're 8,000 miles away.
Can Virtual Phone Numbers Receive SMS?
Yes, most virtual phone numbers receive SMS—but capabilities vary by provider, number type, and carrier restrictions.
How SMS Delivery Works
When someone texts your virtual number, the message doesn't hit a SIM card. It routes through the provider's cloud infrastructure and delivers to you via:
- Mobile app with push notifications
- Web dashboard with real-time message display
- Email inbox with sender ID, message content, and timestamp
Tossable Digits includes SMS-to-email delivery in all plans, delivering unlimited SMS to your email address alongside mobile app access. This means you can manage texts from any device—laptop, tablet, or phone—without installing additional software.
Two-Way SMS: Receive vs. Send
Distinguish between inbound-only SMS (receive only) and two-way SMS capability:
- Inbound-only works for privacy buffers, verification codes, and situations where you need to receive but not respond
- Two-way SMS matters for customer communication, business messaging, and interactive conversations
Carrier regulations complicate this. US and Canada local numbers are restricted to conversational, person-to-person messaging. Sending business-related messages (appointment reminders, order confirmations) on a local number will trigger immediate suspension.
Business SMS is exclusively permitted on toll-free numbers. Carriers enforce stricter verification requirements there, but allow higher-volume messaging in return.
The 2FA Verification Blockade
Major platforms actively block virtual numbers from receiving verification codes. Coinbase explicitly states "virtual phone numbers are not supported" for account security. Bank of America, Wells Fargo, Chase, and government portals like Login.gov and ID.me all reject VoIP numbers for identity verification.
The reason comes down to physical possession. Virtual numbers don't prove you hold a specific device the way a hardware SIM does. Carrier lookup databases classify them as landlines or VoIP, flagging them as fraud risks because anyone can activate a virtual number anywhere without being physically present.
Before relying on a virtual number for critical 2FA, verify with the specific service. Email providers, social media platforms, and productivity apps generally accept virtual numbers without issue. Financial institutions and government portals apply the tightest restrictions.
SMS Security: Why Your Real Phone Number Is a Risk
SMS wasn't designed for security—it was built for convenience in a 1980s telecommunications environment that assumed network operators trusted each other implicitly.
The SS7 Vulnerability
Text messages traverse the Public Switched Telephone Network using Signaling System 7 (SS7) and modern Diameter protocols (its more recent successor), which lack mandatory authentication or encryption. Attackers exploit SS7 messages like ProvideSubscriberInfo and SendRoutingInfo to:
- Track subscriber locations globally
- Intercept SMS messages without physical access to the target device
- Reroute verification codes to attacker-controlled phones
The Electronic Frontier Foundation notes SS7 vulnerabilities remain widespread despite being documented for over a decade, and telecoms have been slow to implement protective measures.
Because SMS 2FA codes travel through these compromised signaling networks, security researchers classify SMS-based authentication as considerably weaker than app-based authenticators (Google Authenticator, Authy) or hardware keys (YubiKey).
SIM Swap Attacks: The $18,000 Average Loss
SIM swapping involves social engineering: a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. Once transferred, they intercept all your SMS messages, including:
- Banking one-time passwords
- Cryptocurrency exchange 2FA codes
- Account recovery links
- Password reset verifications
FBI statistics tell the story:
| Year | SIM Swap Complaints | Total Losses |
|---|---|---|
| 2023 | 1,075 | $48.8 million |
| 2024 | 982 | $26.0 million |
| 2025 | 971 | $17.4 million |
While complaint volume is relatively low compared to phishing (2.6 million fraud reports totaling $12.5 billion in 2024 according to the FTC), the financial devastation per victim remains catastrophic, averaging nearly $18,000 in 2025.
Your real number is the attack surface. Because your carrier-issued number is linked to your identity, account, and credit history, attackers can impersonate you to customer service agents. Virtual numbers managed through a provider like Tossable Digits aren't tied to carrier accounts linked to your SSN or driver's license, making them far harder to social-engineer away.
NIST Downgrades SMS Authentication
The National Institute of Standards and Technology Special Publication 800-63B classifies PSTN-based SMS authentication as "RESTRICTED" and mandates that organizations using it must:
- Offer users at least one unrestricted alternative (app authenticators, security keys)
- Consider risk indicators like device swaps, SIM changes, and number porting before delivering codes
- Provide meaningful notice about security risks
This is the US government's cybersecurity agency telling organizations: SMS authentication is too risky for modern threat environments.
