# Screening inbound calls with spam reputation

> A call-center workflow for routing inbound calls by spam reputation: levels, reasons, STIR/SHAKEN, limits of the data, and why no_reports isn't safe.

Canonical: https://mobilevalidate.com/blog/screening-inbound-calls-with-spam-reputation · Last updated: 2026-09-25

![Cover: Screening inbound calls with spam reputation](https://mobilevalidate.com/og/blog/screening-inbound-calls-with-spam-reputation.png)


By MobileValidate team (https://mobilevalidate.com/about) · Published: 2026-09-25 · Category: Fraud prevention · Tags: Call center, Spam reputation, Robocalls, Call screening, Fraud prevention

Screening inbound calls with spam reputation means looking up the caller ID when a call arrives and routing it by what others have reported about that number: to an agent, an IVR, or a verification step. It saves agent time on robocalls and slows down impersonation scams. It works best as one layer next to network caller-ID authentication and your own verification, because a clean-looking number proves nothing.

## What problem does inbound screening solve?

Contact centers pay for every minute an agent spends on a call, and unwanted calls take real minutes. US consumers filed over 2.6 million Do Not Call complaints with the FTC in fiscal year 2025 ([FTC, 2025](https://www.ftc.gov/reports/national-do-not-call-registry-data-book-fiscal-year-2025)). Businesses receive the same traffic: robocalls into published service lines, callers impersonating customers to reset accounts, and diallers probing IVRs.

Screening gives you a decision point before the call reaches a person. The goal isn't to block as much as possible. It is to send each call to the cheapest path that still serves a genuine caller:

- **Likely genuine:** straight to the queue.
- **Doubtful:** an IVR prompt, a callback, or extra identity checks before account changes.
- **High risk with strong evidence:** an automated path. A person reaches an agent only after passing verification.

Your [call-center screening](/use-cases/call-center-screening) setup decides which path each result takes.

## What does a spam reputation answer contain?

The [spam reputation](/services/spam-reputation) check (`number.spam`) answers from reports about the number, described by class only: telecom regulator actions, government nuisance-call complaint data, community reports, and a signal for numbers recently offered for sale as unassigned. It covers US, Canadian and German numbers and is in **limited access** (internal customers only) for now.

| Field | Meaning |
|---|---|
| `risk_level` | `high`, `medium`, `low` or `no_reports` |
| `risk_score` | 0–100; reports last seen more than 12 months ago count half |
| `reason_regulator` / `reason_government` / `reason_community` / `reason_unassigned` | Which signal classes are behind the answer |
| `voip_range` | Hint only: the range belongs to a VoIP carrier. Adds no points |
| `top_category` | Most frequent report category, e.g. `robocall`, `impersonation`, `debt_relief` |
| `first_seen` / `last_seen` | Months the number first and last appeared in our data |
| `sources` | Number of independent signal classes |

`high` needs a score of at least 80 **and** either a regulator action or two or more independent signal classes. One noisy source can't produce `high` on its own.

## Why isn't number reputation enough on its own?

Because most bad calls come from numbers nobody has reported yet. We analysed 362,116 complaints from 30 daily FTC Do Not Call files (August to September 2026). There were 297,872 distinct caller numbers, and **92.5% of them appeared in exactly one complaint**. The 100 most-reported numbers accounted for only 2.9% of complaints. FCC unwanted-call complaints for January to August 2026 show the same shape: 96.6% of caller IDs appear once. The method and tables are in [our analysis of US nuisance-call complaints](/blog/us-nuisance-call-complaints-what-the-data-shows), built from the [FTC](https://www.ftc.gov/policy-notices/open-government/data-sets/do-not-call-data) and [FCC](https://opendata.fcc.gov/Consumer/Consumer-Complaints-Data-Unwanted-Calls/vakf-fz8e) public data.

That pattern fits caller-ID rotation and spoofing: bad actors change numbers faster than reports accumulate. A reputation check catches the persistent offenders and the numbers regulators have acted on, which is valuable. It will miss fresh numbers. So `no_reports` is the absence of evidence, never a clean bill of health, and your other layers have to carry the rest.

