HLR lookup

An HLR lookup is a query to a mobile number's home network that asks whether the number is assigned to a subscriber, whether that subscriber can be reached right now, and which network currently serves the number. HLR stands for Home Location Register, the database in GSM and 3G networks that holds the subscription record of every customer.

#How does an HLR lookup work?

Every mobile operator keeps a central register of its subscribers. In GSM and UMTS (2G/3G) networks this is the HLR. In 4G/LTE its role is taken by the Home Subscriber Server (HSS), and in 5G by the Unified Data Management function (UDM). All three are specified by 3GPP. The register knows whether a number is in service, whether the SIM is currently attached to a network, and which switch is serving it.

When an SMS is sent between networks, the sending side first asks the recipient's home register where to deliver it. This uses the MAP protocol over the SS7 signalling network. An HLR lookup service makes the same kind of routing query without sending a message, and turns the reply into a simple status. The subscriber's phone isn't contacted and nothing appears on the handset.

#What can an HLR lookup tell you?

A well-formed answer covers four things:

• Status: reachable (known and attached), unreachable (known but switched off or out of coverage), or invalid (not assigned).
• Porting: whether the number now belongs to a different network than the one its range was allocated to. See mobile number portability.
• Roaming: whether the subscriber is currently on a foreign network.
• Current network: its name and MCC/MNC code.

That makes it the most direct test of number reachability for mobile numbers.

#What can't it tell you?

An HLR lookup doesn't tell you who owns a number, whether the owner reads SMS, or whether they use apps like WhatsApp. That needs a channel check such as the WhatsApp check.

It doesn't work for landlines, and most VoIP numbers have no HLR-style record to query. Answers also depend on the home network. Some operators block or rate-limit external queries, or return generic replies to protect their subscribers. A good service reports those cases as unknown instead of guessing.

#Which HLR data is sensitive?

Raw HLR replies can contain identifiers that should never leave a telecom environment: the IMSI (the SIM's permanent subscriber identity), the address of the serving switch (MSC/VLR), and in some cases location-related codes. With those, someone could track a person or attack their account. MobileValidate never returns or stores them. Roaming is reported only as true or false, with no location.

#How does MobileValidate offer HLR lookups?

MobileValidate's HLR lookup is coming soon. It will return status, ported, roaming, network, mcc_mnc and country. Conclusive answers (reachable, unreachable, invalid) will be billed, and unknown answers will be free. Until it launches, the carrier lookup gives line type and current carrier from reference data.