Phone Fraud Detection: Beyond Static Blocklists

The Phone Fraud Landscape

Phone numbers are central to modern fraud schemes:

• SIM swap — Attackers port victim's number to steal SMS 2FA codes
• Account takeover — Compromised numbers enable account access
• Synthetic identity — Fake identities use disposable phone numbers
• CNP fraud — Card-not-present fraud uses untraceable numbers

Phone intelligence provides signals to detect these fraud types.

Key Fraud Detection Signals

LRN Activation Date (Exclusive)

The most powerful signal for SIM swap detection. When a number is ported, the LRN Activation Date updates. Check this date against:

• Account creation date — Number ported after account created?
• Last known good activity — Number changed since last login?
• Transaction timing — Recent port during high-risk action?

if activation_date > account.last_verified_date:
    # Number may have been taken over
    require_step_up_authentication()

VoIP Detection

VoIP numbers are easier to obtain anonymously and are commonly used in fraud:

• No identity verification required
• Can be obtained in minutes
• Easy to abandon after fraud
• May mask true location

Flag VoIP numbers for additional verification in high-risk scenarios.

CNAM Verification

Compare registered caller ID against claimed identity:

• Significant name mismatch = investigate
• Business CNAM on personal account = suspicious
• Blocked/unavailable CNAM = elevated risk

Carrier Analysis

Carrier type provides context:

• Major postpaid carrier — Required identity verification
• Prepaid carrier — Less verification, moderate risk
• VoIP provider — Often no verification, higher risk

Building a Fraud Score

def calculate_phone_fraud_score(phone, context):
    result = veriroute_lookup(phone, lrn=True, cnam=True)
    score = 0

    # Recent port is risky
    days_since_port = result['lrn']['days_since_activation']
    if days_since_port < 7:
        score += 35
    elif days_since_port < 30:
        score += 20

    # VoIP adds risk
    if result['lrn']['line_type'] == 'voip':
        score += 25

    # CNAM mismatch
    if context.provided_name and result['cnam']['name']:
        if not names_similar(context.provided_name, result['cnam']['name']):
            score += 15

    return score

Fraud Prevention Use Cases

Account Opening

Check phone signals during registration:

• Flag VoIP numbers for additional verification
• Store activation date for future comparison
• Verify CNAM matches application name

High-Value Transactions

Before processing sensitive actions:

• Check if phone was ported since last good activity
• Step up authentication for suspicious signals
• Block or hold for review on high scores

Account Recovery

SMS-based recovery is vulnerable to SIM swap:

• Check activation date before sending recovery codes
• Recent port = use alternative recovery method

Frequently Asked Questions

What is SIM swap fraud?

SIM swap fraud occurs when attackers convince a carrier to port a victim's phone number to a new SIM card. This allows them to receive SMS authentication codes and take over accounts. LRN Activation Date helps detect this by showing when a number was last ported.

Why are VoIP numbers higher risk?

VoIP numbers are higher risk because they're easy to obtain without identity verification, can be acquired in minutes, and are commonly used for fraud because they're disposable. However, not all VoIP usage is fraudulent — use VoIP as one signal in a broader fraud assessment.

Related Articles