# How to tell if a phone number is fake: a practical checklist

> How to tell if a phone number is fake at sign-up, in a lead form or on a list: format, line type, network status, app presence, reputation and patterns.

Canonical: https://mobilevalidate.com/blog/how-to-tell-if-a-phone-number-is-fake · Last updated: 2026-10-14

![A form's phone field with a question mark feeds a five-row checklist for format, line type, network status, app presence and patterns, which branches into accept, a one-time code step and a rejected card.](https://mobilevalidate.com/images/blog/how-to-tell-if-a-phone-number-is-fake.svg)

*No single check proves a number is real: layer the signals, then accept, step up or reject.*


By MobileValidate team (https://mobilevalidate.com/about) · Published: 2026-10-14 · Category: Fraud prevention · Tags: Fake numbers, Sign up fraud, Lead verification, Line type, HLR, Fraud prevention

To tell if a phone number is fake, check it in layers: is it a valid number for its country, what kind of line is it, does the mobile network report it as assigned, is it used on messaging apps, and does it fit a suspicious pattern such as reuse or sequential digits. No single check proves a number is real. Only a one-time code proves the person controls it.

This checklist is for businesses that collect numbers in sign-up forms, lead forms, checkouts and imported lists. It isn't about identifying who is calling you: MobileValidate never does reverse lookups (number to name, photo or profile), and nothing below needs one. The decision table near the end puts the layers together.

## What does "fake" mean for a phone number?

"Fake" covers at least five different problems, and each one needs a different check. Mixing them up is how teams end up blocking real customers while fakes get through.

| Kind of fake | Typical example | What catches it |
|---|---|---|
| Not a number at all | `1234567890`, `0000000000`, too few digits | Format validation |
| A valid-looking number nobody has | Random digits in a valid range; a number reserved for TV drama | Network status (HLR) |
| A real number of the wrong kind | A toll-free or premium-rate number in a "mobile" field | Line type |
| A real number the person doesn't control | Someone else's number, a public SMS-receive number | One-time code, reuse patterns |
| A real number used at scale | Many accounts or leads on cheap app-based numbers | Line type plus velocity and reuse patterns |

Fake numbers in lead forms are mostly the first two rows: junk typed to get past a required field. Fake numbers at sign-up are mostly the last two: the number works, but it is used to create accounts someone shouldn't have.

## Is the number even valid for its country?

Start with format: parse the number to [E.164](/glossary/e164) and ask whether it is valid for its country. This layer is free, instant and catches most junk typed into forms.

E.164 is the ITU's international numbering plan: `+`, country code, national number ([ITU-T, 2026](https://www.itu.int/rec/T-REC-E.164)). A library such as Google's libphonenumber tells you two things:

- **Possible**: the length fits the country.
- **Valid**: the number falls in a range that the country's numbering plan allows to be assigned.

That is useful, but it stops there. libphonenumber's own FAQ says a valid range is one from which numbers "can be freely assigned by carriers to users", and warns: "Do not rely on libphonenumber to determine whether numbers are currently assigned to a specific user and reachable" ([Google, 2026](https://github.com/google/libphonenumber/blob/master/FAQ.md)). Our post on [what libphonenumber can and can't check](/blog/does-libphonenumber-check-if-a-number-is-active) goes into the detail.

Add a few cheap pattern rules on top, because junk often passes validation:

- **Fiction ranges.** Some ranges are reserved so they never reach a real person. In North America, "only 555-0100 through 555-0199 are now specifically reserved for fictional use" ([Wikipedia, 2026](https://en.wikipedia.org/wiki/555_(North_American_Numbering_Plan))). In the UK, Ofcom reserves blocks for TV and radio drama, including mobile numbers 07700 900000 to 900999 ([Ofcom, 2026](https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/numbers-for-drama)). A sign-up with one of these is a test entry or a fake.
- **Repeated or ascending digits** such as `5555555555` or `0123456789`. Some are technically valid; few belong to real customers.
- **Your own business numbers**, typed in by someone who didn't want to give theirs.

With MobileValidate, every number is normalized first. Input that can't be parsed comes back as `number_status: "invalid_number"` and is never checked or charged. Show the user the error while they're still on the page: that's the only moment a typo can be fixed.

