Detecting and verifying fake numbers
Verifying a number happens in two layers. First you check whether the number exists and is active on a network — that is what an HLR lookup does, in milliseconds and without the owner noticing a thing. Then you check whether the person actually holds that handset — which is only possible by sending a code to it and having them enter it. The first layer filters out typos and invented ranges; the second stops disposable numbers and fraudsters.
Below you will find which kinds of "fake" numbers actually come in, what an HLR lookup does and does not prove, and how to combine both layers without making your sign-up form unusable.
The kinds of fake numbers you will meet
"Fake" is a collective term for five very different cases. Each calls for a different approach, and only the first two come out with an ordinary check.
| Kind | What is going on | How you establish it |
|---|---|---|
| Non-existent number | An invented sequence, or a number from a range that was never issued. | An HLR lookup reports immediately that the number does not exist. |
| Typo | One digit too many or too few, or the wrong country code. Usually no ill intent. | Format validation (E.164) catches most of them; HLR confirms the rest. |
| Inactive or disconnected | The number existed, but the SIM is no longer in use or has been ported away. | HLR shows the current status and the operator the number belongs to now. |
| Disposable or shared number | A public number from a free receiving site, shared by thousands of people. | It does exist and is active — HLR sees nothing suspicious. Only a sent code and behavioural signals give it away. |
| VoIP or virtual number | A valid number without a SIM card. Often entirely legitimate — businesses use them widely. | The number type can sometimes be inferred from the range, but do not treat this as fraud by default. |
What an HLR lookup does and does not prove
An HLR lookup queries the register of the operator the number belongs to. That yields hard, current facts — but it is not an identity check, and that confusion costs companies money.
What it does tell you
What it does not tell you
That is why the order matters: use HLR to filter out unusable numbers before you send, and use a verification code to prove that someone really holds the handset. The two do not replace one another.
How to handle it in your sign-up form
Enforce the format
Ask for the number in international format and validate it right there in the form. This is free and already removes most typos.
HLR before sending
Use an HLR lookup to check that the number exists and is active. That way you waste no credits on numbers that will never receive anything.
Have a code confirmed
Send a one-time code and have it entered. Only when that succeeds do you know there is someone behind the number who holds the handset.
Disposable numbers at sign-up
The hardest case is the disposable number: a public number from a free receiving site. It exists, it is active, it receives your code just fine — and still it is worthless to you, because the inbox is public and someone else will use that number tomorrow to take over the same account.
Technology alone does not solve this. What does help: not reusing the same codes indefinitely, applying a limit per number, and offering a second factor alongside SMS for sensitive accounts. If you want to know exactly how those public numbers work, read our page on receiving SMS for free.
