How to Detect Disposable and Temporary Phone Numbers

The hour it goes wrong

You launch a welcome bonus on a Monday. By Monday evening your signup dashboard shows 400 new accounts in an hour, every one with a verified phone number, and nearly all of them claiming the bonus. Support is quiet, which is the worst sign. Real customers ask questions.

Nothing is wrong with your SMS check. It did exactly what it was built for: it proved that someone could read a text sent to that number. The trouble is that "someone" can be anyone on the internet. This guide is for the people who run that signup flow, in trust and safety, fraud or product, and for the developers who wire it up.

What counts as a disposable number

It pays to keep the types apart, because they carry very different risk.

From a fraud point of view the question is not "is this number unusual?" but "can this number recover the account later, and is it tied to one person?" A public receive-SMS number fails both tests.

How the abuse works

The mechanics are almost boring, which is why they scale. Here is a single signup from the fraudster's side.

The usual goals are mass account creation for spam or fake reviews, repeated bonus claims, and sockpuppet networks that need many "verified" accounts. Our article on spotting fake profiles shows what those accounts look like from the outside.

The detection signals, in order

Work from cheapest to most expensive, and stop early when the answer is clear. The first three are about the number. The last two are about everything around it.

1. Normalise and validate

   Convert the input to E.164 (for example +15555550177) and reject numbers that are not valid for their country. Impossible lengths and bad prefixes are the cheapest signal you have. The reverse phone lookup guide explains the format and the validation.

2. Check the line type

   Mobile, fixed line, VoIP, toll-free, premium. VoIP alone should raise attention, not trigger a block. A toll-free or premium number on a personal signup is more unusual and deserves a closer look.

3. Compare against receive-SMS sites

   These sites list their numbers by country and rotate them over time. A number on one of them is shared by definition. The check has to be current, because a number listed last year may have been retired and given to an ordinary subscriber since.

4. Look for signs of normal use

   Real personal numbers usually have some footprint: a WhatsApp, Telegram or Signal registration, a mention on a business listing. Absence proves nothing. Presence is reassuring. A disposable number tends to have no messengers, or web mentions only on receive-SMS pages.

5. Look at the pattern, not just the number

   Many signups in a short window from one number range, numbers that differ only in the last digits, one number reused across several accounts. Each number may pass every check above and the campaign is still obvious in aggregate.

Turning signals into a decision

A short rule set beats a single yes/no check. This is the shape we would start with for a consumer signup, as a decision tree:

And the same policy as a table, with fictional numbers:

In your own backend the logic can be as small as this (pseudocode; the field names are illustrative, not the TraceFind API schema):

// result comes from your phone lookup
if (result.disposable) return 'reject_number';
if (burstFromSameRange(result.e164)) return 'manual_review';
if (result.lineType === 'voip' && result.messengers.length === 0) return 'limit_2fa';
return 'accept';

For flows with real volume, the TraceFind developer API lets you run searches from your own backend, and bulk searches are useful for reviewing the users you already have once you notice a problem.

When a number is flagged

A flagged number is a reason to change the flow, not necessarily to ban the person. Reasonable responses, from mildest to strongest:

1. Ask for a different number and say why: "This number is publicly listed and cannot be used for verification."
2. Offer another factor such as an authenticator app or a verified email, so privacy-minded users have a way in.
3. Limit sensitive features (payouts, messaging other users, bonus credits) until the account has stronger verification.
4. Send to manual review when the number is part of a pattern, and record which signals triggered it.
5. Block only for clear abuse, such as a receive-SMS number reused across many accounts that already break your terms.

Pair phone checks with email checks. A disposable email provider together with a disposable number is a far stronger signal than either alone; the email verification guide covers the address side.

Privacy and fairness

Remember that some people use VoIP or prepaid numbers for good reasons: they cannot get a contract, they travel, or they are protecting themselves from harassment. Design the rules so they can still sign up through another route.

Frequently asked questions