## What kind of line is it?

Look up the line type: mobile, fixed line, VoIP, toll-free, premium rate and so on. A real number of the wrong kind is often the first sign of a fake entry.

A [line type](/glossary/line-type) lookup describes the specific number from current data, which is more reliable than guessing from the range. The [carrier lookup](/services/carrier-lookup) returns `line_type`, the current `carrier`, and `original_carrier` when the number was ported. How to read it for fake detection:

| `line_type` | What it suggests | Typical reaction |
|---|---|---|
| `mobile` | A normal mobile number | No signal on its own |
| `fixed_line` | A landline; can't receive SMS in most countries | Offer a voice code or ask for a mobile |
| `voip` | Internet-telephony provider; may be app-based | Extra step in risky flows, not a block |
| `toll_free`, `premium_rate`, `shared_cost` | Almost never a personal contact number | Ask for another number |
| `unknown` (`NO_DATA`) | No data held; free | No signal |

A VoIP number is not a fake number: home phones, office systems and many small businesses run on VoIP. App-based (non-fixed) VoIP numbers are just easier to create in bulk. Our [VoIP detection guide](/blog/voip-number-detection-for-signups) covers fixed versus non-fixed VoIP and the false positives, and the post on app-based numbers at sign-up explains why some now look like mobile numbers.

## Is the number assigned and in service?

Ask the mobile network. An [HLR lookup](/services/hlr-lookup) queries the number's home network and answers whether the number is assigned and whether the phone is reachable right now. This is the strongest check against made-up numbers that pass format validation.

The answer is `status`:

- `reachable`: the network knows the number and can reach it now.
- `unreachable`: the number exists, but the phone is off or out of coverage. That is not a fake.
- `invalid`: the network reports the number as not assigned. For a form entry, this is the clearest sign of a made-up number.
- `unknown`: no conclusive answer, for example after a timeout. Free, and no signal.

Two limits matter. The HLR lookup works only for mobile numbers, because landlines and most VoIP numbers have no home-network register to query. And an assigned number isn't necessarily the user's number: someone can type a real number that belongs to someone else. For more on the different meanings of "active", see [how to check if a phone number is active](/blog/how-to-check-if-a-phone-number-is-active).

It is billed per conclusive answer, including `invalid` and `unreachable` (see [pricing](/pricing)), so many teams reserve it for leads sales will call or sign-ups that unlock credit.

## Could it be a disposable or temporary number?

Possibly, and no lookup can confirm it with certainty. Treat "disposable" as a pattern you detect over time, not a flag you look up.

Two kinds of number cause most of the trouble:

- **Public SMS-receive numbers.** Websites publish numbers whose incoming text messages anyone can read. They're used to pass verification without giving a personal number. Because the same few numbers are shared, they tend to show up across many unrelated accounts.
- **Short-lived virtual numbers.** App-based or rented numbers obtained for one code and released afterwards.

The practical signals are:

- **Reuse in your own data.** The same number on several accounts, or on accounts that were banned, is the strongest disposable signal you have, and it costs nothing. Count accounts per E.164 number.
- **Line type `voip`**, combined with another risk signal.
- **Your blocklist** of numbers already tied to abuse.
- **A one-time code**, which stops anyone who doesn't control the number, though not someone using a shared receive-number website. That's why reuse counts matter.

## Does messaging-app presence prove a number is real?

No, but it is a useful weak positive signal. A number that has an account on a popular messaging app has passed that app's own phone verification at some point, which made-up numbers can't do.

A [WhatsApp number check](/services/whatsapp-number-check) answers `registered: true`, `false` or unknown, with `checked_at`. Read it in one direction only:

- `registered: true` makes a made-up number unlikely.
- `registered: false` is **not** a fake signal. Many real people don't use a given app, especially outside the markets where it dominates, and landlines never have one.

Use presence to lower suspicion, never as a reason to reject. WhatsApp is named here descriptively only. MobileValidate is not affiliated with WhatsApp or Meta.

