How Websites Detect VoIP Numbers (Carrier Lookup)
You entered a number that works perfectly well — it rings, it receives texts — and the signup form rejected it in under a second, before any code was sent. That speed is the tell. Nobody looked at your number and made a judgement call. A database was queried, a field came back reading nonFixedVoip, and a rule fired.
This article explains exactly how websites detect VoIP numbers: which databases they read, what those databases contain, what the checks cost, and why the common workarounds don't work. If you want the background first, start with what a non-VoIP number is or the VoIP vs non-VoIP comparison. What follows is the mechanism.
How websites detect VoIP numbers: the two-second version
Every US phone number carries a paper trail in industry databases that anyone can query for a fraction of a cent. Those records say which company the number was allocated to, which switch currently serves it, and what kind of service that company provides — wireless, wireline, or VoIP. A website doesn't need to guess your line type. It reads it.
The reason this feels invisible is that the record isn't attached to your number in any way you can see. It lives in telecom routing infrastructure that exists so calls can be delivered correctly. Fraud screening is a side effect of a system built for something else entirely.
The four databases doing the work
Almost every commercial "phone intelligence" product is a friendly wrapper around the same underlying sources.
| Source | What it holds | What it reveals about your number |
|---|---|---|
| LERG (Local Exchange Routing Guide) | Which carrier each area-code-and-prefix block was originally allocated to, and what type of carrier that is | The number's birth certificate — who it was issued to before any porting |
| NPAC (Number Portability Administration Center) | A record for every ported number, including Service Provider ID, service provider type — wireless, wireline or VoIP, the Location Routing Number, and SS7 destination point codes | Who serves the number today, and explicitly what category of provider they are |
| LRN dip (a live query against the above) | The Location Routing Number of the switch currently serving the number | Where messages actually terminate, which usually gives away a VoIP platform |
| HLR (Home Location Register) | Live subscriber state on a mobile network: is the SIM active, which network, roaming status | Whether a real mobile subscription exists at all |
The NPAC entry is the part people underestimate. Its records — each one called a "subscription version" — carry a service provider type field that distinguishes wireless from wireline from VoIP as a first-class attribute. It isn't inferred. It's declared, by the provider, as part of how number portability functions.
That's also why the folk advice about porting a VoIP number to a mobile carrier to "launder" it rarely helps. Porting creates a new subscription version; it doesn't erase the history, and the record still shows what kind of provider holds the number. The FCC requires simple one-number ports to complete within one business day, so the data updates fast — fast enough that a screening service reading it will see the change almost immediately, in either direction.
What a lookup actually returns
To make this concrete, here's what a platform gets back from a single API call. Twilio's Lookup v2 is the industry reference point, and its packages map neatly onto the questions a fraud team wants answered:
| Package | Answers the question | Listed price per request |
|---|---|---|
| Formatting and validation | Is this a structurally real number? | Free |
| Line Type Intelligence | Mobile, landline, fixed VoIP, non-fixed VoIP or toll-free — plus carrier name and MCC/MNC | $0.008 |
| Line Status | Is there a live subscription behind it right now? | $0.007, falling to about $0.00385 at high volume |
| SIM Swap | When was the SIM last changed? | Contact sales |
| Call Forwarding | Is unconditional forwarding switched on? | Contact sales |
| Reassigned Number Risk | Has this number changed hands since a given date? | $0.02, down to $0.0015 at volume |
| Identity Match | Does the name, address and date of birth on file match what the user typed? | About $0.10 |
| SMS Pumping Risk | Is this number implicated in SMS pumping fraud? | Free in North America; about $0.025 elsewhere |
Competing providers price the raw layer even lower — Telnyx advertises LRN dips from $0.0015 — and IPQualityScore, Vonage and Telesign sell comparable bundles. A platform screening a million signups for line type is spending a few thousand dollars. Against even a modest fraud loss, that is not a difficult budget conversation.
Why "cannot be used for verification" arrives before any SMS
The sequencing matters, and it's diagnostic. Here is what happens between you clicking submit and the error appearing:
- Format check. The number is normalised to E.164 (
+15551234567) and checked for structural validity. Free, instant, catches typos. - Line type lookup. LERG plus NPAC data returns a type and a carrier name. This is the step that catches VoIP, and it happens before a single message is sent.