Number Recycling Creates Account Hijack Risks
When you abandon a phone number, carriers eventually reassign it. A 2021 Princeton University study demonstrated that recycled numbers remain linked to previous owners' online accounts, allowing new number holders to execute password resets and hijack accounts.
Virtual numbers managed through a provider like Tossable Digits aren't recycled without your knowledge. You control exactly when a number is released, preventing your old number from falling into a stranger's hands while it's still tied to banking, healthcare, and email recovery accounts.
International Calling and Staying Connected While Traveling
The moment you swap SIMs abroad, your home number goes dark. Calls roll to voicemail. Texts vanish into the void. Services tied to your number can't reach you.
The Roaming Cost vs. Reachability Dilemma
International roaming fees remain punishing outside regulated zones. While the EU's "Roam Like at Home" regulation abolished retail roaming charges within the European Economic Area (with wholesale data rates capped at €1.10/GB in 2026), travelers to Asia, Africa, or the Americas face steep fees—often $10-15/day just for the privilege of keeping your phone active.
Buying a local SIM or activating a local eSIM cuts data costs significantly, but it creates a reachability gap: your US number goes silent. Clients calling your business line hear "number not in service." Your bank's fraud alert can't deliver. Family members can't reach you in emergencies.
Virtual Numbers + eSIM: The Traveler's Solution
A US virtual phone number from a provider like Tossable Digits solves the reachability gap. Your virtual number stays active and forwards calls to any number globally—including the local SIM you just activated in Thailand.
How it works in practice:
- Before your trip, set up a US virtual number and configure call forwarding to your mobile
- At your destination, activate a local eSIM for data (or insert a local physical SIM)
- Update your virtual number's forwarding destination to your new local number
- Callers dial your US virtual number and reach you in Bangkok—without knowing you left the country
Tossable Digits is built for exactly this scenario. The service has been featured in travel publications covering how users maintain a US number while living or studying abroad, with call forwarding routing seamlessly to whatever local number they're using on the ground.
eSIM Adoption Driven by Travel
According to industry data, 51% of eSIM users first tried the technology for international travel. The global travel eSIM market generated $1.75 billion in 2026, with travelers seeking to avoid roaming fees while maintaining connectivity.
GSMA Intelligence notes that travel eSIMs allow consumers to bypass home-network roaming charges while keeping their primary home SIM active as a secondary line. This means critical inbound SMS—identity verification codes, OTPs—still arrive on the home number.
Virtual numbers extend this setup further. The eSIM handles cheap local data; the virtual number ensures US contacts can still call and text your familiar number, with messages routed to email or your app.
Key Features to Look for in a Virtual Phone Number Service
Not all virtual number services deliver the same capabilities. Prioritize these features when evaluating providers:
Essential Functional Features
- Incoming texts forwarded to email with sender ID, message body, and timestamp — no app required to manage messages from any device
- Two-way SMS for real conversations with customers; confirm whether your use case is permitted on the number type you select
- Call forwarding to any mobile, landline, or international number without geographic restrictions
- Voicemail delivered as MP3 attachments to email, so you skip the PIN dial-in entirely
- iOS and Android apps with push notifications and contacts integration for managing calls while traveling
Tossable Digits bundles all of these into every plan — unlimited SMS, voicemail-to-email, global call forwarding, and mobile app access — with no per-feature charges and no contract.
Privacy and Security-Specific Features
- Robocall blocking to filter spam and scam calls before they reach your forwarding number
- Two-factor authentication protecting your virtual number dashboard with SMS or app-based verification
- Call recording with automated verbal announcements to both parties — critical for compliance in two-party consent states like California, Florida, Pennsylvania, and Massachusetts
Tossable Digits covers all three: automated recording announcements for legal compliance, two-factor authentication on account access, and robocall blocking included in every plan.
Call Recording Legal Landscape
Call recording compliance is one area where choosing the wrong provider creates real legal exposure. Here's what the law actually requires:
US call recording laws are fragmented. Federal law (18 U.S.C. § 2511) requires one-party consent—meaning only one person in the conversation (which can be you) needs to consent. However, 11 states require all-party consent, including:
- California (Penal Code § 632)
- Florida
- Pennsylvania
- Massachusetts
If you're in a one-party state but call someone in an all-party consent state, courts generally apply the stricter rule.
