Colombia phone numbers: format, mobile prefixes, validation and messaging rules

Colombian numbers use the country code +57 and have 10 digits after it. Mobile numbers start with 3, so in E.164 they look like +57 3XX XXXXXXX; landlines start with 60 and a regional digit (+57 601 XXXXXXX for Bogotá) since the 2021 dialling change. The first three digits name the operator that holds the range, but mobile porting has run since 2011, so they don't prove the current network.

This guide is part of our phone numbers by country series. The tables are generated from libphonenumber's metadata, our MNP atlas and our public catalog. Example numbers are masked with X. We read the resolutions of the Comisión de Regulación de Comunicaciones (CRC), the telecom regulator, in its online legal database, and the laws on the Senate's site, on 2026-11-02. Most are in Spanish only; the translations are ours. This is a summary, not legal advice.

#What does a Colombian phone number look like?

A mobile number is 3XX XXXXXXX: a three-digit code starting with 3, then seven digits. From abroad it is +57 3XX XXXXXXX. There's no trunk 0 for mobiles; people dial the same 10 digits from anywhere in Colombia. The CRC's rules describe the national significant number as a three-digit national destination code (NDC) plus a seven-digit subscriber number (Resolución CRC 5050 de 2016, article 2.6.12.4).

Store only the E.164 form. Colombian databases often hold numbers as 57 3XX… without a plus, as 0057 3XX…, with the old 03 in front of a mobile, or as an old seven-digit landline with a separate one-digit area code. The table below shows what each one becomes, and the code further down handles the mobile cases.

#How did landline numbers change in 2021?

Under Resolución CRC 5826 de 2019, the seven one-digit geographic codes (1, 2, 4, 5, 6, 7 and 8) became three-digit codes by putting 60 in front of them, and every call within Colombia moved to 10 digits. The same change dropped the 03 prefix for calls between landlines and mobiles (ITU communication of 31 October 2019). The plan was postponed once. Both ways of dialling worked from 1 September to 30 November 2021, and only the new one from 1 December 2021. For calls coming from abroad, the overlap ran until 31 January 2022 (CRC, 24 August 2021; CRC, 30 November 2021).

For national calls, callers also no longer choose a long-distance operator with codes such as 05, 07 or 09. International calls out of Colombia didn't change: they still start with 00 plus an operator code. The regions behind each code, as the CRC notified them to the ITU:

Old records are easy to fix with that table:

#Which prefixes are mobile numbers, and which operator holds each?

Every ordinary mobile number starts with 3. For each two-digit block, the generator counted every 10-digit number that libphonenumber's mobile pattern for CO accepts:

The 3 rows are the ones that matter. The open codes are 300 to 305, 310 to 323, most of 324, 350, 351 and 370, plus parts of 330 and 333. 306 to 309, 325 to 329, 34X and 352 onwards aren't mobile ranges in the metadata. The 91 and 94 rows are an edge case: libphonenumber's mobile pattern in the version we use also accepts the 9101 and 9408 blocks, which aren't ordinary mobile numbers. Its 22 October 2026 release (v9.0.42) dropped 9101 from the pattern. We found no CRC document that explains either block, so if your product expects ordinary mobiles, check that the number starts with 3 as well as its type (the code below does).

#3XX codes and the companies behind them

The CRC assigns numbering in blocks and publishes it in its numbering-resource system. The table below follows the carrier prefix data in libphonenumber (file 57.txt, release of 22 October 2026), which names the original holder of each block:

The CRC's portability statistics name four mobile network operators: Claro, Movistar, Tigo and WOM (CRC Data Flash 2026-005). Ownership is changing. Millicom, the group behind Tigo, bought 67.5% of Coltel, the company that runs Movistar in Colombia, on 6 February 2026 and the remaining 32.5% on 27 April 2026. Its August 2026 report still showed Coltel as a separate segment, with integration under way (Millicom Form 6-K, 2026). Read the table as "who first held the range". It tells you nothing about the network a ported number is on today.

