# HLR lookup vs MNP lookup vs number validation: what each one answers

> Validation checks the digits, MNP finds the current network, HLR asks the network if the number is live. What each answers, costs and misses.

Canonical: https://mobilevalidate.com/blog/hlr-vs-mnp-vs-number-validation · Last updated: 2026-09-25

![Cover: HLR lookup vs MNP lookup vs number validation: what each one answers](https://mobilevalidate.com/og/blog/hlr-vs-mnp-vs-number-validation.png)


By MobileValidate team (https://mobilevalidate.com/about) · Published: 2026-09-25 · Category: Guides · Tags: HLR lookup, MNP, Number validation, Carrier lookup, Deliverability

Number validation, MNP lookups and HLR lookups answer three different questions. Validation asks whether the digits could be a real number. An MNP (mobile number portability) lookup asks which network the number belongs to today. An HLR lookup asks the home network whether the subscriber is live right now. Most teams need the first on every number and the others only where a wrong answer costs money.

## What does each check actually answer?

The three names get used as if they were grades of the same product. They aren't. Each one reads a different source of truth, so each one can be right while the others are silent.

| Check | Question it answers | Source of truth | Works for |
|---|---|---|---|
| Number validation | Is this a possible, correctly formatted number for its country? | The national numbering plan, as published and encoded in libraries | Every number type |
| MNP lookup | Which network serves this number today, and was it ported? | Porting databases or reference data built from them | Mobile, and landline where fixed portability exists |
| HLR lookup | Is the number assigned, is the subscriber reachable now, are they roaming? | The home network's subscriber register, queried live | Mobile numbers only |

A useful way to remember it: validation is about the **number**, MNP is about the **network**, and HLR is about the **subscriber**. The further down the list, the more you learn, and the more things can go wrong on the way to an answer.

## How does number validation work?

Validation is an offline calculation. Every country publishes a numbering plan that says which ranges exist, how long numbers are and which ranges are mobile, fixed, toll-free or premium-rate. The international frame for these plans is [ITU-T Recommendation E.164](https://www.itu.int/rec/T-REC-E.164/en) ([ITU, 2010](https://www.itu.int/rec/T-REC-E.164/en)), which also caps a full international number at 15 digits.

Open-source libraries such as [Google's libphonenumber](https://github.com/google/libphonenumber) ([Google, 2026](https://github.com/google/libphonenumber)) package those plans as metadata. Given `07911 123456` and the country `GB`, they return `+447911123456`, say the number is valid, and give a range-based type such as `MOBILE`. It takes microseconds and costs nothing.

What validation cannot do is tell you whether anyone holds the number. A valid number may never have been issued. It may have been disconnected last year. The type is a property of the range, not of the current service, so a number ported from a landline to a VoIP provider still looks like a landline. See [E.164](/glossary/e164) and the [E.164 guide for developers](/blog/e164-phone-number-format-guide-for-developers) for the pitfalls.

## How does an MNP lookup work?

When a subscriber keeps their number and moves to another operator, the number no longer lives on the network its range was allocated to. Regulators made this a right: in the US, wireless portability has existed since November 2003 in the largest metropolitan areas and since May 2004 elsewhere ([FCC](https://www.fcc.gov/general/wireless-local-number-portability-wlnp)), and the EU's electronic communications code requires porting in [Article 106](https://eur-lex.europa.eu/eli/dir/2018/1972/oj) ([EU, 2018](https://eur-lex.europa.eu/eli/dir/2018/1972/oj)).

To route calls and texts, networks keep track of ported numbers. Many countries run a central porting database; others make each operator keep its own copy. An MNP lookup reads that data, directly or through a regularly refreshed replica, and returns the current network and usually a "ported" flag.

It answers "who serves this number?" well. It does not say whether the phone is on, whether the line is still in service, or whether the subscriber is abroad. Because the data is copied, a very recent port can take a while to show up. The [portability post](/blog/mobile-number-portability-why-carrier-lookups-can-be-wrong) explains why prefix-based carrier guesses fail.