Look for services that handle compliance by announcing recordings automatically, eliminating the burden of manually notifying every caller.
Provider Trustworthiness Signals
Evaluate these indicators when selecting a provider:
- BBB accreditation, years in business, and transparent ownership structure — Tossable Digits carries a BBB A+ rating with 21 years in business
- No hidden per-feature charges; some providers advertise low base rates then bill separately for voicemail, call recording, SMS, or forwarding
- Clear SMS policies that explicitly permit 2FA verification codes — some providers prohibit this use case in their terms
How to Get a Virtual Phone Number for International Calls and SMS
Getting started with a virtual number typically takes minutes, not days.
Selection and Sign-Up Process
Choose your provider and number type:
- Identify whether you need a local number (for geographic presence), toll-free (for business/national presence), or international number (for foreign market access)
- Search the provider's inventory—services like Tossable Digits maintain millions of numbers in stock across 500+ US cities and 84 countries for immediate activation
- Verify SMS support for your use case if text messaging matters
Complete signup and identity verification:
- Basic identity verification requirements vary by provider and jurisdiction
- Most providers activate local numbers immediately; international numbers in some countries require address registration (typically 2-4 weeks)
Configuration for International Use
Set up your number properly from day one:
Call forwarding configuration:
- Designate your current active number as the forwarding destination
- Update this anytime you change devices or travel to new countries
- Test inbound calls to confirm routing works correctly
SMS delivery setup:
- Configure SMS-to-email delivery with your preferred email address
- Download the mobile app if available for push notification access
- Verify you can send and receive test messages
Voicemail and screening:
- Record custom voicemail greetings (or use provider defaults)
- Enable robocall blocking to filter spam
- Set call rules to route specific callers to voicemail or forward to different numbers based on time of day
Once configured, callers reach you the same way no matter where you're located, and messages route to your email and app automatically.
No-Contract Flexibility
Look for services that don't lock you into long-term commitments. Tossable Digits operates on a no-contract model: keep numbers for two minutes or ten years and cancel anytime without fees. That flexibility suits travelers who need call forwarding only for specific trips as well as remote workers whose coverage needs shift regularly.
Frequently Asked Questions
Can virtual phone numbers receive SMS?
Yes, most virtual phone numbers receive SMS messages routed through the provider's cloud infrastructure and delivered via mobile app, email, or web dashboard. However, SMS capability varies by number type—US/Canada local numbers support person-to-person messaging only, while toll-free numbers support business SMS. Always verify SMS support before subscribing, especially for 2FA verification codes, which many platforms block on VoIP numbers.
What does 2Number mean in text messages?
"2Number" refers to services or apps that provide a second phone number on top of your existing one—virtual numbers are the most common form. Services like Tossable Digits offer disposable virtual numbers that forward calls and SMS to your existing phone, letting you manage multiple numbers from a single device.
Is SMS-based two-factor authentication safe?
SMS 2FA is better than no 2FA, but NIST classifies it as "RESTRICTED" due to SS7 vulnerabilities and SIM swap risks—with the FBI reporting $17.4 million in SIM swap losses in 2025 alone. Use authenticator apps (Google Authenticator, Authy) or hardware keys (YubiKey) where possible. For services that only support SMS verification, consider using a virtual number for public-facing accounts, though note that major banks and government portals actively block VoIP numbers for identity verification.
Can I keep my US phone number active while traveling internationally?
Yes—a virtual US phone number with global call forwarding keeps you reachable from anywhere in the world. When you activate a local eSIM or SIM abroad, update your virtual number to forward calls to your new local number. Business travelers and expats commonly pair this setup with local data plans to stay reachable on their US number while avoiding roaming fees entirely.
What is the difference between a virtual phone number and an eSIM?
A virtual phone number is a cloud-based number that routes calls and SMS to devices you choose via VoIP. An eSIM is embedded hardware that activates carrier plans so your phone connects to mobile networks. They serve different functions but work well together—the eSIM provides affordable local data while traveling, and the virtual number keeps your home contacts reaching you without international dialing.
