Screening inbound calls with spam reputation

Screening inbound calls with spam reputation means looking up the caller ID when a call arrives and routing it by what others have reported about that number: to an agent, an IVR, or a verification step. It saves agent time on robocalls and slows down impersonation scams. It works best as one layer next to network caller-ID authentication and your own verification, because a clean-looking number proves nothing.

#What problem does inbound screening solve?

Contact centers pay for every minute an agent spends on a call, and unwanted calls take real minutes. US consumers filed over 2.6 million Do Not Call complaints with the FTC in fiscal year 2025 (FTC, 2025). Businesses receive the same traffic: robocalls into published service lines, callers impersonating customers to reset accounts, and diallers probing IVRs.

Screening gives you a decision point before the call reaches a person. The goal isn't to block as much as possible. It is to send each call to the cheapest path that still serves a genuine caller:

• Likely genuine: straight to the queue.
• Doubtful: an IVR prompt, a callback, or extra identity checks before account changes.
• High risk with strong evidence: an automated path. A person reaches an agent only after passing verification.

Your call-center screening setup decides which path each result takes.

#What does a spam reputation answer contain?

The spam reputation check (number.spam) answers from reports about the number, described by class only: telecom regulator actions, government nuisance-call complaint data, community reports, and a signal for numbers recently offered for sale as unassigned. It covers US, Canadian and German numbers and is in limited access (internal customers only) for now.

high needs a score of at least 80 and either a regulator action or two or more independent signal classes. One noisy source can't produce high on its own.

#Why isn't number reputation enough on its own?

Because most bad calls come from numbers nobody has reported yet. We analysed 362,116 complaints from 30 daily FTC Do Not Call files (August to September 2026). There were 297,872 distinct caller numbers, and 92.5% of them appeared in exactly one complaint. The 100 most-reported numbers accounted for only 2.9% of complaints. FCC unwanted-call complaints for January to August 2026 show the same shape: 96.6% of caller IDs appear once. The method and tables are in our analysis of US nuisance-call complaints, built from the FTC and FCC public data.

That pattern fits caller-ID rotation and spoofing: bad actors change numbers faster than reports accumulate. A reputation check catches the persistent offenders and the numbers regulators have acted on, which is valuable. It will miss fresh numbers. So no_reports is the absence of evidence, never a clean bill of health, and your other layers have to carry the rest.

#How does STIR/SHAKEN fit in?

STIR/SHAKEN is caller-ID authentication inside the phone network. The originating provider signs the call to say how well it knows the caller is entitled to the number shown. The FCC adopted rules in 2020 requiring voice providers to implement it in the IP portions of their networks by June 30, 2021 (FCC). Many carriers and SIP trunks pass the result to you as an attestation level or a verification flag.

The two signals answer different questions:

Use both. Weak attestation plus reports is a much stronger signal than either one alone. Full attestation plus no_reports is a reasonable default for the normal queue.

#What does the workflow look like?

The check sits between "the call arrives" and "the call is routed":

1. Your telephony platform receives the call and the caller ID, plus any attestation your carrier passes on.
2. Convert the caller ID to E.164. Most platforms already provide it in that form.
3. Call POST /v1/lookup with checks: ["spam", "carrier"] and a short wait, for example 2 seconds.
4. Combine risk_level, the reasons, line_type and attestation in your routing rules (table below).
5. If the answer is pending, unknown or unsupported_country, route the call normally.
6. Log the level, the reasons and checked_at, not the raw response or the full number.

curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+447700900002"], "checks": ["spam", "carrier"], "wait": 2}'

The test numbers above work for spam reputation in test mode, although live checks cover only US, CA and DE. The first returns high, the second no_reports.

#What do the results look like?

The number.spam part of each result, from real test-mode output:

{"risk_level": "high", "risk_score": 95, "reason_regulator": true, "reason_government": false,
 "reason_community": true, "reason_unassigned": false, "voip_range": false,
 "top_category": "robocall", "first_seen": "2025-11", "last_seen": "2026-08", "sources": 2}

{"risk_level": "no_reports", "risk_score": 0, "reason_regulator": false, "reason_government": false,
 "reason_community": false, "reason_unassigned": false, "voip_range": false, "sources": 0}

The reasons matter as much as the level. A high with reason_regulator: true and top_category: robocall is a strong case for the automated path. A medium driven only by community reports and last seen a year ago deserves a lighter touch. Report texts, reporter details and names are never returned.

#How should you route each result?

A starting table for an inbound service line. Tune it with your own outcome data.

Two rules keep this fair. Never refuse service outright based on a level alone. Give a path to a human. And never treat no_reports as a reason to skip your normal verification for sensitive actions.

#How do you avoid hurting genuine callers?

Reputation data describes numbers, and numbers get spoofed and reassigned. A scam campaign can spoof your customer's real number, so their number collects reports they had nothing to do with. A number reported years ago may now belong to someone new. That's why reports last seen more than 12 months ago count half, and why every level carries its reasons and last_seen.

Practical safeguards:

• Route, don't block. An IVR step costs a genuine caller seconds. A block costs you the customer.
• Show the agent the reason, not a verdict. "Reported for robocalls, last seen August 2026" helps the agent. "SPAM" invites rudeness to a real customer.
• Re-check repeat callers. Scores change as reports arrive and age out, and repeat checks within 24 hours are served free from your account's cache.
• Don't use it for eligibility. Spam levels are not for decisions about credit, jobs, housing or insurance. Our acceptable use policy forbids that.

People who find their number in our data can ask for a review through the opt-out form.

#What does screening cost?

Each conclusive spam answer is billed, including no_reports, because the check was carried out and answered. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). So calls from outside the US, Canada and Germany cost nothing to screen. The carrier lookup is billed only when it returns carrier data. See pricing for current rates.

Call centers see many repeat callers. Answers for the same number within 24 hours come from your account's cache for free, which can keep the average cost per call below the per-check price. Screen only the lines that need it, such as published service numbers and fraud-sensitive queues, and skip internal extensions.

#How does this help outbound teams too?

The same data protects your own caller reputation. Run a bulk job over outbound call lists of people who asked to be contacted, with checks: ["carrier", "spam"] (plus network.carrier_us for US and Canadian lists) and remove numbers recently offered as unassigned or reported for fraud before they reach the dialler. You can also check your own outbound numbers periodically. If they start collecting complaints, you'll see it before your answer rates fall. For list mechanics, see how to clean a phone number list in bulk.

#What are the key takeaways?

• Spam reputation routes inbound calls by evidence: levels with reasons, for US, CA and DE numbers (limited access today).
• In public FTC data, 92.5% of reported caller numbers appear only once, so reputation catches persistent offenders but misses fresh numbers.
• Combine it with STIR/SHAKEN attestation and your own verification. Neither signal is enough alone.
• no_reports is not safe. voip_range alone is not risk. unknown is free and should route normally.
• Route, don't block, and show agents reasons rather than verdicts.