## How does STIR/SHAKEN fit in?

STIR/SHAKEN is caller-ID authentication inside the phone network. The originating provider signs the call to say how well it knows the caller is entitled to the number shown. The FCC adopted rules in 2020 requiring voice providers to implement it in the IP portions of their networks by June 30, 2021 ([FCC](https://www.fcc.gov/call-authentication)). Many carriers and SIP trunks pass the result to you as an attestation level or a verification flag.

The two signals answer different questions:

| Signal | Question it answers | Blind spot |
|---|---|---|
| STIR/SHAKEN attestation | Was this caller ID asserted by a provider that knows the caller? | Doesn't say whether the caller is welcome. A fully attested number can still run a robocall campaign. Non-IP legs and some international calls arrive unsigned |
| Spam reputation | Has this number collected complaints or regulator action? | New and rotated numbers have no history. Spoofed numbers can collect reports that belong to someone else |

Use both. Weak attestation plus reports is a much stronger signal than either one alone. Full attestation plus `no_reports` is a reasonable default for the normal queue.

## What does the workflow look like?

The check sits between "the call arrives" and "the call is routed":

1. Your telephony platform receives the call and the caller ID, plus any attestation your carrier passes on.
2. Convert the caller ID to E.164. Most platforms already provide it in that form.
3. Call `POST /v1/lookup` with `checks: ["spam", "carrier"]` and a short `wait`, for example 2 seconds.
4. Combine `risk_level`, the reasons, `line_type` and attestation in your routing rules (table below).
5. If the answer is `pending`, `unknown` or `unsupported_country`, route the call normally.
6. Log the level, the reasons and `checked_at`, not the raw response or the full number.

```bash
curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001", "+447700900002"], "checks": ["spam", "carrier"], "wait": 2}'
```

The test numbers above work for spam reputation in test mode, although live checks cover only US, CA and DE. The first returns `high`, the second `no_reports`.

## What do the results look like?

The `number.spam` part of each result, from real test-mode output:

```json
{"risk_level": "high", "risk_score": 95, "reason_regulator": true, "reason_government": false,
 "reason_community": true, "reason_unassigned": false, "voip_range": false,
 "top_category": "robocall", "first_seen": "2025-11", "last_seen": "2026-08", "sources": 2}
```

```json
{"risk_level": "no_reports", "risk_score": 0, "reason_regulator": false, "reason_government": false,
 "reason_community": false, "reason_unassigned": false, "voip_range": false, "sources": 0}
```

The reasons matter as much as the level. A `high` with `reason_regulator: true` and `top_category: robocall` is a strong case for the automated path. A `medium` driven only by community reports and last seen a year ago deserves a lighter touch. Report texts, reporter details and names are never returned.

## How should you route each result?

A starting table for an inbound service line. Tune it with your own outcome data.

| Result | Suggested routing |
|---|---|
| `high` with `reason_regulator` | IVR or automated path. Agent only after verification |
| `high` without regulator action | IVR with a simple human check (press a key, state a reference) |
| `medium` | Normal queue, but require full verification before account changes |
| `low` | Normal queue. Watch for patterns |
| `no_reports` | Normal queue. **Not** a guarantee of anything |
| `reason_unassigned: true` | Treat the caller ID as possibly spoofed. Verify before discussing an account |
| `top_category: impersonation` | Flag to the agent. Don't reset credentials on this call |
| `voip_range: true` alone | No action. Many businesses and people call from VoIP |
| `unknown`, `pending`, `unsupported_country` | Normal routing. Not charged |

Two rules keep this fair. Never refuse service outright based on a level alone. Give a path to a human. And never treat `no_reports` as a reason to skip your normal verification for sensitive actions.

