Bulk WhatsApp number check for Pakistani customer lists (+92)

To check a list of Pakistani numbers for WhatsApp, convert every row to E.164 (+923…), drop the rows that aren't valid mobiles, remove duplicates, upload the file as a bulk job with the whatsapp check, read the free estimate, and download one answer per number: registered, not registered or unknown. Pakistani mobiles are easy to normalise, because every one is 03XX plus seven digits at home and exactly 10 digits after +92. The traps are cells a spreadsheet has damaged and 03XX codes that hold no mobile numbers. Check only numbers your customers gave you, and never use the answers to find new people to message: Pakistan's electronic crimes law punishes both spamming and the unauthorised use of other people's identity information.

This guide covers what is specific to Pakistan. The general flow is in our bulk WhatsApp number check guide, and numbering details are in our Pakistan phone number format guide. Facts are as of 7 November 2026, and every price below carries its date. This is general guidance, not legal advice.

How do you format Pakistani numbers for a WhatsApp check?

Use the international form: +92, then the number without its leading 0. A CRM export from Pakistan usually holds several spellings of the same mobile:

The last row is the one to watch in Pakistan. A number written 923XXXXXXXXX is 12 digits long, and spreadsheets often show numbers that long in scientific notation. If the file is saved that way, the digits behind the E are gone. Format the phone column as text before you open or save the export.

There is good news too. In some countries a cell like 92300… is ambiguous: with a default country set, it can be read as a national number and turned into a different, valid number. Pakistan doesn't have that problem, because 92 followed by a mobile number isn't a valid Pakistani national number, so the library reads the 92 as the country code. In our test, libphonenumber-js with the default region PK turned every spelling above into the same +923… number. So default_country: "PK" is safe for a Pakistani list, as long as numbers from other countries carry their own +.

This converter does the same for a mobile list. It returns null for anything that isn't a valid Pakistani mobile:

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** One Pakistani list cell → E.164 mobile (+923…), or null. */
export function toE164Pk(raw) {
  let s = String(raw).trim();
  if (/^\d(\.\d+)?E\+\d+$/i.test(s)) return null;           // 9.23E+11: the spreadsheet already lost digits
  const p = parsePhoneNumberFromString(s, "PK");            // 03…, 923…, +92 3…, 0092…, 3…, +92 (0)3…, Urdu digits
  return p?.isValid() && p.country === "PK" && p.getType() === "MOBILE" ? p.number : null;
}

We ran it on 2026-11-07 with Node 24 and libphonenumber-js 1.13.13, on libphonenumber's own example number for Pakistan. Digits are masked with X here:

The first seven rows are the same customer, so after conversion they collapse into one number. That is what makes the duplicate count honest. The library read the Urdu digits without help; in the same test it did not read Bengali digits, which matters if your list also holds Bangladeshi customers. Rows from other countries return null here on purpose: put them in their own file or keep their + form.

Which Pakistani numbers should you drop before the check?

Every Pakistani mobile has 10 digits after +92, so unlike some countries, a length check is safe here. It isn't enough, though, because not every 03XX code is in use. From libphonenumber's metadata for PK, as tabulated in our Pakistan format guide:

A number such as 0350 XXXXXXX has the right shape, passes most tutorial regexes and is still not a mobile number. The converter above drops it, and so does our job: an invalid number is never checked or billed. Landlines (021…, 042…), toll-free 0800 numbers and UAN numbers fail the mobile filter too; keep them in a separate file if you need them.

Don't use the 03XX code to guess anything else. It shows which operator was first allocated the range, but Pakistani subscribers can port their number to another operator and keep it. For a WhatsApp check the operator doesn't matter; for routing SMS it does, which is what an HLR or MNP lookup is for.

How do you check a list of Pakistani numbers on WhatsApp?

