Carrier Lookup Explained: How Platforms Detect VoIP Numbers

What a Carrier Lookup Is

A carrier lookup takes a phone number in E.164 format, such as +447700900123, and returns metadata about it from telecom databases. The two main kinds are a number-portability and numbering-plan lookup, which is a database query, and an HLR lookup, which is a live signalling query to the mobile network. Platforms use one or both through a vendor such as Twilio, Telesign, Vonage, Sinch, or Telnyx, or through cheaper aggregators such as NumVerify, Abstract API, or IPQualityScore.

The numbering-plan lookup answers: which range does this number belong to, which operator was it originally assigned to, and what kind of line is that range. The portability lookup answers: has this number been ported, and to whom. The HLR lookup answers: is this number currently live on a network, which network, and is the handset reachable. A platform combines the answers into an accept-or-reject decision, usually with a rule as blunt as "line type must be mobile".

Line Type: Mobile, Landline, VoIP

Line type is the field that matters most. Every country's numbering plan reserves ranges for different services, and the lookup vendor maps a number's prefix to a type. The common labels are mobile, landline, fixed VoIP (a VoIP service tied to a physical address, like a cable-company home phone), non-fixed VoIP (Google Voice, TextNow, Skype numbers, most virtual-number apps), pager, premium-rate, and non-geographic. Twilio's Lookup API returns these as mobile, landline, fixedVoip, nonFixedVoip, and a few others.

Platforms that want to stop bulk signups reject non-fixed VoIP because those numbers can be created in seconds with no identity behind them. Some reject landline because it cannot receive SMS. A number from TempNumber.me passes this check because it sits in a mobile range assigned to a real mobile operator; the non-VoIP positioning and what it does and does not guarantee is explained at /non-voip-phone-number. The list of platforms that check, and how strictly, is at /blog/why-voip-numbers-get-rejected.

Line type is inferred from the range, not from the SIM, so it is occasionally wrong. Mobile ranges that an operator has sublet to a virtual-number reseller still show as mobile until a vendor reclassifies them by observed behaviour, which is exactly why reputation lists exist as a second layer.

Portability Databases and What Porting Reveals

Number portability lets a customer keep a number when switching operators, which breaks the assumption that the prefix tells you the carrier. Each country runs a central porting database: NPAC in the US and Canada, operated by iconectiv; the Ofcom-mandated porting records in the UK; the Portabilitätsdatenbank in Germany; and equivalents elsewhere. Lookup vendors query these to return the current carrier rather than the original one.

Porting records also expose something platforms care about: a number ported from a mobile operator to a VoIP provider shows a mobile prefix but a VoIP current carrier, and a strict lookup catches it. The reverse, a VoIP number ported to a mobile operator, is rare but shows the same way. Very recent ports, within the last few days, are sometimes flagged by fintech risk engines because a port is one stage of a SIM-swap attack, which is covered at /blog/sim-swap-protection.

HLR Lookups: The Live Check

An HLR lookup goes past the database and asks the mobile network itself. The vendor sends a signalling message, historically an SS7 MAP Send Routing Info for SM, that the number's home network answers with the subscriber's current status. The reply includes the IMSI, which encodes the mobile country code and network code of the SIM, the serving network if the subscriber is roaming, and whether the handset is currently reachable. Vendors sell this as "number validation" at a fraction of a cent per query.

For a platform, the HLR answer separates a number that exists on paper from one with a live SIM behind it. An unallocated or deactivated number returns an absent-subscriber or unknown-subscriber error. That is one reason recycled and long-dormant numbers on shared SMS sites fail: the platform sees either no live subscriber or a subscriber whose network code does not match the claimed carrier. Numbers offered on TempNumber.me are live on their operator at the moment they are listed, which is what the HLR check is looking for.

HLR lookups are less reliable on some networks that block foreign signalling queries for security, and many operators now return generic responses. Vendors fall back to database lookups in those cases, so a platform's decision is often a blend rather than a single source.

Reputation Lists and Risk Scores

The third layer is not telecom data at all. Vendors such as Telesign, Twilio, IPQualityScore, and Prove maintain scores built from observed behaviour across their customers: how many signups a number has been used for, how often codes to it went unconfirmed, whether it appears in fraud reports, and whether it is a known range for virtual-number resellers. A number returned as "high risk" or "SMS pumping risk" is rejected even if its line type is mobile.

Shared public SMS numbers are the clearest case. A number that has received codes for hundreds of Telegram, Google, and Tinder accounts in a month scores at the top of every list, and platforms block it before sending anything. Private numbers avoid that pattern because the number is used by one person for one purpose, which is the difference between a private number from TempNumber.me and a shared inbox that anyone can read.

The layer that catches even a clean carrier number is the platform's own history. WhatsApp, Telegram, Google, and Discord keep their own records of every number that has ever registered with them. A number that already had an account on that platform, or was banned on it, is refused or throttled regardless of what the lookup says. That is the honest limit of "non-VoIP": it passes the telecom checks, but a prior account on the same platform is a separate reason for rejection that no lookup reveals. The country-and-service pages on TempNumber.me help here because success rates are tracked per platform, and the country-choosing method is at /blog/how-to-choose-country-for-verification.

How to Check a Number Yourself

You can run the same lookups the platforms run. The steps below use Twilio Lookup, which is the vendor most platforms use, and NumVerify, which is cheaper and adequate for line type.

• Twilio Lookup v2: create a Twilio account, then call https://lookups.twilio.com/v2/PhoneNumbers/+447700900123?Fields=line_type_intelligence with your account SID and auth token as basic auth. The response includes line_type_intelligence.type (mobile, landline, nonFixedVoip, and so on), carrier_name, and mobile_country_code and mobile_network_code. Each lookup with that field costs around $0.008.
• Twilio Console: the same data is available without code under Phone Numbers, Lookup, by pasting the number.
• NumVerify: sign up for an API key, then call http://apilayer.net/api/validate?access_key=KEY&number=447700900123. The response returns valid, line_type, carrier, and location. The entry tier has a low monthly quota, which is enough to spot-check a handful of numbers.
• Read the result: mobile plus a named mobile operator is what strict platforms want. nonFixedVoip, or a carrier name such as Bandwidth, Twilio, Onvoy, or Inteliquent on a US number, is what they reject.
• For an HLR check, vendors such as HLR Lookup, TMT Analysis, and Sinch offer per-query pricing; the answer to look for is a live subscriber with an IMSI whose network matches the carrier from the database lookup.
• Remember what the lookup cannot tell you: whether that number has been used on the target platform before. Only the platform knows that.

What This Means When Choosing a Number

A number passes verification when three things line up: the range is mobile, the number is live on a real operator, and its reputation and platform history are clean. Shared inboxes fail on reputation and history. Google Voice and similar apps fail on line type. Long-dormant numbers fail the HLR check. A private, carrier-range number used by one person is the only category that clears all three, and even then a prior account on the same platform can still block it, which is why switching country or service range is the standard fix when a clean number is refused.

How SMS codes travel once the number is accepted, and where they get delayed, is covered at /blog/sms-otp-explained.