#How do I validate a Colombian number in code?

Remove spaces and punctuation, rewrite 0057 to +57, parse with full metadata and the default region CO, and keep only 3XX mobiles.

Python (pip install phonenumbers):

import re

import phonenumbers


def normalize_co(raw: str) -> str | None:
    """E.164 for a Colombian 3XX mobile, or None."""
    s = re.sub(r"[\s().-]", "", raw)
    # "0057..." means +57, but Colombia's exit codes are 00 plus a carrier code
    # (005, 007, 009 ...), so a parser with region CO reads "005" as an exit code.
    s = re.sub(r"^0057(?=3\d{9}$)", "+57", s)
    try:
        n = phonenumbers.parse(s, "CO")
    except phonenumbers.NumberParseException:
        return None
    if (not phonenumbers.is_valid_number(n) or phonenumbers.region_code_for_number(n) != "CO"
            or phonenumbers.number_type(n) != phonenumbers.PhoneNumberType.MOBILE):
        return None
    e164 = phonenumbers.format_number(n, phonenumbers.PhoneNumberFormat.E164)
    return e164 if e164.startswith("+573") else None  # 3XX only, see the prefix table

JavaScript (npm install libphonenumber-js):

import { parsePhoneNumberFromString } from "libphonenumber-js/max";

/** "321 XXXXXXX", "+57 321 …", "0057 321 …" or "57321…" → E.164 for a Colombian 3XX mobile, or null. */
export function normalizeCo(raw) {
  // "0057…" means +57, but Colombia's exit codes are 00 plus a carrier code (005, 007, 009 …),
  // so region CO reads "005" as one. Rewrite it first.
  const input = String(raw).replace(/[\s().-]/g, "").replace(/^0057(?=3\d{9}$)/, "+57");
  const phone = parsePhoneNumberFromString(input, "CO");
  return phone?.isValid() && phone.country === "CO" && phone.getType() === "MOBILE" && phone.number.startsWith("+573")
    ? phone.number : null;
}

We ran both on 2026-11-02 (Python 3.12 with phonenumbers 9.0.40, Node.js 24 with libphonenumber-js 1.13.13). Both returned an E.164 number for rows 1 to 5 below, including row 3, and nothing for rows 6 to 10. They also agreed on inputs outside the table. 57 3XX… without a plus, 03 3XX… with the old prefix and 009 57 3XX… with a Colombian exit code all became the right E.164 number. +57 03XX…, with a stray 0 after the country code, was rejected, and so were numbers in the 306, 325 and 9101 blocks. The libphonenumber column shows what the library makes of each input on its own, without our two extra rules. The shape regex column tests the pattern most tutorials give, after spaces, dashes and brackets are removed:

Rows 3, 8 and 9 are the ones to remember:

1. Row 3: 0057 passes the regex, but libphonenumber on its own rejects it. Colombia's metadata lists the international prefixes 005, 007, 009, 00414, 00444 and 00456, so the parser reads 005 as the exit code and the rest no longer fits. Without the rewrite you lose real customers.
2. Row 8: 34X is shaped like a mobile number and passes the regex, but no mobile range starts there, so an OTP sent to it is wasted.
3. Row 9: a 60X landline fails the regex (the regex expects 3 or 9 first) but is a valid number. If you accept landlines for voice calls, don't run them through a mobile-only check.

Our post on why an E.164 regex is not enough shows the same problem in other countries, and our Python and JavaScript guides cover more languages.

#Does number portability change the carrier?

