--- title: "VoIP and Burner Number Fraud Signals" description: "How fraudsters use VoIP and burner numbers to clear phone verification, the signals that distinguish a disposable number from a real mobile, and why line type should reweight a case rather than decide it alone." canonical: https://defencecore.com/blog/voip-burner-number-fraud-signals published: 2026-07-08 modified: 2026-07-08 --- # VoIP and Burner Number Fraud Signals The phone number is one of the most trusted fields on a signup form — which is exactly why fraudsters attack it. A number *feels* like a commitment to a real identity, but VoIP services and burner apps have made phone numbers cheap, disposable, and creatable in bulk. This guide covers how fraudsters use VoIP and burner numbers, the signals that distinguish them from a real customer's mobile, and how to weigh a number in an investigation. --- ## Why fraudsters love VoIP and burner numbers A real mobile number is (loosely) tied to a SIM, a carrier account, and often an identity and a cost. A VoIP or burner number is none of those: - **Cheap and instant** — provisioned in seconds, often free, from a web app. - **Disposable** — used for one signup and discarded, so it carries no history to investigate. - **Bulk-creatable** — one actor can control hundreds, enabling ring-scale abuse. - **Geography-flexible** — a number with a local country code that has no physical presence there, letting a persona fake locality. - **SMS-capable** — enough to pass an SMS OTP, which is the whole point when the number exists only to receive one verification code. The number does its entire job — clearing phone verification — and then evaporates. That's why it's the fraudster's tool of choice for account creation. --- ## The signals that expose a disposable number ### 1. Line type The foundational check. Carrier lookups return whether a number is **mobile, landline, or VoIP.** VoIP on a field that's supposed to be a personal mobile is the single clearest signal. It isn't proof of fraud — plenty of legitimate people use VoIP — but it's an inconsistency that reweights everything else. ### 2. Carrier identity Numbers issued by carriers that are actually VoIP providers or known bulk-SMS resellers cluster with fraud. The carrier name behind a number often says more than the number itself. ### 3. No history, no reporting A real person's mobile accumulates residue — it appears in breaches, connects to accounts, has a reputation. A burner used once is invisible: zero breach history, no linked accounts, no reporting. A "long-time" persona on a historyless number is contradictory. ### 4. Recent activation / recycled number Freshly provisioned numbers and recently recycled ones (previously belonging to someone else) both break the assumption of a stable identity behind the line. ### 5. Reuse across accounts The highest-value signal: the same number, or numbers from the same VoIP block, behind multiple "different" signups. That converts a single disposable number into evidence of a coordinated ring. ### 6. Country-code mismatch A number whose country contradicts the email domain, the IP geography, or the claimed persona location — a seam of an assembled identity. --- ## How to weigh a phone number properly The mistake is binary thinking: "VoIP = fraud." It isn't. A number is one signal, and its weight depends on the company it keeps. VoIP on a free-trial signup with a fresh email and a datacenter IP is a strong combined signal; VoIP on an otherwise deeply corroborated, historied identity is a person who happens to use internet calling. **The line type reweights the case; it doesn't decide it.** Good investigation places the phone signal in the context of every other identifier, rather than declining on it alone. --- ## Investigating the number in context This contextual weighing is what [DefenceCore](/) automates. Given a phone number (alongside the rest of a case's identifiers), the agent pulls carrier and line-type data, checks fraud and spam reporting history, and — critically — pivots to see what the number connects to: accounts registered against it, alternate identifiers surfaced beside it, and whether it or its VoIP block appears behind other signups. The result isn't a "VoIP: yes/no" field. It's the number resolved into the identity graph, with: - **line type and carrier** shown as attributes with a citation; - **deterministic risk signals** firing on disposable-number patterns (VoIP on a personal field, no history, reuse across accounts, country mismatch); - and the **cross-account links** that reveal a ring when one exists — all weighted against the rest of the identity so a reviewer sees whether the phone is the seam that unravels a fake identity or an innocent detail in a real one. [See a sample report](/sample-report). --- ## VoIP / burner red flags | Signal | What it suggests | |---|---| | VoIP line type on a "personal mobile" field | Disposable / provisioned-for-signup number | | Carrier is a VoIP or bulk-SMS reseller | Fraud-adjacent provisioning | | Zero breach history, no linked accounts | Number has no real-person residue | | Freshly activated or recently recycled | No stable identity behind the line | | Same number / VoIP block across signups | Coordinated ring | | Country code contradicts email / IP / persona | Assembled identity | --- ## Frequently asked questions **Is a VoIP number always a sign of fraud?** No. Many legitimate people use VoIP as their primary number. VoIP is an inconsistency that raises scrutiny and reweights the other signals — it is not a verdict on its own. Declining solely on line type will cost you real customers. **How can you tell if a phone number is VoIP or a burner?** A carrier lookup returns the line type (mobile / landline / VoIP) and the issuing carrier; disposable numbers also tend to have no breach or account history and to be recently provisioned. The combination — VoIP line type plus no history plus reuse across accounts — is what identifies a burner used for fraud. **Why do fraudsters use burner numbers for signups?** Because a VoIP/burner number is cheap, instant, disposable, bulk-creatable, and can receive an SMS OTP — everything needed to clear phone verification and then be thrown away, leaving no history to trace. **What's the most useful phone signal in an investigation?** In isolation, line type. In practice, the discovery that a number (or its VoIP block) is reused across multiple accounts is the most valuable, because it exposes coordinated abuse rather than a single event. --- ## Weigh a real number in context Run a phone number from a suspicious signup through a full investigation and see it resolved against the rest of the identity, not judged in isolation. → **[Run an investigation](/)**