Phones and numbers

Call forwarding and voicemail: the codes, the costs abroad and the security traps

Phones and numbers · By the Open Line editorial team · Published 2026-10-31

Voicemail feels like part of the phone, but it is really a call divert: when you do not answer, the network forwards the caller to a mailbox on your operator's system. The same machinery lets you send calls to another number, a landline or an internet calling service. Knowing how it works helps with three practical problems: setting up forwarding on purpose, avoiding charges when you travel, and closing a security gap that has been used to break into accounts.

The four kinds of forwarding

Mobile networks built on the GSM family of standards (which today covers 4G and 5G networks as well as the older ones) define four basic diverts. Each has its own condition:

• Unconditional (call forwarding unconditional, CFU): every call goes straight to the other number. Your phone does not ring.
• Busy (CFB): calls are diverted when you are already on a call, or when you reject an incoming call.
• No reply (CFNRy): calls are diverted when the phone rings without being answered for a set time.
• Not reachable (CFNRc): calls are diverted when the network cannot reach your phone at all, because it is switched off, in aeroplane mode or out of coverage.

On most lines, the operator sets the three conditional diverts (busy, no reply, not reachable) to its voicemail number when the line is activated. That is why an unanswered call lands in your mailbox without you ever configuring anything.

The codes, and what each part means

The keypad codes for these services are standardised by 3GPP, the body that writes mobile network specifications (technical specification TS 22.030 sets out the structure). They work by dialling the code and pressing the call button, and on most networks and phones they still work today, although some operators now prefer that you change settings in their app or account pages, and some older US networks used their own codes, such as *72 and *73.

A code has three parts: an action prefix, a service number and, where needed, a destination number. The prefixes are:

• ** register and switch on (with a number);
• * switch on, using a number already registered;
• # switch off, keeping the number stored;
• ## erase: switch off and forget the number;
• *# check the current status.

The service numbers are 21 for unconditional, 67 for busy, 61 for no reply and 62 for not reachable. Two group codes cover several at once: 002 for all forwarding and 004 for all conditional forwarding. Put the destination number in full international format to be safe.

The number in the examples is from the range the UK regulator reserves for drama, so it will not reach a real person. For the no-reply divert, the ring time can usually be set from 5 to 30 seconds in steps of 5; if you leave it out, the network uses its default.

A warning about ##002#: it is often recommended as a quick way to stop any unwanted divert before travelling, and it does that. But it also removes the diverts to your voicemail, so callers will hear the phone ring out or get a network message instead. To restore voicemail you need your operator's voicemail number (it is usually on the operator's support pages) or a call to customer service.

Phones also have menus for this. On an iPhone, the Phone settings include a call forwarding switch, which covers unconditional forwarding only. Android phones put it in the dialler's settings under calls or supplementary services, with the exact path depending on the manufacturer. Both simply send the same requests to the network.

What forwarding and voicemail cost

A forwarded call is, in effect, a new call from your line to the destination, so it is usually billed to you at the rate for calling that destination. Forwarding your mobile to a number in your own country is often included in a bundle; forwarding it to a number abroad is usually charged as an international call, by the minute, even if the person who called you paid only for a local call. Check your tariff before you set a divert to a foreign number.

Travelling adds a second layer. When your phone is abroad and you do not answer, the call has to reach the network you are visiting before it can be diverted back to the voicemail at home. Depending on how your operator handles it, that can mean paying for an incoming roaming call and an outgoing leg to your mailbox. Within the EU and EEA, the roaming rules explained in our guide to roam like at home keep this at domestic prices. Outside it, voicemail is a classic source of surprise charges. Options that avoid it:

• switch voicemail off for the trip, or set unconditional forwarding straight to voicemail so calls never reach the visited network;
• use Wi-Fi calling if your operator supports it abroad, so calls reach you over the internet and are billed as if you were at home;
• ask your operator whether it offers a voicemail setting designed for roaming, since many have one.

Listening to voicemail from abroad by calling the mailbox is also a call, and may be billed as one. Visual voicemail, which downloads messages as data into the phone's app, avoids that if your operator supports it, but counts against any roaming data allowance.

Voicemail as a security weakness

Voicemail is one of the least protected parts of a phone account, and that has been exploited for years.

The best-known case is British. Journalists and a private investigator working for the News of the World accessed the voicemail of public figures and private individuals, including a murdered schoolgirl, mostly by exploiting default or guessable PINs on remote voicemail access. The scandal led to the closure of the paper in 2011 and to a public inquiry whose report by Lord Justice Leveson was published on 29 November 2012. Operators tightened their systems afterwards, but the basic weakness, a mailbox protected by a short number, remains.

A newer risk links voicemail to online accounts. Many services can deliver a login or recovery code by an automated voice call. If an attacker triggers that call at a moment when you will not answer, the code is read into your voicemail. If the mailbox has a weak PIN, or accepts access without one when the call appears to come from your own number (caller ID can be spoofed, as explained in our guide to caller ID and spoofing), the attacker can retrieve the code. A security researcher demonstrated this route against several large online services at the DEF CON conference in 2016.

Forwarding itself can be abused. A common scam asks the victim, on some pretext such as a parcel or a network test, to dial a code that begins with **21* or a similar prefix followed by a number. That sets up unconditional forwarding to the fraudster, who then receives the victim's calls, including voice verification calls from banks. It sits alongside SIM swap fraud as a way to take over a phone number without touching the phone.

Locking it down

1. Set a voicemail PIN you have not used elsewhere, as long as your operator allows, and never keep the default.
2. Turn off PIN-free access from your own number if your operator offers that option.
3. Check your diverts now and then with *#21#, *#61#, *#62# and *#67#. Anything other than your voicemail number deserves an explanation.
4. Never dial a code someone sends or reads to you unless you understand exactly what it does.
5. Prefer an authenticator app or passkey to voice or SMS codes for important accounts; then a hijacked mailbox cannot unlock them.
6. Disable voicemail entirely if you never use it. Callers will simply hear the phone ring out, and there is no mailbox to attack.

Read next

More in Phones and numbers

Phones and numbers

Keeping your number

Porting rights in the EU and US, caller ID over the internet, and the fight against spoofing.

Privacy

SIM swap fraud

How a phone number gets hijacked, the warning signs, and how to lock yours down.

Calling abroad

EU roaming rules

What roam like at home covers, fair-use limits, and where the EU rules stop.