Five steps, from export to answers:

1. Export only customers who gave you their number, with your own ID column (for example crm_id,phone). Format the phone column as text. Leave out bought lists, scraped numbers and number ranges.
2. Convert and dedupe. Run every cell through a converter like the one above. Keep the rows that return null aside for a manual fix; don't guess the missing digits.
3. Estimate. Upload the file in the dashboard (Bulk jobs › Upload a list), or send the numbers to POST /v1/jobs/estimate. The estimate is free, checks nothing and stores nothing.
4. Run with a cost cap. Start the job with max_cost set to the estimate, so it can never cost more. Choose whatsapp, or whatsapp.business if you also need to know whether the account is a WhatsApp Business account.
5. Download and join back. The result file keeps your row order (row_no); join it back to your own IDs by row number. Store each answer with its checked_at date.

A job holds up to 50,000 numbers, and a dashboard file can be up to 10 MB. Bigger exports go into several jobs.

What does the estimate do with national and international spellings?

Here is a real estimate made with the public sandbox key on 2026-11-07. The sandbox accepts only our test values, which are UK drama-range numbers, so this shows the behaviour, not Pakistani data. The same number is sent three ways: in E.164, with spaces, and in national format with default_country set:

curl https://api.mobilevalidate.com/v1/jobs/estimate \
  -H "Authorization: Bearer mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+44 7700 900001", "+447700900002", "+447700900003", "+447700900006", "07700 900001"],
       "checks": ["whatsapp"], "default_country": "GB"}'

Response (abridged):

{
  "object": "estimate",
  "total": 6,
  "valid": 4,
  "invalid": 0,
  "duplicate": 2,
  "cached": 0,
  "checks": ["whatsapp.registered"],
  "max_cost": { "amount": "0", "currency": "USD" },
  "breakdown": [
    { "check": "whatsapp.registered", "price_mode": "batch", "reason": null, "checks": 0,
      "unit_price": { "amount": "0.00025", "currency": "USD" } },
    { "check": "whatsapp.registered", "price_mode": "realtime", "reason": "small_batch", "checks": 4,
      "unit_price": { "amount": "0.004", "currency": "USD" },
      "countries": ["GB"], "batch_minimum": 132 }
  ]
}

duplicate: 2 is the two extra spellings of the first number. The national one was matched because default_country told the job which country it belongs to; for your file that is "PK", and a 0300… cell and a +92300… cell become one check. Duplicates are never checked or billed. max_cost is 0 because test keys are never billed.

The small_batch line is the other thing to read. The bulk price needs at least 132 numbers from the same country in one job. These four numbers are below that minimum for their country, so they would be checked the real-time way, at the real-time price. A Pakistani customer list easily clears it; the handful of +971 or +44 customers in the same file may not, and the estimate shows them on their own line before you spend anything. Details are in the bulk jobs docs.

What does it cost?

From our public catalog (GET /v1/services), fetched on 2026-11-07:

Only conclusive answers are billed. Unknown, invalid, duplicate and unsupported rows are free, and so are repeats served from your account's cache. Prices can change; the pricing page always has the current ones.

A worked example with made-up figures, to show the arithmetic: a 25,000-row export converts to 21,400 unique valid Pakistani mobiles; the rest are duplicates, landlines, dead blocks and cells lost to scientific notation. The WhatsApp job can cost at most 21,400 × US$0.00025 = US$5.35. If 6,000 come back not registered and you want to know which of those still work before you send SMS, an HLR job on those 6,000 costs at most 6,000 × US$0.005 = US$30.00.

What share of Pakistani numbers are on WhatsApp?

We don't quote one, and you shouldn't plan with one. Public reports describe the country, not your list. DataReportal's Digital 2026 report for Pakistan counts 194 million cellular mobile connections at the end of 2025, equal to 75.9% of the population, 117 million internet users (45.6%) and 79.9 million social media user identities (31.2%) (DataReportal, 2025). The report gives no WhatsApp figure.

