Which Short Code Texted Me? How to Check a Verification Sender

You get a text from 40404, or 74843, or a string like 787 473, and the first instinct is to search the digits. That search rarely settles anything, because a short code identifies a route rather than a company, and the same digits can be leased to different senders in different countries. This guide explains what a short code actually is, why the lookup you are looking for does not exist in the form you want, and the three checks that do tell you whether the message deserves your attention.

What is a verification short code?

A short code is a shortened phone number, usually five or six digits, that a business leases from a registry so it can send high volumes of automated messages. Ordinary phone numbers are built for two-way conversation; short codes are built for throughput, which is why banks, social platforms and delivery companies use them for one-time passwords and alerts.

Two things follow from that design. First, the code belongs to whoever is leasing it at the moment, not permanently to a brand. Second, a code that works in one country means nothing in another, because each country's registry allocates its own ranges. That is the root of the confusion behind almost every "which number is this" search.

Why you cannot look a short code up in a directory

There is no worldwide search box that converts a short code into a verified sender. The US registry lists codes leased in the United States and is genuinely useful for that market, but it does not cover the rest of the world, and it cannot tell you whether the message you received actually came from the leaseholder.

That last point matters more than the coverage gap. Sender IDs are spoofable: the digits shown on your screen are supplied by whoever sent the message, so a scammer can display a familiar code as easily as a real one. A lookup that returned a clean answer would therefore still not prove the message was genuine. This is the same reason we treat the sender as weak evidence in our guide to spotting a fake text.

How to tell whether the message is genuine

Three checks, in this order, settle almost every case:

• Did you start something? A verification code is a response. If you did not just try to sign in, reset a password or confirm a purchase, the code was requested by someone else — and that is worth acting on rather than ignoring.
• Does the message ask for anything? A real verification text gives you a code and asks for nothing. Any request to reply, to pay, to confirm details or to read the code back to a person marks the message as an attack.
• Is there a link? Verification messages from major platforms do not carry links. A link is the payload of a phishing message; the code beside it is decoration.

If all three checks pass, the sending number is irrelevant. If any one fails, the sending number is still irrelevant — the message is not safe no matter which code it came from. Understanding how verification codes work makes the pattern obvious: the code travels one way, from the service to you.

Common short codes people ask about

Certain codes come up repeatedly in searches. 40404 is long associated with X in the United States. Codes in the 30000 and 70000 ranges are widely used by messaging and delivery platforms. Sequences that look like 244 444 or 787 473 are usually alphanumeric sender IDs rendered as digits by the phone rather than true short codes.

Recognising a code gives you context and nothing more. Google, Facebook and PayPal each route verification messages through local carriers rather than a single global number, and none of them publishes a definitive list — so "this is not the number it used last time" is not evidence of anything. Judge the message, then move on.

Which services send the most verification codes (Vernum, September 1, 2026)

If you are on this page because you want to receive a code rather than identify one, here is what the live Vernum catalog looks like right now for the services that generate the most verification traffic. One coin is $0.01.

The spread between four coins and fifty-three is not about delivery quality; it tracks how heavily each service's numbers are recycled and screened. Turkey is in the catalog for every service listed here, at 35 coins for Google, Instagram and Facebook. Prices refresh hourly, so treat this table as a snapshot and check the dashboard for the current list.

Troubleshooting: the code came from a number you did not expect

A code arriving from an unfamiliar sender is normal; a code arriving when you did nothing is not. Work through it like this:

1. You requested it, unfamiliar sender: use it. Routes change between countries and carriers, and a new sending number is not a warning sign on its own.
2. You did not request it, once: ignore the code, do not reply, and check that the account it mentions still has a password only you know.
3. You did not request it, repeatedly: treat it as an attempt in progress. Someone is entering your number on a login screen. Change the password on that account and turn on a second factor that is not SMS.
4. Dozens at once: that is a flood designed to bury one real alert. Do not delete anything; open your important accounts directly and look for the message that matters.

And if the problem is the opposite one — the code you asked for never showed up — the causes are different and mostly fixable, which we cover in why a verification code does not arrive. The country code is the culprit far more often than the sender is.

Frequently asked questions

Is there a short code lookup directory I can search? Not a single global one. Short codes are allocated per country by separate registries, and the same digits can belong to different senders in different countries. The US registry lists codes leased in the United States, but there is no worldwide search box that turns any short code into a sender name, which is why message content is the more reliable test.

What is the 40404 number? 40404 is one of the best-known US short codes and is associated with X (formerly Twitter). Recognising a code is useful context, not proof: sender IDs are routinely spoofed, so a message that displays a familiar code and still asks you for a payment, a password or a code you must read back is not genuine regardless of the number it shows.

Why do verification codes arrive from a different number each time? Because large services route messages through local carriers, and the sending short code differs by country and by route. Google, Facebook and PayPal all publish no fixed global list for exactly this reason. Two codes sent to the same phone an hour apart can legitimately come from two different numbers.

Can I reply to a short code? Some accept replies for specific keywords — STOP to unsubscribe, and 7726 to forward a suspicious message to your carrier in the US and UK. Most verification short codes are send-only, so a reply goes nowhere. Never reply with a code, a password or personal details whatever the number looks like.