## How does an HLR lookup work?

An HLR lookup asks the mobile network itself. Every operator keeps a register of its subscribers: the Home Location Register in 2G and 3G, with successors in 4G and 5G. When an SMS is delivered between networks, the sending side first asks the recipient's home register where to send it, using the MAP protocol specified in [3GPP TS 29.002](https://www.3gpp.org/DynaReport/29002.htm) ([3GPP](https://www.3gpp.org/DynaReport/29002.htm)). An HLR lookup makes the same kind of routing query without sending a message.

The reply shows whether the number is assigned, whether the subscriber is currently attached to a network, which network holds the subscription (so porting) and whether it is a foreign network (so roaming). Nothing appears on the handset.

Its limits are practical. It works for mobile numbers only. Some operators block or mask external queries, and some return generic answers to protect subscribers, so a good service reports those cases as unknown rather than guessing. Raw replies can include identifiers such as the IMSI or the serving switch, which should never leave a telecom environment. See the [HLR lookup glossary entry](/glossary/hlr-lookup).

## How do cost and speed compare?

We won't quote market prices or response times here, because they vary by country, route and volume, and any single number would be misleading. The relative order is stable, though, and it follows from how each check works.

| | Validation | MNP lookup | HLR lookup |
|---|---|---|---|
| Where the answer comes from | Local metadata | A database or replica | The home network, live |
| Relative cost | Free | Low | Higher: each query crosses networks |
| Relative speed | Instant | Fast | Depends on the destination network |
| Freshness | As fresh as the library release | As fresh as the replica | Real time |
| Typical failure | Outdated metadata | Recent port not yet visible | Network blocks or masks the query |

The practical consequence: run validation on everything, because it is free and removes junk before you pay for anything. Spend on network data only where the answer changes what you do next.

## Which check should you use when?

Pick the cheapest check that answers the question your workflow actually asks. This decision table covers the common cases.

| Situation | Minimum check | Add when it pays off | Why |
|---|---|---|---|
| Form field accepts a phone number | Validation | Line type | Catches typos while the person is still on the page |
| Sending an OTP by SMS | Validation + line type | Live reachability | Don't send codes to landlines or premium-rate ranges; offer another channel to unreachable phones |
| Routing or pricing SMS by network | Current network (MNP) | — | Prefix-based guesses are wrong for every ported number |
| Cleaning an old contact list before a consented campaign | Validation + line type | Live reachability | Removes disconnected and never-assigned numbers before you pay per message |
| Fraud review of a new sign-up | Line type + current network | Channel checks, spam reputation | Signals about how the number is used, not only whether it exists |
| Checking landlines or VoIP numbers | Validation + line type | — | HLR lookups don't work for these line types |
| Deciding whether to call now | Live reachability | — | The only check that reflects the phone's state at this moment |

If you are unsure, start with validation and line type, measure how many messages still fail, and add a live check where the failure rate justifies it.

## What does MobileValidate offer for each?

Each layer maps to something you can call today, except the live one:

- **Validation and normalization** happen on every request, free. Each result carries `e164`, `country` and `number_status` (`valid`, `invalid_number`, `duplicate`, `suppressed`). Invalid and duplicate rows are never checked or charged.
- **Network data** comes from the [carrier lookup](/services/carrier-lookup): `line_type`, the current `carrier`, `country` and, when it differs, `original_carrier`, which is the porting signal. For US and Canadian numbers, where porting between landline, mobile and VoIP is common, the [US/CA carrier lookup](/services/us-carrier-lookup) runs in bulk jobs.
- **Live network status**, the [HLR lookup](/services/hlr-lookup), is **coming soon**. It will return `status`, `ported`, `roaming` (true or false only, never a location), `network`, `mcc_mnc` and `country`, and never the IMSI or serving switch.