The gap between those numbers is the useful part. There are far more mobile connections than internet users, so many working Pakistani numbers belong to people who aren't online at all, for example on a basic phone. A WhatsApp check of a Pakistani list can therefore return a large not-registered group made of numbers that are alive and reachable by SMS or a call. Don't read registered: false as "dead number". That is a question for an HLR check.

The other thing to know is how SIMs are sold. Under section 17 of the Prevention of Electronic Crimes Act 2016 (PECA), selling a SIM without obtaining and verifying the subscriber's details in the way PTA approves is a crime punishable by up to three years in prison (PECA, consolidated 2025). A Pakistani number is therefore tied to a verified subscriber. That subscriber isn't always your customer: a family member or employer may own the SIM your customer uses. It's one more reason to check only the numbers people gave you, and to message only people who asked.

Is WhatsApp cheaper than SMS for OTP in Pakistan?

Pakistan is its own market on Meta's rate card. From our rate-card dataset, transcribed from Meta's USD rate cards:

Prices are per delivered message. Meta charges only for delivered messages, so a code sent to a number without WhatsApp costs nothing but time.

The authentication-international rate is the one to plan for if you send codes from abroad. It has applied to Pakistan since 1 February 2025. Meta charges it when your business is eligible and is based in another country than the recipient. A business becomes eligible once it sends more than 750,000 messages outside customer service windows in a moving 30-day period to users in markets with such a rate, and it always gets 30 days' notice. Meta determines your business's country from publicly available information (Meta, 2026). For a large sender based in, say, the UAE, a code to a +92 user costs five times the local rate.

We don't quote SMS prices here. Pakistani SMS prices vary by route, sender type and contract, and list prices say little about what you pay. Put the rate from your own invoice next to the table above. Our WhatsApp OTP vs SMS OTP cost guide has the formula for cost per verified user. A pre-check fits in front of it: knowing which customers are on WhatsApp means you send the code to the channel that reaches them first.

What do PTA rules and PECA require before you check or message?

Pakistan has no comprehensive data protection law yet. The federal cabinet approved the Personal Data Protection Bill 2023 in principle on 26 July 2023 (The Nation, 2023). We found no record that Parliament has passed it, and on 24 August 2026 an Express Tribune commentary still called for its enactment (Express Tribune, 2026). Watch for it, but don't read "no law yet" as "no rules". Three sets of rules apply today.

PECA 2016: identity information and spamming

We read the consolidated text of the Prevention of Electronic Crimes Act 2016, with amendments up to Act No. II of 2025, on 2026-11-07 (PECA, consolidated 2025):

• Identity information (section 16). Whoever "obtains, sells, possesses, transmits or uses another person's identity information without authorization" can be imprisoned for up to three years and/or fined up to Rs5 million. The Act defines identity information as information that "may authenticate or identify an individual". Ask counsel whether that covers a phone number in your case; bought and scraped lists sit close to this line.
• Spamming (section 25). Transmitting harmful, fraudulent, misleading, illegal or unsolicited information to anyone without the recipient's permission is spamming. The section doesn't depend on the channel: it covers any information system, which includes messaging apps.
• Unsubscribe. Anyone engaged in direct marketing must give recipients the option to unsubscribe (section 25(2)).
• Penalties. Unsolicited messages or direct marketing without an unsubscribe option: a fine of up to Rs50,000 the first time, then Rs50,000 to Rs1 million for each later violation. Harmful, fraudulent, misleading or illegal messages: up to three months in prison and/or a fine of Rs50,000 to Rs5 million.

PTA's anti-spam rules and the 3627 register

PTA's Protection from Spam, Unsolicited, Fraudulent and Obnoxious Communication Regulations, 2009 apply to licensed operators (PTA, 2009). We read the 2nd Amendment of 2022 (S.R.O. 2402(I)/2022, gazetted 31 December 2022) page by page on 2026-11-07 (PTA, 2022). What people call the "PTA DND" is the operators' central Do Not Call / SMS Register (C-DNCR) it sets up:

• Opting out: "Not to receive marketing msg: send msg to 3627". The amendment defines unsolicited communication as promotional or marketing messages sent to people who haven't consented and whose details are recorded in the C-DNCR.
• Consent first: telemarketers, through their SMS aggregator (the short-code holder), must ask each subscriber for consent by message in English and Urdu before sending marketing, and keep a record of each consent in case of dispute.
• Registered senders: a telemarketer is a person or company authorised by PTA. All marketing goes out through approved short codes, or alphanumeric IDs set against short codes, under service agreements with aggregators or operators.
• Unsubscribe and timing: people who opted in must be able to unsubscribe, and operators must ensure these messages arrive within normal business hours.