## How do you avoid hurting genuine callers?

Reputation data describes numbers, and numbers get spoofed and reassigned. A scam campaign can spoof your customer's real number, so their number collects reports they had nothing to do with. A number reported years ago may now belong to someone new. That's why reports last seen more than 12 months ago count half, and why every level carries its reasons and `last_seen`.

Practical safeguards:

- **Route, don't block.** An IVR step costs a genuine caller seconds. A block costs you the customer.
- **Show the agent the reason, not a verdict.** "Reported for robocalls, last seen August 2026" helps the agent. "SPAM" invites rudeness to a real customer.
- **Re-check repeat callers.** Scores change as reports arrive and age out, and repeat checks within 24 hours are served free from your account's cache.
- **Don't use it for eligibility.** Spam levels are not for decisions about credit, jobs, housing or insurance. Our [acceptable use policy](/legal/acceptable-use) forbids that.

People who find their number in our data can ask for a review through the [opt-out form](/opt-out).

## What does screening cost?

Each conclusive spam answer is billed, **including `no_reports`**, because the check was carried out and answered. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). So calls from outside the US, Canada and Germany cost nothing to screen. The carrier lookup is billed only when it returns carrier data. See [pricing](/pricing) for current rates.

Call centers see many repeat callers. Answers for the same number within 24 hours come from your account's cache for free, which can keep the average cost per call below the per-check price. Screen only the lines that need it, such as published service numbers and fraud-sensitive queues, and skip internal extensions.

## How does this help outbound teams too?

The same data protects your own caller reputation. Run a bulk job over outbound call lists of people who asked to be contacted, with `checks: ["carrier", "spam"]` (plus `network.carrier_us` for US and Canadian lists) and remove numbers recently offered as unassigned or reported for fraud before they reach the dialler. You can also check your own outbound numbers periodically. If they start collecting complaints, you'll see it before your answer rates fall. For list mechanics, see [how to clean a phone number list in bulk](/blog/how-to-clean-a-phone-number-list-in-bulk).

## What are the key takeaways?

- Spam reputation routes inbound calls by evidence: levels with reasons, for US, CA and DE numbers (limited access today).
- In public FTC data, 92.5% of reported caller numbers appear only once, so reputation catches persistent offenders but misses fresh numbers.
- Combine it with STIR/SHAKEN attestation and your own verification. Neither signal is enough alone.
- `no_reports` is not safe. `voip_range` alone is not risk. `unknown` is free and should route normally.
- Route, don't block, and show agents reasons rather than verdicts.

## Sources

1. [Combating Spoofed Robocalls with Caller ID Authentication](https://www.fcc.gov/call-authentication) — Federal Communications Commission, 2021
2. [National Do Not Call Registry Data Book for Fiscal Year 2025](https://www.ftc.gov/reports/national-do-not-call-registry-data-book-fiscal-year-2025) — Federal Trade Commission, 2025
3. [Do Not Call (DNC) Reported Calls Data](https://www.ftc.gov/policy-notices/open-government/data-sets/do-not-call-data) — Federal Trade Commission, 2026
4. [Consumer Complaints Data - Unwanted Calls](https://opendata.fcc.gov/Consumer/Consumer-Complaints-Data-Unwanted-Calls/vakf-fz8e) — Federal Communications Commission, 2026

## Frequently asked questions

### Can I block every call with a high spam level?

You can, but routing is usually better than blocking. Send high-risk calls to an IVR or a verification step. Caller IDs can be spoofed, so a real customer may occasionally arrive from a number with reports.

### Does no_reports mean the caller is safe?

No. It means we hold no reports for the number. New, rarely used and spoofed numbers often have no history. Handle the call normally and rely on your usual verification.

### Which numbers does the spam reputation check cover?

Numbers from the United States, Canada and Germany. Other numbers return unsupported_country and are not charged. The service is in limited access (internal customers only) for now.

### Is the check fast enough to run while the phone is ringing?

Spam answers come from our own daily-refreshed reference data, not a live call to another service, so real-time answers are fast. Set a short wait and route the call normally if the answer isn't back in time.