How to tell if a phone number is fake: a practical checklist

To tell if a phone number is fake, check it in layers: is it a valid number for its country, what kind of line is it, does the mobile network report it as assigned, is it used on messaging apps, and does it fit a suspicious pattern such as reuse or sequential digits. No single check proves a number is real. Only a one-time code proves the person controls it.

This checklist is for businesses that collect numbers in sign-up forms, lead forms, checkouts and imported lists. It isn't about identifying who is calling you: MobileValidate never does reverse lookups (number to name, photo or profile), and nothing below needs one. The decision table near the end puts the layers together.

#What does "fake" mean for a phone number?

"Fake" covers at least five different problems, and each one needs a different check. Mixing them up is how teams end up blocking real customers while fakes get through.

Fake numbers in lead forms are mostly the first two rows: junk typed to get past a required field. Fake numbers at sign-up are mostly the last two: the number works, but it is used to create accounts someone shouldn't have.

#Is the number even valid for its country?

Start with format: parse the number to E.164 and ask whether it is valid for its country. This layer is free, instant and catches most junk typed into forms.

E.164 is the ITU's international numbering plan: +, country code, national number (ITU-T, 2026). A library such as Google's libphonenumber tells you two things:

• Possible: the length fits the country.
• Valid: the number falls in a range that the country's numbering plan allows to be assigned.

That is useful, but it stops there. libphonenumber's own FAQ says a valid range is one from which numbers "can be freely assigned by carriers to users", and warns: "Do not rely on libphonenumber to determine whether numbers are currently assigned to a specific user and reachable" (Google, 2026). Our post on what libphonenumber can and can't check goes into the detail.

Add a few cheap pattern rules on top, because junk often passes validation:

• Fiction ranges. Some ranges are reserved so they never reach a real person. In North America, "only 555-0100 through 555-0199 are now specifically reserved for fictional use" (Wikipedia, 2026). In the UK, Ofcom reserves blocks for TV and radio drama, including mobile numbers 07700 900000 to 900999 (Ofcom, 2026). A sign-up with one of these is a test entry or a fake.
• Repeated or ascending digits such as 5555555555 or 0123456789. Some are technically valid; few belong to real customers.
• Your own business numbers, typed in by someone who didn't want to give theirs.

With MobileValidate, every number is normalized first. Input that can't be parsed comes back as number_status: "invalid_number" and is never checked or charged. Show the user the error while they're still on the page: that's the only moment a typo can be fixed.

#What kind of line is it?

Look up the line type: mobile, fixed line, VoIP, toll-free, premium rate and so on. A real number of the wrong kind is often the first sign of a fake entry.

A line type lookup describes the specific number from current data, which is more reliable than guessing from the range. The carrier lookup returns line_type, the current carrier, and original_carrier when the number was ported. How to read it for fake detection:

A VoIP number is not a fake number: home phones, office systems and many small businesses run on VoIP. App-based (non-fixed) VoIP numbers are just easier to create in bulk. Our VoIP detection guide covers fixed versus non-fixed VoIP and the false positives, and the post on app-based numbers at sign-up explains why some now look like mobile numbers.

#Is the number assigned and in service?

Ask the mobile network. An HLR lookup queries the number's home network and answers whether the number is assigned and whether the phone is reachable right now. This is the strongest check against made-up numbers that pass format validation.

The answer is status:

• reachable: the network knows the number and can reach it now.
• unreachable: the number exists, but the phone is off or out of coverage. That is not a fake.
• invalid: the network reports the number as not assigned. For a form entry, this is the clearest sign of a made-up number.
• unknown: no conclusive answer, for example after a timeout. Free, and no signal.

Two limits matter. The HLR lookup works only for mobile numbers, because landlines and most VoIP numbers have no home-network register to query. And an assigned number isn't necessarily the user's number: someone can type a real number that belongs to someone else. For more on the different meanings of "active", see how to check if a phone number is active.

It is billed per conclusive answer, including invalid and unreachable (see pricing), so many teams reserve it for leads sales will call or sign-ups that unlock credit.

#Could it be a disposable or temporary number?

Possibly, and no lookup can confirm it with certainty. Treat "disposable" as a pattern you detect over time, not a flag you look up.

Two kinds of number cause most of the trouble:

• Public SMS-receive numbers. Websites publish numbers whose incoming text messages anyone can read. They're used to pass verification without giving a personal number. Because the same few numbers are shared, they tend to show up across many unrelated accounts.
• Short-lived virtual numbers. App-based or rented numbers obtained for one code and released afterwards.

The practical signals are:

• Reuse in your own data. The same number on several accounts, or on accounts that were banned, is the strongest disposable signal you have, and it costs nothing. Count accounts per E.164 number.
• Line type voip, combined with another risk signal.
• Your blocklist of numbers already tied to abuse.
• A one-time code, which stops anyone who doesn't control the number, though not someone using a shared receive-number website. That's why reuse counts matter.

#Does messaging-app presence prove a number is real?

No, but it is a useful weak positive signal. A number that has an account on a popular messaging app has passed that app's own phone verification at some point, which made-up numbers can't do.