These rules cover traffic through the mobile operators: SMS and calls. A WhatsApp message doesn't pass through the C-DNCR. A customer on the 3627 register has still told you something about what they want, though, and PECA's spamming section applies to every channel.

WhatsApp's own opt-in rule

WhatsApp's Business Messaging Policy (last updated 23 September 2026) says you may only contact people on WhatsApp if they have given you their mobile number and you have received opt-in permission confirming that they want to receive messages or calls from you (WhatsApp, 2026). A registered: true answer is a fact about the number, not permission to message it. Our consent and law guide covers other regions.

On our side, a request with long runs of consecutive numbers is refused as suspected enumeration, each account has a daily cap, and our acceptable use policy forbids unsolicited bulk messaging and checking ranges to find out who uses an app. Anyone can object through the opt-out form.

What do you do with numbers that are not on WhatsApp?

Route them to a channel that reaches them, and keep the answer:

For the not-registered group, an HLR check answers the next question: is the number reachable on its network at all? It also tells you whether the number was ported, which matters for SMS routing because the 03XX code doesn't. Send marketing SMS only through an approved short code or registered sender to people who consented, and respect the 3627 register. Treat unknown as missing data, never as a dead number, and don't overwrite a stored conclusive answer with an unknown one. Our list cleaning guide shows how to combine the checks.

Re-check before each campaign to opted-in customers, starting with the oldest answers. Numbers do change hands: a number that is given up is later assigned to someone else, so a list from two years ago has drifted.

How do you start with MobileValidate?

The checks for this guide are WhatsApp number check, WhatsApp Business check and live network status (HLR). All three take Pakistani numbers in real time and in bulk jobs. You don't need a WhatsApp account, a phone or a QR pairing.

• Free, today. Get a free test key to build against fixed test answers, and use the free estimate on any file before you pay. To look at one number without an account, the free carrier lookup answers three numbers a day.
• Real checks free. Every live account can check 20 phone numbers and 10 e-mail addresses for real, free, on the dashboard's Try it page. Request access to open one.
• Then prepay. Top-ups of US$100 or more get a 5% bonus, US$500 or more 8%, and US$2,000 or more 10%.

Results are kept for your account's retention setting, 30 days by default, and you can delete a job's results at any time. A check returns registration facts only, never a name, CNIC or address. WhatsApp is named descriptively; MobileValidate is not affiliated with WhatsApp, Meta or PTA.

What are the key takeaways?

• Convert every row to +923… before upload. 03XX…, 923XX…, 0092…, +92 (0)… and 3XX… are the same customer, and default_country: "PK" reads them all correctly.
• Format the phone column as text: a cell shown as 9.23E+11 has lost digits for good.
• Pakistani mobiles have exactly 10 digits after +92, but 0338, most of 035 and 036, and 038–039 hold no mobile numbers.
• Bulk WhatsApp checks cost US$0.25 per 1,000 (catalog, 2026-11-07), with a minimum of 132 numbers per country group in one job for the bulk price. Unknowns and duplicates are free.
• A WhatsApp authentication message to Pakistan lists at US$0.0150 from 1 October 2026; foreign senders above Meta's threshold pay US$0.0750.
• No comprehensive data protection law yet, but PECA punishes unauthorised use of identity information and spamming, and PTA's 3627 register and short-code rules govern marketing SMS. Check your own customers' numbers, never bought or scraped lists.