Yes. Mobile number portability started on 29 July 2011, under Ley 1245 de 2008 and Resolución CRC 2355 de 2010. At launch a port took up to five business days (MinTIC, 2011), and from 1 July 2020 less than one business day (CRC, 2020). The rules in force as of November 2026, from the CRC's compiled Resolución 5050 de 2016 and two later resolutions:

• Next calendar day. A request made between 8 a.m. and 4 p.m., any day including holidays, is activated in the next calendar day's change window. If the request isn't made in a shop, the clock starts when the customer receives the new SIM, and the whole port can't take more than three business days (article 2.1.17.3).
• Mobile numbers only. Portability covers non-geographic numbers (mobile network numbers, service numbers and UPT numbers), not 60X landlines (article 2.6.1.2).
• PIN by SMS, no debt barrier. The central database administrator sends a confirmation PIN by SMS. Since June 2023 an unpaid balance with the old operator is no longer a reason to refuse a port; the donor operator can still collect it (Resolución CRC 7151 de 2023).
• 30 days before porting back. Since 1 September 2026, the PIN isn't issued if the customer wants to go back to an operator they left less than 30 calendar days ago (Resolución CRC 8171 de 2026, article 11).

Porting is common. The CRC counts 65.8 million ports from 2011 to March 2026, about 6.9 million of them in 2025, and 1.5 million in the first quarter of 2026, 10.3% fewer than a year earlier (CRC Data Flash 2026-005). The Colombia row of our MNP atlas:

Our MNP atlas compares Colombia with other countries. For routing, pricing or fraud rules, look up the current network per number instead of reading the 3XX code. Our SMS routing with MNP and HLR use case shows where that pays off.

#Which messaging apps and channels reach people?

SMS reaches every active mobile. On WhatsApp, Colombia has its own row in Meta's rate card rather than sitting in a regional group, so a business pays Colombian rates per message category (Meta pricing, read on 2026-11-02). Our WhatsApp Business API pricing post explains the categories.

We didn't find a published source that measures messaging-app use in Colombia in a way we can verify, so we don't quote shares. The practical answer is to measure your own opted-in customers. Check which apps they are registered on, route each person to the channel they use, and keep SMS as the fallback. Our channel-by-country guide shows the method.

#How do I check WhatsApp registration for a Colombian customer list?

Normalise every row first, then run one check per number. A check tells you whether a number is registered at the time of the check. Like any registration check, it can't tell you whether the person wants your messages:

For lists, use a bulk job. WhatsApp checks get the bulk price only for groups of at least 132 numbers from the same country in one job, so collect a day's Colombian numbers into one job rather than sending many small ones. Upload a CSV whose numbers are written nationally (3XX XXXXXXX) with default_country=CO:

curl https://api.mobilevalidate.com/v1/jobs \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -F file=@customers.csv -F checks=whatsapp,carrier -F default_country=CO

Send the same body to POST /v1/jobs/estimate first: it is free and shows the maximum cost before anything runs. Unknown or inconclusive results are never charged; see current prices. Our bulk WhatsApp number check post walks through the whole flow.

#What are the rules for SMS, calls and personal data?

These summarise the laws and CRC resolutions as we read them on 2026-11-02. Not legal advice; ask counsel how they apply to you.

#Contact hours and limits: Ley 2300 de 2023

Ley 2300 de 2023, known as the "dejen de fregar" ("stop bothering") law, took effect on 10 October 2023 (Senate text). It was written for debt collection, and article 5 applies it "in the same terms" to advertising sent by SMS, messaging apps, websites, e-mail and phone calls. The main rules:

• Hours. Contact is allowed Monday to Friday from 7 a.m. to 7 p.m. and Saturday from 8 a.m. to 3 p.m., with no contact on Sundays or public holidays (article 3). Article 5 repeats that advertising may only be sent within those hours.
• Frequency. Once a collector has reached the consumer, it may not contact them through several channels in the same week or more than once in the same day (article 3). Because article 5 extends the law to advertising, plan marketing around the same limits.
• Authorised channels. Collectors may only use the channels the consumer has authorised (article 2).
• Easy opt-out, no forced consent. A purchase or entering a shop can't be made conditional on accepting marketing, promotions that feed databases need explicit acceptance, and the sender must offer a quick, simple way to stop messages (article 5).
• Exceptions. The limits don't cover confirmations of money transactions, information the consumer asked for, or alerts about fraudulent or unusual transactions (article 8).
• Enforcement. The Superintendencia de Industria y Comercio (SIC) and the Superintendencia Financiera sanction breaches, each within its remit (article 9).

