PhoneCo.in is designed to be easy to use and secure. The server which processes your text message communicates with a separate server processing the bitcoin transaction. The data from your text message is sent using AES-265 encryption and is signed using HMAC-SHA1. This combination of security measures makes it very difficult to initiate a PhoneCo.in transaction in any way other than using a cell phone, as any requests to the bitcoin server must originate from the text message processing server.
We require you to reply with a 5 character confirmation code within 5 minutes when sending a payment. This is necessary to verify that your phone has initiated the payment request (and that someone isn’t spoofing your phone number when contacting our server). Spoofing another phone number is illegal in the United States and punishable with fines up to $10,000. If you receive a confirmation code for a payment you didn’t initiate, contact us so we can help track the offender.