# SMS codes (/docs/verify/sms)

A verification to a phone number (E.164, like `+14155550123`) sends an SMS:

```
Your Acme verification code is 482913. Don't share it with anyone.
```

The name is the environment's Verify setting "App name" (the project's name by default); the
wording is fixed, because carriers approve senders for exactly this kind of message.

## Which number sends it [#which-number-sends-it]

- **coss.com's shared numbers** (the default): numbers coss.com registered with carriers for
  one-time codes. You register nothing. Each destination always gets its codes from the same
  number. The messages are coss.com's, so they don't appear in your SMS list; their cost is
  billed to you as `verify.sms`, by country, once a carrier takes the message.
- **One of your own numbers**: choose it in Verify's settings. It must be registered and approved
  ([SMS senders](/docs/sms/senders)); the messages appear under SMS in your environment and are billed as
  SMS. Use it when your users should see your number, or for countries the shared numbers don't
  reach.

## Countries [#countries]

Codes go only to the countries in the environment's Verify settings (the US and Canada by
default); anything else fails with `country_not_allowed`. Allow only where your users are: SMS
pumping sends codes to numbers elsewhere. The shared numbers never send to the countries where
pumping is most common; send from your own number if you have users there.

## Opt-outs [#opt-outs]

A person who replied STOP to the number can't get codes from it: the verification fails with
`recipient_suppressed`. On the shared numbers, a STOP applies to every app using them, as with
any shared sender. Ask the person to reply START, or use email.

## What coss.com keeps [#what-cosscom-keeps]

The code itself is never stored, logged or put in a webhook: coss.com keeps a keyed hash of it
until the verification expires, and the message's text is erased once it is sent.