## Has the number been reported for spam or fraud?

Sometimes you can find out. The [spam reputation check](/services/spam-reputation) returns a level (`high`, `medium`, `low` or `no_reports`), a 0–100 score and the classes of signal behind it. It's currently in **limited access**, available to approved customers only, and its report coverage is strongest for North American and European numbers.

For fake-number detection, one field stands out: `reason_unassigned` is true when the number was recently offered for sale as unassigned, which suggests a made-up lead or a spoofed caller ID. A `high` level with a `fraud_hacking` or `impersonation` category is worth a manual review. `no_reports` doesn't mean a number is genuine, only that we hold no reports for it. Our post on [phone number reputation](/blog/phone-number-reputation-explained) explains how reputation is built.

## Which patterns give fake numbers away?

Patterns across many entries are often stronger than any check on one number. Fake numbers tend to arrive in bursts and in sequences.

Watch for:

- **Velocity.** Many sign-ups or leads in a short time from one carrier, one range or one country you don't usually see.
- **Sequential runs.** `…100`, `…101`, `…102` from different "people" is enumeration, not customers. MobileValidate refuses requests with 20 or more consecutive numbers (`403 suspected_enumeration`), see [rate limits and abuse](/docs/rate-limits-and-abuse), but you should also look for runs in your own forms.
- **Duplicates.** The same number behind several accounts, leads or orders.
- **Mismatches.** A number's country that doesn't match the IP, billing address or shipping country.
- **Code requests without completion.** Many verification codes requested to numbers in one premium or unusual range, with few codes ever entered, points to [SMS pumping](/glossary/sms-pumping) rather than real users.

These rules are free and catch fakes that pass every per-number lookup, because the numbers involved are often real.

## How do I check several layers in one request?

Send the number with the checks you need in one call to `POST /v1/lookup` (up to 100 numbers, up to 20 checks). This example uses [test numbers](/docs/test-mode), so nothing is billed:

```bash
curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001"], "checks": ["carrier", "hlr", "whatsapp"], "wait": 5}'
```

Each answer comes back under `checks`, keyed by its code (`network.carrier`, `number.hlr`, `whatsapp.registered`), with `status` and `checked_at`. In test mode, `+447700900001` returns a mobile line, `reachable` and `registered: true`; the [test mode page](/docs/test-mode) lists numbers for every other branch. If an answer is still pending, don't block the user: continue with your default flow.

For an imported list, run the same checks as a [bulk job](/docs/bulk-jobs). Send the list to `POST /v1/jobs/estimate` first: it's free and shows the invalid and duplicate counts and the maximum cost before anything runs. Unknown or inconclusive results are never charged.

## How do I turn the signals into a decision?

Use three outcomes, not two: accept, step up, reject. Most suspicious numbers deserve a second verification step, not a block, and `unknown` is always no signal.

| Signal | Accept | Step up (code, other channel, hold reward) | Reject or ask again |
|---|---|---|---|
| Format | Valid | — | Invalid, fiction range, repeated digits |
| Line type | `mobile`, `fixed_line` where you can call | `voip` in a flow with rewards or payouts | `premium_rate`, `toll_free` as a personal number |
| HLR `status` | `reachable`, `unreachable` | — | `invalid` (not assigned): ask the user to correct it |
| Messaging presence | `registered: true` lowers suspicion | `false` only together with other signals | Never on its own |
| Spam reputation (limited access) | `no_reports`, `low` | `medium` | `high` with fraud category or `reason_unassigned`: review |
| Patterns | No reuse, normal velocity | Number on 2+ accounts, country mismatch | Sequential runs, known abuse number |
| Any check `unknown` | Treat as no signal | — | — |

For a lead form, "reject" usually means "ask again": show a message asking the person to check their number, rather than silently discarding the lead. For a sign-up, "step up" means sending a code by SMS or voice, offering another verification method, or holding a bonus until the account has some history. NIST's digital identity guidance takes a similar line for phone-based codes, asking verifiers to consider risk indicators such as device swap, SIM change and number porting before relying on the phone network ([NIST, 2025](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)).

