---
agentTools:
projectIndex: https://docs.defastra.com/llms.txt
---
# Deep Phone Check signals
List of the fraud checks we perform with our ***Deep Phone Check*** product.
[block:callout]
{
"type": "warning",
"title": "Advice",
"body": "We strongly advise reading our [introduction to fraud prevention](https://docs.defastra.com/docs/fraud-prevention-introduction) before seeking in-depth information on the specifications of our deep fraud checks."
}
[/block]
[block:callout]
{
"type": "info",
"title": "Important",
"body": "An important part of our risk scoring mechanism for phone numbers is powered by ratio discrepancies between the behavior of real and safe phone numbers VS disposable and risky phone numbers.\n\nWe generate discrepancy ratios by analyzing hundreds of thousands of phone numbers from numerous disposable phone number websites and legitimate databases.\n\nTo understand the ground-breaking technicalities that power our risk assessment logic for phone numbers, we invite you to [read our multiple technical white papers](https://cdn.defastra.com/downloads/papers/Defastra_SMS_Verification_Black_Market.pdf)."
}
[/block]
Here is the up-to-date overview of all the phone fraud checks we perform to uncover risk & trust signals:
[block:html]
{
"html": "\n\n
This check goes above and beyond to detect if the phone number is \n present on any disposable & temporary phone websites \n by consistently crawling hundreds of disposable phone number websites \n and storing the data we found.
\n
Risk outcome example: \n Phone number is disposable and was found on: https://sms-activate.org/en/44798512454, https://smsreceivefree.com/44798512454
\n
Trust outcome example: \n This phone number was not found on any free temporary/disposable SMS services
This check performs a deep scan to verify the carrier of the phone number. \n We do not simply rely on blacklisting VOIP carriers. \n We also flag risky mobile carriers usually found on SMS verification \n bypass services (such as cheap prepaid SIM carriers that are \n prominent on the black market but rarely associated with legitimate \n customers). We also check if the carrier is one of the main mobile carrier in its country, or an unusual small/unknown carrier. Learn more about \n our carrier scoring here.
\n
Risk outcome example: \n The carrier Lycamobile was blacklisted by our system as it is mostly used by fraudsters. It is not one of the main mobile carriers in France (FR): Bouygues Telecom, Free, Orange France, SFR
\n
Trust outcome example: \n The carrier SFR is one of the main mobile carriers in France (FR): Bouygues Telecom, Free, Orange France, SFR
\n
\n
\n\n
\n
Phone Is Blacklisted check \n \n \n (code: PHONE_IS_BLACKLISTED)
\n\t
\n
This check leverages OSINT to see if a phone number has been blacklisted \n (banned) by 3rd party services such as social media websites. Many fraudsters \n share the same disposable phone number to create fake accounts \n on various platforms. When a fake profile gets caught and blacklisted by for example \n Twitter, Instagram or any other major social, we gather that new \n intelligence to flag the phone number as risky. This is \n a very effective test against any sort of disposable phone number.
\n
Risk outcome example: \n This phone was blacklisted by various social media, indicating an extreme risk of fradulent activity
\n
Trust outcome example: \n This phone was not blacklisted by any 3rd party services\n
\n
\n
\n\n
\n
Phone OS check \n \n \n (code: PHONE_OS)
\n\t
\n
This check leverages exclusive intelligence to identify the device behind a phone number. \n Significant discrepancies are found between the OS of fraudulent VS \n legitimate phone numbers. For example, IOS devices are very trustworthy, \n while if no OS is found, it can indicate that the phone number is \n coming from a SIM farm or an unsafe device. \n Learn more here.
\n
Risk outcome example: \n No devices were linked to this phone number, which is highly unusual for phone numbers from Germany (DE).
\n
Trust outcome example: \n This phone number is live on an iOS device.