#The do-not-contact register (RNE)

The CRC runs the Registro de Números Excluidos (RNE). Since Resolución CRC 7356 de 2024, anyone can register for free to refuse marketing by SMS, apps or web, e-mail and calls. Registration or removal takes effect the next business day, and businesses can consult the register before a campaign. Senders of SMS with commercial content have five business days after a registration to stop, and short-code holders must comply with Ley 1581 de 2012 or risk losing the code (Resolución CRC 7356 de 2024). Messages the person asked for, before or after registering, aren't blocked. Ported numbers don't carry their registration automatically: the person must update it.

#Short codes today

Business SMS go out from short codes that the CRC assigns. A short code has five or six digits: the first two identify the service mode (one-off purchase, subscription, mass messages, free to the user, or adult content), and the rest identify the content or application. Only commercial or advertising messages and transactional messages may be sent through them, and an applicant must first be registered as a content and application provider with the CRC (Resolución CRC 5050 de 2016, articles 6.4.1.1, 6.4.1.2 and 6.4.2.1).

#What changes with Resolución CRC 8308 de 2026

On 30 July 2026 the CRC published Resolución 8308 de 2026 against fraud by call and SMS (CRC; MinTIC). It phases in three groups of measures:

1. Calls (about three months). Companies that call people for marketing must register the numbers they call from with their operator. Those calls show the label "Llamada con fines publicitarios" (call for advertising purposes), and suspicious calls get a warning label. MinTIC dates this phase from 30 October 2026.
2. Ordinary lines sending bulk SMS (six months). Operators must monitor person-to-person lines for patterns such as mass sending to many recipients, SIM farms, or A2P traffic disguised as P2P, and may restrict them after notice.
3. A2P SMS (12-month transition). Business messages move to a new "código corto A2P", a registered alphanumeric Sender ID of 3 to 11 characters tied to the sender's legal or brand name, and pre-approved message templates. A centralised validator will check them, and after the transition messages that fail validation will be blocked. Foreign senders can hold a Sender ID if they have a branch or an authorised representative in Colombia.

The 12-month transition only starts when the CRC publishes a separate resolution on A2P remuneration. As of 2026-11-02 we found only the draft of that rule (CRC draft), so today's short-code regime still applies. If you send SMS to Colombia from abroad, ask your provider now how it will register your Sender ID and templates.

#Personal data: Ley 1581 de 2012 and the SIC

Ley Estatutaria 1581 de 2012 requires the holder's authorisation, defined as "prior, express and informed" consent, for processing personal data, obtained in a way you can show later. When asking for it, you must say what the data is for and what rights the person has. The SIC is the data protection authority and can fine up to 2,000 monthly minimum wages, repeatedly while a breach continues (Senate text, articles 3, 9, 12, 19 and 23).

The SIC applies this to marketing. In October 2025 it confirmed a fine on Colombia Telecomunicaciones (Movistar) for repeatedly contacting another operator's customers by SMS, WhatsApp and calls without that consent. It said such processing must follow Ley 1581 de 2012 and Ley 2300 de 2023 strictly (SIC, 29 October 2025). A registration check on a customer's number is processing of personal data too, so keep it to your own customers and a stated purpose. Our consent guide sets out that baseline.

#What that means for OTP

A one-time passcode the user asked for is "information requested by the consumer", which Ley 2300's limits exclude (article 8), and it isn't marketing. It still travels the same routes. Send it through a provider with an assigned short code, keep offers out of it, and plan for the Sender ID and template registration under Resolución 8308. Don't reuse numbers collected for verification for marketing unless the person opted in. Our debt collection contactability use case covers the channel-first approach Ley 2300 rewards.

#What changed recently?