If you want points, weights and reason codes instead of a table, see [how to build a phone number risk score](/blog/how-to-build-a-phone-number-risk-score). For the full sign-up defence with e-mail checks and friction tiers, see [how to reduce fake sign-ups](/blog/how-to-reduce-fake-signups-with-phone-and-email-checks). Our phone-number fraud signals field guide maps each signal to specific attacks.

## Where should each check run?

Free checks (format, fiction ranges, repeated digits, duplicates, velocity) belong on every form. Add line type before sending a code at sign-up ([OTP and sign-up fraud](/use-cases/otp-and-signup-fraud)), the HLR lookup and, with access, spam reputation for leads sales will call ([lead verification](/use-cases/lead-verification)), and a bulk job with line type and HLR for imported lists. See current prices on the [pricing page](/pricing).

## What are the consent and privacy rules?

- **Check only numbers you have a reason to process**, such as sign-ups, leads and customers who gave you their number. A phone number usually identifies a person, so data protection rules apply.
- **Store the answer and `checked_at`**, not more.
- **No eligibility decisions** (credit, housing, jobs, insurance) and no list building for unsolicited messages: the [acceptable use policy](/legal/acceptable-use) forbids both.
- **No reverse lookups.** No check returns a name, photo, profile or location.
- **Objections** go through the [opt-out form](/opt-out); suppressed numbers are skipped and never charged.

## What are the key takeaways?

- "Fake" means different things: junk input, unassigned numbers, the wrong line type, numbers the user doesn't control, and real numbers used at scale. Each needs its own check.
- **Format validation is free** and catches junk, but a valid number may still be unassigned. Add fiction-range and repeated-digit rules.
- **Line type** catches the wrong kind of number. VoIP is a reason for a step-up, not a block.
- **The HLR lookup** is the strongest test for made-up mobile numbers: `invalid` means the network reports it as not assigned.
- **Messaging presence** is a weak positive signal; its absence proves nothing.
- **Patterns** such as reuse, sequences and velocity catch fakes that pass every per-number check.
- Decide with **accept, step up or reject**, treat `unknown` as no signal, and remember that only a one-time code proves the person controls the number.

## Sources

1. [libphonenumber FAQ](https://github.com/google/libphonenumber/blob/master/FAQ.md) — Google, 2026
2. [E.164: The international public telecommunication numbering plan](https://www.itu.int/rec/T-REC-E.164) — ITU-T, 2026
3. [TV and radio drama telephone numbers](https://www.ofcom.org.uk/phones-and-broadband/phone-numbers/numbers-for-drama) — Ofcom, 2026
4. [555 (North American Numbering Plan)](https://en.wikipedia.org/wiki/555_(North_American_Numbering_Plan)) — Wikipedia, 2026
5. [NIST SP 800-63B-4: Digital Identity Guidelines, Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) — NIST, 2025

## Frequently asked questions

### How can I tell if a phone number is fake?

Check it in layers. First confirm it is a valid number for its country, then look up its line type, ask the mobile network whether it is assigned, and check whether it is used on messaging apps. Watch for patterns such as reused or sequential numbers. Only a one-time code proves the person controls the number.

### Is there a free way to check if a phone number is real?

Partly. An open-source library such as libphonenumber tells you, for free, whether a number is possible and valid for its country. It can't tell you whether the number is assigned to anyone or in use. That needs a live network lookup or a code sent to the number.

### Does a VoIP number mean the number is fake?

No. A VoIP number is a real, working number served by an internet-telephony provider. App-based VoIP numbers are easier to create in bulk, so they deserve an extra verification step in risky flows, but many genuine customers and businesses use VoIP.

### Can a lookup detect disposable or temporary SMS numbers?

Not with certainty. No check returns a reliable disposable flag for every number. Line type, numbers reused across many of your accounts and your own blocklist are the practical signals; a one-time code still stops numbers the user doesn't control.

### What should I do when a check returns unknown?

Treat it as no signal, not as a sign of a fake number. Fall back to your default flow, such as sending the verification code, and never overwrite a stored conclusive answer with unknown. Unknown answers are not charged.

### Can MobileValidate tell me who owns a phone number?

No. MobileValidate never does reverse lookups: no names, photos, profiles or addresses. The checks describe the number itself: whether it is valid, what kind of line it is, whether the network knows it and whether it is registered on an app.