Phone number reputation: what it is, where it comes from and how it's scored

Phone number reputation is a summary of a number's history: how often people complained about it, whether regulators acted against it, whether it was reported on spam-report sites and how it behaves on the network, usually reduced to a risk level or score. Carriers use it to label or block calls, and businesses use it to screen inbound calls, leads and sign-ups. It describes the number, not the person, and "no reports" never means "safe".

#What is phone number reputation?

Phone number reputation is the trust a number has earned from its past behaviour and reports. Like a sender's reputation in e-mail, it is built by observers, not declared by the owner, and different observers reach different conclusions.

Two questions drive almost every use of it:

• Inbound: "Should I trust this number that is calling me or signing up?" Call centres, fraud teams and lead buyers ask this.
• Outbound: "Why are people's phones labelling my number as spam?" Sales teams, clinics and anyone who calls customers ask this.

This guide explains how reputation is built, which signals it uses and where it fails. For an inbound routing workflow, see screening inbound calls with spam reputation.

#Who scores a phone number's reputation?

There is no single global score. Several systems score numbers independently:

Because each system sees different data, a number can be clean in one and flagged in another. That is why a business that has fixed a problem with one carrier may still see labels on another.

#Which signals feed a reputation score?

US regulators have described the kind of analytics carriers may use. In 2019 the FCC clarified that voice providers may offer opt-out call blocking "based on any reasonable analytics designed to identify unwanted calls", and listed factors such as "large bursts of calls in a short timeframe; low average call duration; low call completion ratios; invalid numbers placing a large volume of calls; common Caller ID Name (CNAM) values across voice service providers; a large volume of complaints related to a suspect line; sequential dialing patterns; neighbor spoofing patterns" and "correlation of network data with data from regulators, consumers, and other carriers" (FCC 19-51).

Grouped by type, the signals look like this:

Messaging has its own version. CTIA's guidelines describe operators reporting, blocking and suspending unwanted message traffic, so a sender number's history affects whether its texts arrive (CTIA, 2023).

#Is STIR/SHAKEN the same as reputation?

No, and mixing them up leads to wrong conclusions. STIR/SHAKEN is caller ID authentication: the originating provider signs the call and states how well it knows the caller's right to use the number. An A-attested call means the provider vouches for the caller ID. It doesn't mean the call is wanted. A legitimate business can be spoofed, and an authenticated caller can still run a nuisance campaign.

Reputation systems use attestation as one input. In the same 2019 ruling, the FCC proposed a safe harbor for blocking unauthenticated calls, a step it said would encourage deployment of the SHAKEN/STIR framework (FCC 19-51).

#What can't a reputation score tell you?

Every score has blind spots, and good decisions account for them:

• Spoofing. A fraudster can display someone else's number. The reports then land on the innocent owner, and the fraudster's real line stays clean.
• New and rarely used numbers. They have no history. "No reports" is the normal state for most numbers.
• Reassigned numbers. A number with a bad history may now belong to someone new. See the Reassigned Numbers Database, explained.
• Coverage. Complaint data and community reporting are densest in North America and Europe. Elsewhere, the absence of reports is weaker evidence.
• Context. A debt collector, a pharmacy reminder line and a scam can all generate complaints. The category of reports matters as much as their count.

That's why reputation should route decisions (to an agent, an IVR, a verification step, a review queue) rather than make final verdicts about people.

#How does MobileValidate score spam reputation?

The spam reputation check is in limited access: approved customers only for now. It returns a level, a score and the reasons behind it, from daily-refreshed reference data:

Levels follow published rules. high needs a score of 80 or more and either a regulator action or at least two independent signal classes, so one noisy source can't make a number "high" on its own. medium is 50–79 and low is 20–49. Reports last seen more than 12 months ago count half, so old problems fade. Report texts, reporter details and names are never returned.

Every conclusive answer is billed, including no_reports, at $0.002 per number in real time and $0.001 in bulk at the time of writing (pricing). unknown answers and numbers from sanctioned countries and regions are free. Repeat checks within 24 hours come from your account's cache at no charge.

#How do you use reputation in a call or sign-up flow?

Here is a real-time check with a test key, where +447700900001 returns high and +447700900002 returns no_reports (see test mode):

curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+447700900002"], "checks": ["spam", "carrier"], "wait": 3}'

And a routing rule that treats reputation as one signal, not a verdict:

function route(item) {
  const spam = item.checks["number.spam"];
  if (spam?.status !== "completed") return "normal";            // unknown or late: don't punish the caller
  const a = spam.attributes;
  if (a.risk_level === "high" && ["impersonation", "fraud_hacking"].includes(a.top_category)) return "verify_identity";
  if (a.risk_level === "high") return "ivr_first";
  if (a.reason_unassigned) return "review";                     // likely spoofed caller ID or invented lead
  if (a.risk_level === "medium") return "flag_for_agent";
  return "normal";                                              // low or no_reports: handle as usual
}

The same idea works elsewhere:

• Call centres: route high callers to an IVR or a verification step instead of blocking. See call-center screening.
• Lead verification: a lead whose number was recently offered as unassigned is probably invented. See lead verification.
• Sign-ups: add risk_level to your fraud score next to line type from the carrier lookup and device signals. Our guide to reducing fake sign-ups shows how the signals combine.
• Your own numbers: check the numbers you call from on a schedule, so you see complaints before customers stop answering.

#How do you use reputation data fairly?

Reputation is information about a number that usually belongs to a person. Use it to protect your customers and staff, not to judge people. Don't use it for credit, employment, housing or insurance decisions; our acceptable use policy forbids that. Explain any extra step neutrally. Store checked_at with each decision, because scores change. If your own number appears in our data and you think it shouldn't, use the opt-out form; the data-subject notice explains your rights.

#Key takeaways

• Phone number reputation summarises a number's history: complaints, community reports, regulator actions and network behaviour.
• Carriers, apps, regulators and data services score numbers separately, so reputations differ between systems.
• US rules let carriers block calls using "reasonable analytics" such as call bursts, short durations, low completion ratios and complaint volumes.
• STIR/SHAKEN authenticates caller ID; it is an input to reputation, not a reputation score.
• "No reports" is not "safe": spoofing, new numbers, reassignment and thin coverage all hide risk.
• Use reputation to route calls, leads and sign-ups to the right next step. MobileValidate's spam reputation check (limited access) returns levels, scores and reasons, and never charges for unknown answers.