One request can combine several checks. Here is a real test-mode call:

```bash
curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["07700 900001", "12345"], "checks": ["carrier"], "default_country": "GB"}'
```

Response (excerpt, test mode: the two items of `results`):

```json
[
  {"input": "07700 900001", "e164": "+447700900001", "country": "GB", "number_status": "valid",
   "checks": {"network.carrier": {"status": "completed", "registered": true,
     "attributes": {"line_type": "mobile", "carrier": "Test Carrier", "country": "GB"},
     "billed": false, "reason": null}}},
  {"input": "12345", "e164": null, "country": null, "number_status": "invalid_number"}
]
```

The invalid number never reaches a check. With a live key it would not be billed either.

## How should you read the answers together?

The layers disagree in predictable ways, and the disagreements are informative:

- **Valid, but carrier data is `unknown`.** The number fits the plan, but no data exists for it. That can mean a new range, a small operator or a number never issued. The result is free; treat it as "no evidence", not as "fake".
- **`original_carrier` differs from `carrier`.** The number was ported. Normal on its own; worth a look only together with other signals, such as a password reset minutes later.
- **Range says mobile, lookup says VoIP.** The number moved to an internet-telephony service. The lookup wins, because it describes the number today. See [VoIP detection for sign-ups](/blog/voip-number-detection-for-signups).
- **Valid mobile, unreachable in an HLR reply.** The phone is off or out of coverage. One unreachable answer means "try later"; repeated ones over weeks suggest an abandoned number.

Store `checked_at` with every answer. Network facts change, and a decision is only as good as the age of the data behind it.

## What are the key takeaways?

- **Validation** is free and offline. It checks the digits against the numbering plan, not whether anyone holds the number.
- **MNP** tells you the current network. It fixes routing and pricing mistakes caused by ported numbers.
- **HLR** asks the home network. It is the only one of the three that says whether a mobile subscriber is reachable now, and it doesn't work for landlines or most VoIP.
- Run validation on everything; add network checks where a wrong answer costs more than the check.
- In MobileValidate: normalization on every request, carrier lookup for line type and porting hints, HLR lookup coming soon. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). See [pricing](/pricing).

For a step-by-step view of what "active" means, read [how to check if a phone number is active](/blog/how-to-check-if-a-phone-number-is-active).

## Sources

1. [Recommendation ITU-T E.164: The international public telecommunication numbering plan](https://www.itu.int/rec/T-REC-E.164/en) — ITU, 2010
2. [3GPP TS 29.002: Mobile Application Part (MAP) specification](https://www.3gpp.org/DynaReport/29002.htm) — 3GPP, 2024
3. [Wireless Local Number Portability (WLNP)](https://www.fcc.gov/general/wireless-local-number-portability-wlnp) — FCC, 2004
4. [Directive (EU) 2018/1972 establishing the European Electronic Communications Code](https://eur-lex.europa.eu/eli/dir/2018/1972/oj) — European Union, 2018
5. [libphonenumber](https://github.com/google/libphonenumber) — Google, 2026

## Frequently asked questions

### Is an HLR lookup always better than an MNP lookup?

No. An HLR lookup answers more questions (is the subscriber reachable right now, are they roaming), but it only works for mobile numbers, depends on the home network answering, and usually costs more. If you only need to know which network a number is on, porting data is enough.

### Does number validation tell me whether a number exists?

No. Validation checks that the digits fit the country's numbering plan. A valid number may never have been assigned, or may have been disconnected years ago.

### Which check should run before every OTP?

Validation plus line type is the usual minimum: it removes impossible numbers and lines that cannot take SMS. Add a live reachability check where failed or wasted messages are expensive.

### Does MobileValidate offer HLR and MNP lookups?

Validation and E.164 normalization are free on every request. The carrier lookup returns line type, current carrier and the original carrier when a number was ported. The HLR lookup is coming soon.