\n
\n
\n\n
\n
Phone Data Breach check \n \n \n (code: PHONE_DATA_BREACH)
\n\t
\n
This check searches through all existing data breaches to see if the \n phone number was involved in a data breach. It is fairly uncommon for a \n phone number to be associated with data breaches, so no risk signals are \n derived from this check. However, a phone that was breached is considered \n much safer than usual, as it indicates it was in use long enough and was not freshly activated. Note that we source our data for this check from \n Have I Been Pwned.
\n
No risk signals are derived from this check.
\n
Trust outcome example: \n This phone number was involved in the data breach 'Facebook 2017' 5 years ago.
\n
\n
\n\n
\n
Phone Type check \n \n \n (code: PHONE_TYPE)
\n\t
\n
This check leverages various HLR data sources to analyze the type of a \n phone number (VOIP, MOBILE, LANDLINE...), and flags suspicious phone types \n such as VOIP.
\n
Risk outcome example: \n This phone number type is 'VOIP'.
\n
Trust outcome example: \n This phone number type is 'MOBILE'.
This check analyze the online profiles we found linked to\n the phone number and cross-check every bit of information we \n found (pictures, name, location, etc) to see if it is consistent. For example, \n if a phone number is found to be named 'Livia' on its 'Viber' profile, \n but named 'Fred' on 'Telegram', and '典- 汉字' on 'LINE', this is a risk signal. \n Those discrepancies are common among shared fake phone numbers. However, \n if the phone number is found to be linked to a Skype profile named 'Thomas' \n and a Telegram profile named 'Thomas', this would be considered a very strong trust signal. \n Learn more here.\n
\n
Risk outcome example: \n This phone number's online profiles are not consistent: Telegram first_name is 'Алексей' in Cyrillic, LINE name is '艺涵' in Chinese.
\n
Trust outcome example: \n This phone number's online profiles are consistent: Skype username is 'thomas78', Airbnb name is 'Thomas', Facebook first_name is 'Thomas'. The Skype country is Netherlands (NL), matching with the Airbnb country Netherlands (NL).
This check analyze on which online services the phone number is registered. Major discrepancies are \n found between a fraudulent and legitimate phone numbers' social presence. \n A common mistake fraud managers make is to believe that a phone number \n linked to various social profiles is a safe attribute. However, this approach is inaccurate and \n can lead to many disposable phone numbers being undetected. \n We crafted a holistic and powerful system that analyzes the kind of service \n a phone is registered on to uncover temporary phone numbers. For example, \n a French phone number with a VKontakte and KakaoTalk profile is a highly \n suspicious pattern that is very rarely seen in real life, but very common among \n phone numbers sold on SMS verification bypass websites. This high impact check \n uncovers deep fraud patterns like no other solution. \n Read our technical white paper here.
\n
Risk outcome example: \n This phone number is registered on VKontakte, KakaoTalk, which is highly unusual for a France (FR) number. The chance of this number not being fraudulent is 155748 to 1.
\n
Trust outcome example: \n This phone number is registered on services Google, Instagram, Microsoft which is very common among legitimate France (FR) phone numbers.
This check leverages check the social information about \n a phone number, such as the Telegram username, the Viber last_seen property, \n and dozens other social media indicators. Significant discrepancies are found between \n fraudulent and legitimate phone numbers' social attributes. \n We analyzed millions of fraudulent phone numbers and uncovered \n significant systemic patterns linked to disposable phone numbers. \n For example, a phone number linked to a Telegram profile named 'Helpdesk Bitcoin' \n is a very high-risk signal, as it shows those phone numbers are linked to \n cryptocurrency scams on Telegram. Another example would be a phone number \n linked to a WhatsApp business account named 'Escort Service': this would \n indicate a very risky phone number involved in romance scams. \n Read our technical white paper here.
\n
Risk outcome example: \n This phone number is linked to a Telegram account named 'Escort Hire Premium'. The word 'Escort' is blacklisted as it is always associated with fraud.
\n
Trust outcome example: \n No black-market patterns were present on the online profiles of this phone number