Detecting Disposable & VOIP Phone Numbers

A phone number feels like a trustworthy identity anchor. It is not — at least not on its own. Anyone can provision a free VOIP line in seconds, grab a disposable number from a temporary-SMS site, or rent a bank of numbers in bulk. Fraudsters use these to pass verification, dodge order-limit rules, and stay untraceable after the chargeback lands.

This tutorial covers how to spot disposable and VOIP numbers at checkout, and what to do once you have flagged one.

Why phone numbers matter to fraud

Many stores treat the phone field as decorative. Fraud operations treat it as a tool:

• Bypassing per-customer limits. A fresh number looks like a fresh customer, so promo caps and one-per-household rules fall apart.
• Passing SMS verification. Temp-SMS services publicly display incoming codes, so a "verified" number proves nothing.
• Staying anonymous. A burner number cannot be traced back after a stolen-card order ships.
• Powering account farms. Aged accounts each need a unique-looking number, and VOIP supplies them cheaply.

If your only phone check is "did they enter something in the right format," you are validating the fraud, not stopping it.

Signals that a number is disposable

Signals. These indicators separate a real personal line from a throwaway:

• Line type is VOIP. The single most useful lookup. Numbers assigned to VOIP carriers (rather than mobile or landline networks) are heavily overrepresented in fraud.
• Known temp-SMS ranges. Public disposable-number services publish recognizable blocks. Their numbers rotate through many unrelated "customers."
• Carrier does not match region. A number claiming to be local but registered to an out-of-region or foreign VOIP provider.
• Reuse across accounts. The same number attached to multiple accounts, names, or shipping addresses in your store.
• Number/geo mismatch. Phone country code, billing address, and IP geolocation all pointing to different places.
• Freshly provisioned. Numbers with no history that appear across many merchants at once — a hallmark of bulk-rented pools.
• Format tricks. Numbers padded with extra digits, repeated patterns, or sequential runs across a batch of orders.

No single signal is proof. VOIP alone is common among legitimate customers who use internet-based phone services. Weight it, do not auto-reject on it.

Verification steps that catch them

Detection points you at risk; verification confirms it. Layer these so a determined fraudster hits friction while a real buyer sails through.

Best control. Run a line-type lookup at checkout and route only the suspicious numbers into a verification challenge — never make every customer jump through a hoop.

1. Line-type lookup. Classify each number as mobile, landline, or VOIP before the order is accepted. This is the highest-leverage single check.
2. Risk-based SMS verification. Send a one-time code only to flagged numbers. A real owner receives it; a shared temp number rarely will in a way that ties back to the buyer.
3. Reuse checks. Compare the number against recent orders. Repeated use across different identities is a strong block signal.
4. Cross-field consistency. Confirm the phone's region lines up with billing, shipping, and IP. Multiple mismatches raise the score.
5. Progressive friction. For medium-risk cases, add a small step (email confirmation, manual review hold) rather than an outright block, so false positives can recover.

Where Shopify falls short

Shopify collects the phone number but does not tell you its line type, carrier, or whether it has appeared across suspicious orders. You would need a carrier-lookup integration plus your own reuse-tracking logic to act on any of the signals above — and you would need it to run before the order is created, not after.

That is the role of a checkout-level filter. Shieldy Fraud Filter evaluates checkout signals — including phone risk factors alongside IP, country, VPN, proxy, Tor, and device fingerprints — and blocks or holds high-risk orders through its AI fraud scoring before they complete. Because enforcement happens at checkout, a disposable number tied to other red flags never turns into a shipped order you have to claw back.

Balancing security and conversion

VOIP is not automatically fraud. Plenty of legitimate customers use Google Voice, an internet phone plan, or a business line that classifies as VOIP. Punishing all of them costs you real sales.

Keep the balance with these rules:

• Score, do not blanket-block. VOIP raises risk; it should not by itself cancel an order.
• Combine signals. VOIP + disposable email + datacenter IP + mismatched geo is a confident block. VOIP alone is a shrug.
• Reserve hard blocks for numbers that are both VOIP and reused across identities, or that sit in known temp-SMS ranges.
• Audit false positives. Review held orders regularly so you learn which patterns are genuinely risky in your store.

The takeaway

A phone number only counts as identity if you know what kind of line it is and whether it has been reused. Look up line type, watch for temp-SMS ranges and cross-identity reuse, and challenge only the flagged numbers so real customers are untouched.

Do that at checkout and disposable numbers stop being a loophole. If you want the line-type lookups, reuse tracking, and blocking wired together out of the box, Shieldy Fraud Filter handles it as part of its checkout-level scoring.