A WhatsApp number check answers registered: true, false or unknown, with checked_at. Read it in one direction only:

• registered: true makes a made-up number unlikely.
• registered: false is not a fake signal. Many real people don't use a given app, especially outside the markets where it dominates, and landlines never have one.

Use presence to lower suspicion, never as a reason to reject. WhatsApp is named here descriptively only. MobileValidate is not affiliated with WhatsApp or Meta.

#Has the number been reported for spam or fraud?

Sometimes you can find out. The spam reputation check returns a level (high, medium, low or no_reports), a 0–100 score and the classes of signal behind it. It's currently in limited access, available to approved customers only, and its report coverage is strongest for North American and European numbers.

For fake-number detection, one field stands out: reason_unassigned is true when the number was recently offered for sale as unassigned, which suggests a made-up lead or a spoofed caller ID. A high level with a fraud_hacking or impersonation category is worth a manual review. no_reports doesn't mean a number is genuine, only that we hold no reports for it. Our post on phone number reputation explains how reputation is built.

#Which patterns give fake numbers away?

Patterns across many entries are often stronger than any check on one number. Fake numbers tend to arrive in bursts and in sequences.

Watch for:

• Velocity. Many sign-ups or leads in a short time from one carrier, one range or one country you don't usually see.
• Sequential runs. …100, …101, …102 from different "people" is enumeration, not customers. MobileValidate refuses requests with 20 or more consecutive numbers (403 suspected_enumeration), see rate limits and abuse, but you should also look for runs in your own forms.
• Duplicates. The same number behind several accounts, leads or orders.
• Mismatches. A number's country that doesn't match the IP, billing address or shipping country.
• Code requests without completion. Many verification codes requested to numbers in one premium or unusual range, with few codes ever entered, points to SMS pumping rather than real users.

These rules are free and catch fakes that pass every per-number lookup, because the numbers involved are often real.

#How do I check several layers in one request?

Send the number with the checks you need in one call to POST /v1/lookup (up to 100 numbers, up to 20 checks). This example uses test numbers, so nothing is billed:

curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001"], "checks": ["carrier", "hlr", "whatsapp"], "wait": 5}'

Each answer comes back under checks, keyed by its code (network.carrier, number.hlr, whatsapp.registered), with status and checked_at. In test mode, +447700900001 returns a mobile line, reachable and registered: true; the test mode page lists numbers for every other branch. If an answer is still pending, don't block the user: continue with your default flow.

For an imported list, run the same checks as a bulk job. Send the list to POST /v1/jobs/estimate first: it's free and shows the invalid and duplicate counts and the maximum cost before anything runs. Unknown or inconclusive results are never charged.

#How do I turn the signals into a decision?

Use three outcomes, not two: accept, step up, reject. Most suspicious numbers deserve a second verification step, not a block, and unknown is always no signal.

For a lead form, "reject" usually means "ask again": show a message asking the person to check their number, rather than silently discarding the lead. For a sign-up, "step up" means sending a code by SMS or voice, offering another verification method, or holding a bonus until the account has some history. NIST's digital identity guidance takes a similar line for phone-based codes, asking verifiers to consider risk indicators such as device swap, SIM change and number porting before relying on the phone network (NIST, 2025).

If you want points, weights and reason codes instead of a table, see how to build a phone number risk score. For the full sign-up defence with e-mail checks and friction tiers, see how to reduce fake sign-ups. Our phone-number fraud signals field guide maps each signal to specific attacks.

#Where should each check run?

Free checks (format, fiction ranges, repeated digits, duplicates, velocity) belong on every form. Add line type before sending a code at sign-up (OTP and sign-up fraud), the HLR lookup and, with access, spam reputation for leads sales will call (lead verification), and a bulk job with line type and HLR for imported lists. See current prices on the pricing page.

#What are the consent and privacy rules?

• Check only numbers you have a reason to process, such as sign-ups, leads and customers who gave you their number. A phone number usually identifies a person, so data protection rules apply.
• Store the answer and checked_at, not more.
• No eligibility decisions (credit, housing, jobs, insurance) and no list building for unsolicited messages: the acceptable use policy forbids both.
• No reverse lookups. No check returns a name, photo, profile or location.
• Objections go through the opt-out form; suppressed numbers are skipped and never charged.

#What are the key takeaways?

• "Fake" means different things: junk input, unassigned numbers, the wrong line type, numbers the user doesn't control, and real numbers used at scale. Each needs its own check.
• Format validation is free and catches junk, but a valid number may still be unassigned. Add fiction-range and repeated-digit rules.
• Line type catches the wrong kind of number. VoIP is a reason for a step-up, not a block.
• The HLR lookup is the strongest test for made-up mobile numbers: invalid means the network reports it as not assigned.
• Messaging presence is a weak positive signal; its absence proves nothing.
• Patterns such as reuse, sequences and velocity catch fakes that pass every per-number check.
• Decide with accept, step up or reject, treat unknown as no signal, and remember that only a one-time code proves the person controls the number.