Phone verification for trust & safety teams: stopping fake accounts without killing signups

Phone verification basics

Phone verification can establish that a user has access to a particular phone number. That is useful, but possession alone is a weak signal for trust & safety.

Fraudsters can obtain disposable numbers, use VoIP lines, rotate numbers across accounts, or control large pools of SIMs. A successful OTP therefore does not mean the account is legitimate. It only tells you that the person completing the signup can receive the verification message.

The more useful question is: what does the phone number tell you before you spend money or add friction?

Number intelligence can reveal whether a number is active, which carrier currently holds it, what type of line it is, whether it has been ported, and whether it matches other risk signals available to your system. Those signals can feed a signup decision before an OTP is sent.

That creates a more useful trust & safety model:

• Low-risk number: let the signup proceed with minimal friction.

• Unclear number: verify possession with an OTP or another lightweight check.

• High-risk number: apply additional controls, manual review, or block the signup.

This distinction matters because phone verification should not be treated as a binary security gate. It is one signal in a broader risk-based onboarding system.

It also should not be confused with regulated Know Your Customer (KYC). KYC can establish a person's identity for regulated financial or other flows; phone intelligence primarily helps you assess the risk associated with the number being used.

Use friction only when the risk justifies it

The strongest signup flow is not necessarily the one with the most verification. Every additional step creates another opportunity for a legitimate user to abandon signup, while determined bad actors will adapt to the control.

Trust & safety teams should therefore separate number intelligence from number verification.

Number intelligence happens before the OTP. It helps answer whether the number looks valid, active, correctly formatted, associated with a real mobile network, recently ported, or otherwise unusual.

Number verification happens when you need to establish that the user actually controls the number.

This makes it possible to build a risk-based decision tree rather than sending every signup through the same flow:

1. Validate the number first. Reject malformed, inactive, or otherwise unusable numbers before spending money on verification messages

2. Assess the available risk signals. Combine phone intelligence with signals such as IP reputation, device behaviour, signup velocity, account history, and the value of the account being created

3. Apply proportional friction. Low-risk users should move through signup quickly. Suspicious users can be challenged with OTP or stronger verification

4. Block or review high-risk signups. If multiple signals point toward abuse, another OTP is unlikely to solve the underlying problem.

The result is a better trade-off: less friction for legitimate users and more resistance against automated or coordinated account creation.

SMS should be a decision, not the default

SMS OTP remains useful because users understand it and it works across a wide range of devices and markets. The problem is treating it as the first and only response to every signup.

If a number is clearly inactive or otherwise unsuitable before the message is sent, there is little reason to spend money sending an OTP to it. If the number looks legitimate and the surrounding signup signals are clean, forcing an OTP may add friction without meaningfully improving your fraud detection.

SMS therefore works best as one step in a risk-based flow, rather than as a universal gate.

Then there's the security ceiling. The National Institute of Standards and Technology classifies out-of-band authentication over the public telephone network as a restricted authenticator in SP 800-63B, which obliges you to run a risk assessment and offer an unrestricted alternative while you keep a migration plan.

Use silent authentication where low friction matters

Silent authentication can reduce signup friction by verifying a number through the user's cellular connection without asking them to enter an OTP. That makes it useful when conversion is especially important, and operator coverage is strong.

The role is straightforward: use it where you can establish possession without adding another manual step, then fall back to other verification methods when network conditions or operator coverage prevent it.

Keep in mind that silent authentication is not a replacement for number intelligence. It can establish control of the number, but it does not by itself tell you whether the number is being used to create fraudulent accounts.

Keep alternative channels as fallbacks

Voice and WhatsApp can serve as fallback verification channels when SMS delivery fails, or a market performs better on another channel.

They are useful for improving completion rates, but they should not become another universal verification requirement. The same principle applies: first determine whether the signup warrants verification, then choose the channel most likely to complete that verification with the least friction.

Why SMS-only onboarding is a trust & safety liability

SMS-only onboarding creates two related problems for trust & safety teams.

The first is friction. A legitimate user can be delayed by a failed or delayed message, causing abandonment at exactly the point where the platform is trying to convert a new customer.

The second is abuse. If every signup automatically triggers a paid SMS, attackers have an incentive to automate the flow. SMS pumping can generate unnecessary messaging costs, while the same automated signup infrastructure can be used to create fake accounts, farm referral bonuses, abuse promotions, or generate fraudulent marketplace activity.

The problem is bigger than SMS cost. A signup flow that sends the same verification challenge to every user gives attackers a predictable and expensive method to target.

Fraud makes SMS-only onboarding worse specifically for trust & safety teams. Artificially inflated traffic, better known as SMS pumping, uses bots to hammer your send-code endpoint with numbers the fraudster controls and collect termination revenue on every message you pay for. On a platform, the same weakness doubles as a fake-account vector: bots that farm OTP endpoints are frequently the same bots farming referral bonuses, promo codes, or marketplace listings.