- Carrier name check. Even when the type field says something acceptable, a carrier name like Bandwidth, Twilio, Telnyx or "Google (Grand Central)" is itself a rejection trigger on strict platforms.
- Live status query. Optionally, an HLR query confirms an active subscription. A VoIP number has no home network to answer.
- Risk scoring. The line-type result is combined with other signals — see below — into a single score.
- Decision. Send the code, silently drop the request, or return an error.
If you were refused instantly, you hit step 2 or 3. If the form accepted your number and the code never arrived, you have a delivery problem, not a classification one — and that's a different fix, covered in why phone numbers get rejected for verification.
Line type is only one signal
Focusing solely on VoIP detection misses how these systems are actually built. IPQualityScore, whose own documentation returns a fraud_score from 0 to 100 alongside fields like VOIP, prepaid, active_status, recent_abuse and leaked, states the point plainly: no single phone intelligence signal should be used in isolation. Telesign lists a similar stack. The signals that travel alongside line type include:
- Number tenure. How long the number has existed in its current allocation. Brand-new allocations score worse than numbers with years of history.
- Porting recency. A number ported within the last few days is treated with suspicion, because porting is a step in both legitimate switching and account-takeover attacks.
- SIM swap recency. A SIM changed hours ago is the classic signature of a takeover in progress. This is why some banks refuse SMS 2FA for a window after a swap.
- Reuse and recycling. US carriers return disconnected numbers to circulation, so a number can arrive already carrying someone else's account history.
- Velocity. How many accounts, on this platform or across a shared consortium, have touched this number.
- Geographic coherence. A US number, an IP address in another country, and a device locale in a third is a mismatch pattern that scores badly on its own.
- Prepaid status. Weighted mildly negative by some platforms — a blunt and frequently unfair signal, since plenty of ordinary people use prepaid.
This is why identical numbers get different outcomes on different days. You are not being measured against a VoIP blocklist; you are being scored, and the threshold moves.
What this means in practice
Three honest conclusions follow from the mechanism.
You cannot disguise a VoIP number. Line type isn't a label on the number that can be edited — it's a property of how the number is provisioned and routed, recorded in databases the provider populates. Every "make VoIP look like mobile" trick either doesn't work or stops working when a platform re-runs its checks.
The area code is irrelevant. A VoIP number with a Manhattan 212 prefix is still VoIP. Sites that need a US number are checking line type, not geography.
A number's history travels with it. If you obtain a recycled or previously abused number, you inherit its score. This is the practical case against free public receive-SMS numbers: they are shared, already registered everywhere, and carry accumulated abuse history — so they fail the risk check for reasons that have nothing to do with you.
The workable path, if your goal is a legitimate signup while keeping your personal number private, is a carrier-backed mobile number that passes the check on its merits. Not because the check has been fooled, but because there's nothing to fool.
Frequently asked questions
Can I check my own number the same way a website does?
Yes. Several providers offer free carrier-lookup tools that run the same LERG and NPAC query. Enter your number in E.164 format and read the line type and carrier name fields. That's the same data the signup form sees.
Does a website know I used a lookup service, or which one?
No. Lookups are one-directional queries against routing databases. Neither you nor the number's owner is notified, and there's no record on the number that a lookup occurred.
Why do some sites accept fixed VoIP but not non-fixed VoIP?
Fixed VoIP is tied to a verified physical address — an office phone system or an ISP-provided home line — which makes it harder to acquire in bulk. Non-fixed VoIP can be provisioned by API in seconds. Some platforms draw the line between them; many block both.
How current is this data?
Very. Porting records update as ports complete, and the FCC requires simple ports to finish within one business day. Live HLR queries return the network's current state at the moment of the query.
The short version
Websites detect VoIP numbers by reading telecom routing databases — LERG for original allocation, NPAC for who serves the number now and what type of provider they are, plus a live network query when they want to confirm a real subscription exists. It costs under a cent, takes milliseconds, and runs before any verification code is generated. The line type is a property of the number's provisioning, not a setting, which is why the outcome is so consistent and why the shortcuts don't hold up.