The rows for CO and +57 in our numbering-plan changes dataset, built from libphonenumber's release notes:

Latest numbering-plan updates for CO: 2025-05-23 (v9.0.6), 2024-10-30 (v8.13.49), 2024-09-19 (v8.13.46), 2023-09-27 (v8.13.22), 2022-09-08 (v8.12.55).

That dataset stops at September 2026. libphonenumber's 22 October 2026 release (v9.0.42) updated Colombia's numbering-plan metadata, short numbers and carrier data again, so update your library at least monthly. Beyond numbering, the changes that matter are:

• 30 July 2026: Resolución CRC 8308 de 2026 on call and SMS fraud, with call labels from late October 2026 and Sender IDs after a transition.
• 1 September 2026: the 30-day wait before porting back to the previous operator.
• February to April 2026: Millicom (Tigo) took full ownership of Coltel (Movistar).
• October 2025: the SIC's confirmed fine for marketing contact without consent.

#What can MobileValidate check for Colombian numbers?

Generated from our public catalog:

* bulk jobs only. Catalog as fetched on 2026-11-02; the live list is at GET /v1/services.

A lookup returns network and registration facts. It never returns a subscriber's name, ID number or address, and we don't offer "number details" searches.

Here is a practical flow for a customer list: normalise with normalize_co(), then one real-time lookup gives the line type, the current network and WhatsApp registration. It uses the public sandbox key mv_test_publicSandboxn9ZgneuhR1B9CRfKG3fulym and our test values. The sandbox accepts only those UK drama numbers, so the example uses them. With a live key, pass the output of normalize_co().

import os

import requests  # pip install requests

API = "https://api.mobilevalidate.com/v1/lookup"
KEY = os.environ["MOBILEVALIDATE_API_KEY"]


def profile(numbers: list[str]) -> dict[str, dict]:
    """Line type, current network and WhatsApp registration per number. None means we don't know."""
    r = requests.post(API, headers={"Authorization": f"Bearer {KEY}"}, timeout=15,
                      json={"numbers": numbers, "checks": ["carrier", "whatsapp"], "wait": 5})
    r.raise_for_status()
    out = {}
    for row in r.json()["results"]:
        carrier, wa = row["checks"]["network.carrier"], row["checks"]["whatsapp.registered"]
        attrs = carrier["attributes"] or {}
        out[row["e164"]] = {
            "line_type": attrs.get("line_type"),
            "network": attrs.get("carrier"),
            "whatsapp": wa["registered"] if wa["status"] == "completed" else None,
        }
    return out


for number, info in profile(["+447700900001", "+447700900002", "+447700900005"]).items():
    print(number, info)

What the test values return (we ran it against the sandbox on 2026-11-02):

Keep None apart from False: None means we don't know, and it's never billed. Requests with 20 or more consecutive numbers are refused (403 suspected_enumeration), and our acceptable use policy forbids finding recipients for unsolicited messages. People can object through our opt-out form. See WhatsApp number check, MNP lookup, HLR lookup and carrier lookup for the fields.

#What are the key takeaways?

• Colombian numbers are +57 plus 10 digits. Mobiles start with 3 (3XX XXXXXXX), landlines with 60X since 2021. Store the E.164 form.
• Rewrite 0057 to +57 before parsing, drop the old 03, and convert old one-digit area codes by adding 60 in front.
• The 3XX code names the range holder (Claro, Movistar, Tigo, WOM, Avantel or a virtual operator), not the current network: porting has run since 29 July 2011 and now takes a day.
• Send marketing only Monday to Friday 7 a.m. to 7 p.m. and Saturday 8 a.m. to 3 p.m., check the RNE, and get prior, express and informed consent under Ley 1581 de 2012.
• Prepare for Resolución CRC 8308 de 2026: registered calling numbers for marketing calls now, Sender IDs and templates for A2P SMS later.

Platform, regulator and company names are used descriptively. MobileValidate is not affiliated with any of them.