# VoIP number detection for sign-ups: what works and what to watch out for

> Why VoIP numbers matter at sign-up, fixed vs non-fixed VoIP, which signals detect them, and how to add friction without turning away real customers.

Canonical: https://mobilevalidate.com/blog/voip-number-detection-for-signups · Last updated: 2026-09-25

![Cover: VoIP number detection for sign-ups: what works and what to watch out for](https://mobilevalidate.com/og/blog/voip-number-detection-for-signups.png)


By MobileValidate team (https://mobilevalidate.com/about) · Published: 2026-09-25 · Category: Fraud prevention · Tags: VoIP, Line type, Sign up fraud, Carrier lookup, Fraud prevention

VoIP number detection tells you, at sign-up, whether a phone number is served by an internet-telephony provider rather than a mobile network. It matters because app-based VoIP numbers are cheap to create in bulk. But many genuine customers use VoIP too, so the right response is usually extra verification, not a block.

## Why does a VoIP number matter at sign-up?

Phone verification works as an anti-abuse control because a phone number is supposed to be scarce. A mobile number normally comes with a SIM, a contract or prepaid top-up and, in many countries, an identity check. That cost is what stops one person from opening a thousand accounts.

Some VoIP numbers remove that cost. An app-based number can often be created in minutes, used to receive one code and released again. That makes it attractive for:

- **Promotion and referral abuse**: one person, many "new customer" bonuses.
- **Fake account farms**: accounts created for spam, fake reviews or resale.
- **Evading bans**: a blocked user returns with a fresh number.
- **Account takeover**: an attacker attaches a number they can drop afterwards.

The same property makes VoIP useful to honest people: a second number for a small business, a number that works while travelling, a home phone line delivered over broadband. That's why line type should inform your decision, not make it on its own. The [VoIP glossary entry](/glossary/voip-number) covers the basics.

## What is the difference between fixed and non-fixed VoIP?

Regulators and the industry separate VoIP services by how they're tied to a place and to the public phone network.

In US rules, an **interconnected VoIP service** is one that enables real-time two-way voice, requires a broadband connection and IP-compatible equipment at the user's location, and lets users receive calls from and make calls to the ordinary phone network ([47 CFR § 9.3, 2026](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-9/subpart-A/section-9.3)). Within that group, the industry commonly distinguishes two kinds:

| | Fixed VoIP | Non-fixed VoIP |
|---|---|---|
| Tied to | One service address | An account; works anywhere online |
| Typical examples | Home phone from a cable or fibre provider; office desk phones | App-based numbers; softphones; cloud phone systems |
| How it's obtained | Usually with a broadband contract | Often online in minutes |
| Behaves like | A landline | A mobile app |
| Sign-up risk | Low, similar to a landline | Higher, because numbers can be created and released quickly |

Most lookup data doesn't separate the two reliably. A result of `voip` tells you the number is served by an internet-telephony provider. The carrier name, together with your own context, often tells you which kind it is: a large cable operator suggests fixed VoIP, while a provider known for app-based numbers suggests non-fixed.

## Which signals can detect a VoIP number?

There is no single perfect signal. These are the ones that exist, from weakest to strongest:

| Signal | How it works | Strength | Main limitation |
|---|---|---|---|
| Numbering plan | Some countries reserve ranges for VoIP or nomadic services | Weak | Most VoIP numbers use ordinary geographic ranges |
| Offline library type | Libraries like [libphonenumber](https://github.com/google/libphonenumber) return a type from range metadata | Weak | Describes the range, not today's service; US/CA ranges show `FIXED_LINE_OR_MOBILE` |
| Carrier lookup `line_type` | Current data about the specific number | Strong | Coverage varies by country; `unknown` when no data |
| Current carrier name | Which provider serves the number now | Strong in context | Brand names and resellers can hide the underlying provider |
| Porting history | Number moved from mobile/landline to a VoIP provider | Medium | Needs current data; a port alone is normal |
| Spam `voip_range` hint | Range belongs to a VoIP carrier | Context only | US, CA, DE; adds no risk points by design |
| Messenger presence | Number has an account on a messaging app | Indirect | VoIP numbers can also register on messengers |

The more reliable method is a lookup against current data for the individual number. MobileValidate's [carrier lookup](/services/carrier-lookup) returns `line_type` (with `voip` as one value) and the current `carrier` for numbers worldwide. For US and Canadian numbers, where porting between landline, wireless and VoIP services is common, the [US and Canada carrier lookup](/services/us-carrier-lookup) returns current-carrier data in bulk jobs.