The most public case belongs to a platform, not a retailer or bank, which is exactly the category of abuse trust & safety teams are asked to own. Elon Musk posted in February 2023 that "Twitter is getting scammed by phone companies for $60M/year of fake 2FA SMS messages," and the company restricted SMS two-factor authentication to paying subscribers weeks later. If your platform holds stored payment credentials, seller payouts, or wallet balances, the case against SMS as your sole factor gets stronger.

The broader lesson for trust & safety teams is this: if a control has a direct per-attempt cost and attackers can trigger it automatically, the platform needs a way to distinguish legitimate traffic from abuse before incurring that cost.

Build a risk-based signup decision

The most effective way to reduce fake accounts without damaging conversion is to stop treating every signup as equally risky.

A marketplace, for example, might accept a low-risk buyer after basic number validation while requiring stronger checks from a new seller who wants immediate access to payouts. A social platform might allow a clean signup to proceed after number validation but challenge accounts showing unusual device, IP, or signup-velocity patterns.

The exact signals will differ by platform, but the principle is consistent: validate, then assess, and then challenge only when necessary.

Phone intelligence belongs at the beginning of that sequence because it can provide useful information before an OTP or other paid verification step takes place.

For higher-risk accounts, the platform can then layer additional controls such as OTP verification, identity verification, device intelligence, behavioural analysis, or manual review.

The objective is to make abuse progressively more expensive while keeping the path for legitimate users as short as possible.

Signup controls that matter

Once a signup reaches the verification stage, the goal is to prevent attackers from repeatedly triggering the same control while keeping the experience predictable for legitimate users.

The OTP itself is only one part of the defence. Rate limits, geographic restrictions, delivery monitoring, and number validation determine whether the verification layer actually reduces abuse or simply adds cost and friction.

The OWASP Multifactor Authentication Cheat Sheet sets the baseline for code handling: enforce a short time-to-live and make codes single-use. Apply strict attempt limits and invalidate on successful verification. On resend, generate a new code and overwrite the old record.

Around that core, the operational layer decides whether your flow survives contact with real traffic and real attackers:

1. Rate limits on both requests per number and account/device activity, so a bot cannot simply rotate numbers to bypass per-number limits and farm accounts.

2. Resend intervals long enough to discourage retries that cost you money and short enough that a genuine customer doesn't give up waiting.

3. Geographic permissions that disable messaging to countries where you have no users, sellers, or drivers, since geo-permissions are a primary pumping defence.

4. Consent capture stored with a timestamp and the exact wording shown, because reconstructing it later during a dispute, including a chargeback or regulatory inquiry, is not possible.

5. Delivery monitoring broken out by country and carrier, which prevents one global number from hiding regional failures.

6. Multi-provider failover keyed to region or carrier, so a single route outage doesn't stop signups.

Where Acudo fits the flow

Number validation sits before the OTP and other verification channels.

This is where Acudo fits into the signup workflow. Instead of sending a verification message to every number a user submits, a platform can first query number intelligence and use the result as an input to its risk decision.

An HLR lookup can confirm whether a number is active and identify the network currently associated with it. It can also return information such as line type and porting status. Combined with other available risk signals, this helps the platform distinguish a number that looks usable from one that warrants further scrutiny.

A low-risk number can move forward without an unnecessary verification step. An invalid or inactive number can be rejected before an OTP is sent. A number that raises concerns can trigger stronger verification or additional review.

That is the key difference between using phone data for trust & safety and simply adding another verification step: the data helps decide when friction is necessary in the first place.

Acudo provides this number intelligence through its HLR Lookup and related validation capabilities, giving trust & safety teams a way to put number-level signals upstream of their verification and onboarding workflows.

Stop fake accounts without making signup harder

The goal of phone verification for trust & safety teams should not be to verify every user as aggressively as possible. It should be to apply the right amount of friction to the right signup.

Start by validating the number before sending an OTP. Combine number intelligence with the other signals your platform already collects, such as device, IP, account history, signup velocity, and transaction risk. Let low-risk users move through signup quickly, challenge suspicious users with additional verification, and reserve blocking or manual review for cases where multiple signals indicate abuse.

The verification channel then becomes a tactical choice rather than the entire fraud strategy. SMS may be the most practical option in one market, silent authentication may reduce friction in another, and voice or WhatsApp can provide fallback coverage where needed.

Acudo fits upstream in that process, providing number intelligence that can help your team make the decision before verification costs and signup friction are incurred. Rather than treating phone verification as a binary pass/fail gate, platforms can use number data as one part of a broader risk-based onboarding system.

Speak to Acudo to explore how number validation can fit into your signup and trust & safety workflows.