How do I detect if a phone number is VoIP?

Send the phone number to a number-type lookup API like Telebase and check the numberType field in the response. If it returns nonFixedVoip, the number is a virtual number not tied to a physical address. If it returns fixedVoip, it is a VoIP number assigned to a fixed location. One API call returns the number type alongside carrier, country and active status.

What is the difference between fixed VoIP and non-fixed VoIP?

Fixed VoIP numbers are assigned to a physical address, like an office phone line or home broadband phone. Non-fixed VoIP numbers are virtual, not tied to any location or device, and can be created instantly through services like Google Voice or TextNow. Non-fixed VoIP is the higher fraud risk because the numbers are cheap, disposable and anonymous.

Should I block all VoIP numbers at sign-up?

Non-fixed VoIP numbers should be blocked or routed to higher-friction verification for most consumer sign-up flows. Fixed VoIP is more nuanced: it is legitimate for business accounts but unusual for personal banking. The right threshold depends on your product and risk appetite.

Can VoIP numbers receive OTP SMS messages?

Most VoIP numbers can receive SMS, which is why OTP verification alone does not catch them. The number passes the verification step because it is technically reachable. A number-type lookup is needed to identify that the number is VoIP before you send the OTP.

Implementation guide

How to Detect VoIP Numbers With a Single API Call

Send any phone number to a number-type lookup API and check the numberType field in the response. If it returns nonFixedVoip, the number is a virtual number not tied to a physical address or device. If it returns fixedVoip, it is a VoIP number assigned to a fixed location. Both are worth flagging at sign-up, but non-fixed VoIP is the higher risk. Telebase returns number type alongside carrier, active status and SIM swap status in a single call.

Why VoIP detection matters at sign-up

Non-fixed VoIP numbers are the tool of choice for multi-accounting, promotional abuse and synthetic identity fraud. They are cheap (often free), disposable (new numbers in seconds), and anonymous (no identity verification required to obtain one). A fraudster running 50 fake accounts does not buy 50 SIM cards. They spin up 50 VoIP numbers through a wholesale provider and register one per account.

Format validation does not catch this. The number is correctly formatted. OTP verification does not catch it either. The number receives the SMS. Only a carrier-level lookup reveals what kind of number it is.

The lookup

One HTTP request returns the number type along with carrier, country and active status. The number must be in E.164 format (country code, no spaces, no dashes).

Request

GET /lookup?phone=%2B447700900000
Authorization: Bearer YOUR_API_KEY

Response: legitimate mobile

{
  "phoneNumber": "+447700900000",
  "numberType": "mobile",
  "carrier": "EE",
  "country": "GB",
  "active": true,
  "simSwap": false,
  "simSwapAt": null,
  "_meta": { "activeSource": "LINE_STATUS" }
}

Response: non-fixed VoIP number

{
  "phoneNumber": "+12025551234",
  "numberType": "nonFixedVoip",
  "carrier": "Bandwidth.com",
  "country": "US",
  "active": true,
  "simSwap": false,
  "simSwapAt": null,
  "_meta": { "activeSource": "VALID" }
}

The numberType field is the one you need. The rest of the response gives you additional context for your risk decision.

What each number type means

numberType value	What it is	Suggested action
`mobile`	Standard mobile number on a physical SIM or eSIM	Allow. Lowest risk for onboarding.
`fixedVoip`	VoIP number assigned to a fixed location (office line, home broadband phone)	Flag for review. Legitimate in some contexts (business accounts), unusual for a personal banking sign-up.
`nonFixedVoip`	Virtual number not tied to any physical address or device. Google Voice, TextNow, wholesale VoIP.	Block or route to higher-friction verification. This is the primary number type used for multi-accounting and promotional abuse.
`landline`	Traditional fixed-line telephone	Flag. Cannot receive SMS. May indicate a mistyped number or an older customer.
`tollFree`	Toll-free number (0800, 1-800)	Block. Not a personal number.
`voicemail`	Voicemail-only number	Block. Cannot receive SMS and is not a real subscriber line.

Implementation: a simple decision function

In practice, you write a function that calls the lookup and returns a risk decision. Here is the logic in pseudocode:

Decision logic (pseudocode)

// Call Telebase lookup
response = GET /lookup?phone={e164_number}

// Decision tree
if response.numberType == "nonFixedVoip":
    return "BLOCK"  // or route to manual review

if response.numberType in ["tollFree", "voicemail"]:
    return "BLOCK"

if response.numberType == "fixedVoip":
    return "REVIEW"

if response.numberType == "landline":
    return "REVIEW"

if response.active == false:
    return "REVIEW"

return "ALLOW"

This runs before you send the OTP. If the number fails the screen, you skip the SMS entirely and save the cost. If it passes, you proceed to verification as normal.

Combining VoIP detection with other signals

Number type on its own is a strong screen. Combined with carrier and active status, it gets stronger.

Number type + carrier: a mobile number on a recognised national carrier is low risk. A mobile number on a wholesale carrier you do not recognise is worth a second look, even if the type is technically mobile.
Number type + country: a UK sign-up with a US VoIP number is a stronger signal than either fact alone.
Number type + active status: a non-fixed VoIP number that is also inactive is almost certainly not a real customer.

For a full walkthrough of combining these signals into a composite score, see building a risk score from telecom signals.

Running this pre-OTP saves money

Every SMS you send to a fraudulent number is wasted spend. OTP delivery to international or premium-rate numbers is expensive. A number-type check before the OTP catches the numbers you should never have texted. The lookup is cheaper than the SMS, and the numbers it catches would never have converted to real customers anyway.

This also reduces SMS pumping, where attackers trigger mass OTP sends to inflate traffic and collect revenue-share payments from premium-rate numbers.

Getting started

Telebase returns numberType on every lookup. Sign up, get an API key, and run your first lookup in under two minutes. Every account starts with 100 free queries. For full language-specific integration examples, see the Node.js and Python guides.

Request early access