## Why can't you rely on the number range?

Because in many countries the range says little about today's service.

In the US and Canada, mobile and fixed numbers share the same area codes. That's why offline libraries return `FIXED_LINE_OR_MOBILE` for most North American numbers. We checked this with libphonenumber-js 1.13.13: `+1 415 555 2671` parses as a valid number of type `FIXED_LINE_OR_MOBILE`, with no way to tell VoIP apart. On top of that, a number can be ported from a mobile carrier to a VoIP provider and back while keeping its digits. Our post on [why carrier lookups can be wrong after porting](/blog/mobile-number-portability-why-carrier-lookups-can-be-wrong) goes into this.

Elsewhere, ranges help more but still aren't enough. A country may have a dedicated range for nomadic services while also allowing VoIP providers to issue ordinary geographic numbers. Use the range as a free first filter, for example to reject premium-rate numbers, and a lookup for the line type.

## How do you check line type in a sign-up flow?

Add the carrier check to the request you already make before sending a code. A test-mode example:

```bash
curl https://api.mobilevalidate.com/v1/lookup \
  -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"numbers": ["+447700900001"], "checks": ["carrier", "whatsapp"], "wait": 5}'
```

Response (excerpt, test mode):

```json
"checks": {
  "network.carrier": {"status": "completed", "registered": true,
    "attributes": {"line_type": "mobile", "carrier": "Test Carrier", "country": "GB"},
    "confidence": "high", "cached": false, "billed": false, "reason": null},
  "whatsapp.registered": {"status": "completed", "registered": true,
    "confidence": "high", "cached": false, "billed": false, "reason": null}
}
```

For a VoIP number, `line_type` is `"voip"` and `carrier` names the provider. When we hold no data, the result is `unknown` with `reason: "NO_DATA"` and isn't charged. You're not charged for inconclusive results (unknown, unsupported country, timeout, invalid, duplicate). Test keys return fixed test data; the [test mode page](/docs/test-mode) lists every test number.

## What should you do when a sign-up number is VoIP?

Match the reaction to what's at stake in the flow, and combine VoIP with other signals before adding friction:

| Situation | VoIP alone | VoIP plus another risk signal |
|---|---|---|
| Free sign-up, no rewards | Allow | Add a CAPTCHA or e-mail confirmation |
| Sign-up with a bonus, trial or referral credit | Allow, hold the reward until the account has history | Require another verification method |
| B2B account, company number | Allow; cloud telephony is normal for businesses | Check the company domain and e-mail |
| New 2FA number on an existing account | Allow and notify the old contact details | Confirm through the old number or e-mail |
| Marketplace seller or payout account | Ask for another verification method | Manual review |

"Another risk signal" can be a new device, a disposable e-mail domain, a mismatch between the number's country and the IP country, many sign-ups from one provider in a short time, or a missing messenger account. NIST's guidance points the same way: it asks verifiers to consider risk indicators such as device swap, SIM change and number porting before relying on the phone network for codes ([NIST, 2025](https://csrc.nist.gov/pubs/sp/800/63/b/4/final)).

A useful habit is to look at **clusters** rather than single numbers. Ten sign-ups from ten mobile carriers are normal. Ten sign-ups in an hour from the same small VoIP provider, with similar e-mail patterns, are not.

## How many false positives should you expect?

More than most teams assume, which is why blanket blocks backfire.

VoIP isn't a niche. In the FCC's public unwanted-call complaint data, the `method` field records how the *complaining consumer* gets their phone service. From January to August 2026, 14,377 of 90,759 complaints came from consumers on "Internet (VOIP)" service, about 16%, according to our own count of the dataset ([FCC, 2026](https://opendata.fcc.gov/Consumer/Consumer-Complaints-Data-Unwanted-Calls/vakf-fz8e)). Those are ordinary people with VoIP phone lines, not callers. The number says nothing about VoIP sign-ups in your product, but it shows that real consumers use VoIP. Our analysis of [US nuisance-call complaints](/blog/us-nuisance-call-complaints-what-the-data-shows) describes the dataset and its limits.

