VoIP number detection for sign-ups: what works and what to watch out for

VoIP number detection tells you, at sign-up, whether a phone number is served by an internet-telephony provider rather than a mobile network. It matters because app-based VoIP numbers are cheap to create in bulk. But many genuine customers use VoIP too, so the right response is usually extra verification, not a block.

#Why does a VoIP number matter at sign-up?

Phone verification works as an anti-abuse control because a phone number is supposed to be scarce. A mobile number normally comes with a SIM, a contract or prepaid top-up and, in many countries, an identity check. That cost is what stops one person from opening a thousand accounts.

Some VoIP numbers remove that cost. An app-based number can often be created in minutes, used to receive one code and released again. That makes it attractive for:

• Promotion and referral abuse: one person, many "new customer" bonuses.
• Fake account farms: accounts created for spam, fake reviews or resale.
• Evading bans: a blocked user returns with a fresh number.
• Account takeover: an attacker attaches a number they can drop afterwards.

The same property makes VoIP useful to honest people: a second number for a small business, a number that works while travelling, a home phone line delivered over broadband. That's why line type should inform your decision, not make it on its own. The VoIP glossary entry covers the basics.

#What is the difference between fixed and non-fixed VoIP?

Regulators and the industry separate VoIP services by how they're tied to a place and to the public phone network.

In US rules, an interconnected VoIP service is one that enables real-time two-way voice, requires a broadband connection and IP-compatible equipment at the user's location, and lets users receive calls from and make calls to the ordinary phone network (47 CFR § 9.3, 2026). Within that group, the industry commonly distinguishes two kinds:

Most lookup data doesn't separate the two reliably. A result of voip tells you the number is served by an internet-telephony provider. The carrier name, together with your own context, often tells you which kind it is: a large cable operator suggests fixed VoIP, while a provider known for app-based numbers suggests non-fixed.

#Which signals can detect a VoIP number?

There is no single perfect signal. These are the ones that exist, from weakest to strongest:

The more reliable method is a lookup against current data for the individual number. MobileValidate's carrier lookup returns line_type (with voip as one value) and the current carrier for numbers worldwide. For US and Canadian numbers, where porting between landline, wireless and VoIP services is common, the US and Canada carrier lookup returns current-carrier data in bulk jobs.

#Why can't you rely on the number range?

Because in many countries the range says little about today's service.

In the US and Canada, mobile and fixed numbers share the same area codes. That's why offline libraries return FIXED_LINE_OR_MOBILE for most North American numbers. We checked this with libphonenumber-js 1.13.13: +1 415 555 2671 parses as a valid number of type FIXED_LINE_OR_MOBILE, with no way to tell VoIP apart. On top of that, a number can be ported from a mobile carrier to a VoIP provider and back while keeping its digits. Our post on why carrier lookups can be wrong after porting goes into this.

Elsewhere, ranges help more but still aren't enough. A country may have a dedicated range for nomadic services while also allowing VoIP providers to issue ordinary geographic numbers. Use the range as a free first filter, for example to reject premium-rate numbers, and a lookup for the line type.

#How do you check line type in a sign-up flow?

Add the carrier check to the request you already make before sending a code. A test-mode example:

curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001"], "checks": ["carrier", "whatsapp"], "wait": 5}'

Response (excerpt, test mode):

"checks": {
  "network.carrier": {"status": "completed", "registered": true,
    "attributes": {"line_type": "mobile", "carrier": "Test Carrier", "country": "GB"},
    "confidence": "high", "cached": false, "billed": false, "reason": null},
  "whatsapp.registered": {"status": "completed", "registered": true,
    "confidence": "high", "cached": false, "billed": false, "reason": null}
}

For a VoIP number, line_type is "voip" and carrier names the provider. When we hold no data, the result is unknown with reason: "NO_DATA" and isn't charged. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). Test keys return fixed test data; the test mode page lists every test number.

#What should you do when a sign-up number is VoIP?

Match the reaction to what's at stake in the flow, and combine VoIP with other signals before adding friction:

"Another risk signal" can be a new device, a disposable e-mail domain, a mismatch between the number's country and the IP country, many sign-ups from one provider in a short time, or a missing messenger account. NIST's guidance points the same way: it asks verifiers to consider risk indicators such as device swap, SIM change and number porting before relying on the phone network for codes (NIST, 2025).

A useful habit is to look at clusters rather than single numbers. Ten sign-ups from ten mobile carriers are normal. Ten sign-ups in an hour from the same small VoIP provider, with similar e-mail patterns, are not.

#How many false positives should you expect?

More than most teams assume, which is why blanket blocks backfire.

VoIP isn't a niche. In the FCC's public unwanted-call complaint data, the method field records how the complaining consumer gets their phone service. From January to August 2026, 14,377 of 90,759 complaints came from consumers on "Internet (VOIP)" service, about 16%, according to our own count of the dataset (FCC, 2026). Those are ordinary people with VoIP phone lines, not callers. The number says nothing about VoIP sign-ups in your product, but it shows that real consumers use VoIP. Our analysis of US nuisance-call complaints describes the dataset and its limits.

Common false positives:

• Cable and fibre home phones. They are fixed VoIP and behave like landlines. They usually can't receive SMS, which is a delivery problem, not fraud.
• Business numbers. Companies increasingly run on cloud phone systems. Blocking VoIP in a B2B sign-up blocks your customers.
• Travellers and expats who keep a home-country number through an app.
• Ported numbers that data sources haven't caught up with yet.

Measure it. Log every VoIP decision and check how many stepped-up users go on to complete the extra verification. If most do, the rule is costing you conversions without catching much.

#How does VoIP relate to spam and robocalls?

Robocall and spam operations often use VoIP numbers, because they can rotate through many numbers cheaply and spoof caller IDs. That's a calling problem more than a sign-up one, but the data overlaps.

MobileValidate's spam reputation check (limited access; US, CA and DE numbers) returns voip_range: true when a number's range belongs to a VoIP carrier. It is deliberately a hint only: it adds no points to risk_score. A number is rated high, medium or low because of reports against it, such as regulator actions, government complaint data or community reports, never because of its line type. If a sign-up number has both line_type: voip and a high risk level with a fraud_hacking or impersonation category, that combination deserves a manual review.

#What are the key takeaways?

• App-based (non-fixed) VoIP numbers are cheap to create and release, so they appear often in fake sign-ups and promotion abuse.
• Fixed VoIP, such as broadband home phones and office systems, behaves like a landline and carries little sign-up risk.
• The number range is a weak signal. A lookup of the specific number's line_type and current carrier is more reliable, and unknown answers are free.
• Treat VoIP as a reason for proportionate friction, such as holding rewards, another verification step or a lower send limit, not as an automatic block.
• Look for clusters and combinations, and measure how many stepped-up users turn out to be genuine.

To put this into a full pre-send pipeline, read OTP fraud prevention: checks to run before sending a code. The line type glossary entry lists every value the carrier lookup can return.