Common false positives:

- **Cable and fibre home phones.** They are fixed VoIP and behave like landlines. They usually can't receive SMS, which is a delivery problem, not fraud.
- **Business numbers.** Companies increasingly run on cloud phone systems. Blocking VoIP in a B2B sign-up blocks your customers.
- **Travellers and expats** who keep a home-country number through an app.
- **Ported numbers** that data sources haven't caught up with yet.

Measure it. Log every VoIP decision and check how many stepped-up users go on to complete the extra verification. If most do, the rule is costing you conversions without catching much.

## How does VoIP relate to spam and robocalls?

Robocall and spam operations often use VoIP numbers, because they can rotate through many numbers cheaply and spoof caller IDs. That's a calling problem more than a sign-up one, but the data overlaps.

MobileValidate's [spam reputation](/services/spam-reputation) check (limited access; US, CA and DE numbers) returns `voip_range: true` when a number's range belongs to a VoIP carrier. It is deliberately a **hint only**: it adds no points to `risk_score`. A number is rated `high`, `medium` or `low` because of reports against it, such as regulator actions, government complaint data or community reports, never because of its line type. If a sign-up number has both `line_type: voip` and a `high` risk level with a `fraud_hacking` or `impersonation` category, that combination deserves a manual review.

## What are the key takeaways?

- App-based (non-fixed) VoIP numbers are cheap to create and release, so they appear often in fake sign-ups and promotion abuse.
- Fixed VoIP, such as broadband home phones and office systems, behaves like a landline and carries little sign-up risk.
- The number range is a weak signal. A lookup of the specific number's `line_type` and current carrier is more reliable, and `unknown` answers are free.
- Treat VoIP as a reason for proportionate friction, such as holding rewards, another verification step or a lower send limit, not as an automatic block.
- Look for clusters and combinations, and measure how many stepped-up users turn out to be genuine.

To put this into a full pre-send pipeline, read [OTP fraud prevention: checks to run before sending a code](/blog/otp-fraud-prevention-checks-before-sending-a-code). The [line type glossary entry](/glossary/line-type) lists every value the carrier lookup can return.

## Sources

1. [47 CFR § 9.3 — Definitions (interconnected VoIP service)](https://www.ecfr.gov/current/title-47/chapter-I/subchapter-A/part-9/subpart-A/section-9.3) — eCFR / Federal Communications Commission, 2026
2. [Consumer Complaints Data — Unwanted Calls](https://opendata.fcc.gov/Consumer/Consumer-Complaints-Data-Unwanted-Calls/vakf-fz8e) — Federal Communications Commission, 2026
3. [libphonenumber](https://github.com/google/libphonenumber) — Google, 2026
4. [NIST SP 800-63B-4: Digital Identity Guidelines — Authentication and Authenticator Management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final) — NIST, 2025

## Frequently asked questions

### Can I tell a VoIP number from its digits alone?

Rarely. A few countries have dedicated VoIP or nomadic ranges, but many VoIP numbers sit in ordinary geographic ranges, and in the US and Canada numbers can be ported between landline, mobile and VoIP services. A lookup against current data for the specific number is needed.

### Should I block all VoIP numbers at sign-up?

Usually not. Many real people and businesses use VoIP numbers, including home phone services from cable operators and cloud phone systems. Add a verification step or lower limits for VoIP numbers where the risk justifies it.

### What is the difference between fixed and non-fixed VoIP?

Fixed VoIP is tied to one location, such as a home phone service delivered over a broadband line. Non-fixed VoIP can be used from anywhere with an internet connection, typically through an app. Non-fixed numbers are the ones that are easy to create in bulk.

### Does the spam reputation check treat VoIP numbers as risky?

No. It reports voip_range as a hint only and adds no points to the score. A VoIP range is not a risk by itself.