Real-Time Carrier Lookup & VoIP Detection Architecture

# Introduction to Carrier Intelligence & Line-Type Classification

In modern digital platforms, user onboarding and multi-factor authentication (MFA) rely heavily on telecom channels. However, blind SMS dispatch without prior **telecom verification** exposes applications to severe vulnerabilities—most notably **SMS toll fraud** (also known as Artificially Inflated Traffic or AIT) and account creation abuse using disposable virtual numbers.

Implementing real-time **carrier lookup** and deterministic **line type detection** enables security and infrastructure teams to identify high-risk virtual numbers before sending an SMS OTP or provisioning high-privilege resources.

# Anatomy of Telecom Identifiers: MNOs, MVNOs, and VoIP

Telecom routing is structured around international identifier standards and network routing registries. Understanding these primitives is essential for robust **VoIP detection** and carrier attribution:

1. **Mobile Network Operator (MNO)**: Physical infrastructure owners (e.g., Verizon, AT&T, Vodafone, Jio) managing radio access networks (RAN) and core HLR/HSS databases.

2. **Mobile Virtual Network Operator (MVNO)**: Service providers that lease wireless capacity from MNOs (e.g., Mint Mobile, Google Fi) and map under specific Mobile Network Codes (MNC).

3. **Fixed Landline**: Traditional public switched telephone network (PSTN) wireline connections tied to geographic exchanges.

4. **Non-Fixed VoIP / Virtual Numbers**: Cloud-based communication providers (e.g., Twilio, Bandwidth, Google Voice, TextNow) that assign numbers without physical SIM cards or physical location constraints.

:::

# The Mechanics of SMS Toll Fraud (Artificially Inflated Traffic)

SMS toll fraud occurs when malicious actors exploit authentication forms by triggering thousands of SMS verification requests to premium-rate or collusion-controlled telephone numbers.

# How the Attack Unfolds

1. **Botnet Ingestion**: Fraudsters script headless browsers to submit registration forms using blocks of VoIP or international premium rate numbers.

2. **Unchecked OTP Triggers**: The target application executes expensive downstream SMS API calls without validating whether the recipient line is mobile or VoIP.

3. **Revenue Sharing Exploitation**: Fraudsters receive a kickback from rogue carriers for the inflated traffic, while the application incurs massive SMS delivery bills.

# High-Throughput Carrier Lookup Pipeline Architecture

To achieve sub-50ms latency in production onboarding flows, your verification pipeline should execute in three sequential phases:

[ Incoming User Request ]
           │
           ▼
[ Phase 1: E.164 Invariant Normalization & Local Syntax Check ($0.00) ]
           │
           ▼
[ Phase 2: Zero-Knowledge HMAC-SHA256 Cache Query ($0.003 - $0.004) ]
           │
      ┌────┴────────────────────────┐
   (Hit)                          (Miss)
      │                             │
      ▼                             ▼
[ Cached Record ]            [ Phase 3: Upstream Carrier & MNP Lookup ($0.0125 - $0.016) ]
      │                             │
      └──────────────┬──────────────┘
                     ▼
[ Decision Matrix: Line Type & Risk Scoring ]
       ├── Mobile      ──> Send SMS OTP
       ├── Landline    ──> Fallback to Voice Call or Email
       └── VoIP        ──> Require Passkey / WebAuthn / Block

# 1. Preflight Invariant Formatting

Verify length (maximum 15 digits under ITU-T E.164) and strip country-specific national trunk prefixes before any network call.

# 2. Zero-Knowledge Cryptographic Cache

Check local/tenant cache with HMAC-SHA256 salted hashes. If the carrier data was verified within the authoritative 30-to-90-day window, return the cached line type instantly at an 80% cost reduction.

# 3. Authoritative HLR & MNP Resolution

Query real-time Mobile Number Portability (MNP) databases to capture recent carrier transfers and authoritative line type assignments.

# Production Implementation Example

Here is an enterprise-grade TypeScript implementation for gating authentication by line type:

import { PhoneVerifloClient } from "@phoneveriflo/sdk";

interface VerificationDecision {
  allowSmsOtp: boolean;
  channel: "sms" | "voice" | "passkey_fallback" | "block";
  carrierName?: string;
  lineType?: string;
  riskScore: number;
}

export async function evaluatePhoneRisk(
  rawPhoneNumber: string,
  countryCode: string
): Promise<VerificationDecision> {
  const client = new PhoneVerifloClient({
    apiKey: process.env.PHONEVERIFLO_API_KEY!
  });

  // Step 1: Execute carrier lookup with automatic E.164 preflight
  const lookup = await client.carrier.lookup({
    phoneNumber: rawPhoneNumber,
    countryCode: countryCode,
    forceFresh: false // Leverage zero-knowledge HMAC cache
  });

  const { lineType, carrier, isPorted, valid } = lookup;

  if (!valid) {
    return { allowSmsOtp: false, channel: "block", riskScore: 100 };
  }

  // Step 2: Evaluate risk matrix based on line type detection
  switch (lineType) {
    case "mobile":
      return {
        allowSmsOtp: true,
        channel: "sms",
        carrierName: carrier.name,
        lineType,
        riskScore: isPorted ? 15 : 0
      };

    case "voip":
      // Block SMS dispatch for disposable VoIP; route to WebAuthn / Passkey
      return {
        allowSmsOtp: false,
        channel: "passkey_fallback",
        carrierName: carrier.name,
        lineType,
        riskScore: 85
      };

    case "landline":
      // Landlines cannot receive SMS; offer voice call OTP
      return {
        allowSmsOtp: false,
        channel: "voice",
        carrierName: carrier.name,
        lineType,
        riskScore: 20
      };

    default:
      return { allowSmsOtp: false, channel: "block", riskScore: 90 };
  }
}

# Cost Economics: Unchecked vs. Carrier-Aware Dispatch

When sending 100,000 monthly verifications, line-type filtering and cached preflights radically transform infrastructure ROI:

:::

# Summary & Best Practices for Engineers

1. **Gate Every SMS Gateway**: Never invoke downstream SMS providers before validating line type via real-time carrier lookup.

2. **Handle MNP Gracefully**: Mobile numbers are frequently ported between carriers; ensure your lookup source reflects real-time portability registries rather than static prefix tables.

3. **Enforce Step-Up Authentication**: Rather than outright rejecting legitimate VoIP users (e.g., enterprise Google Voice users), downgrade them to email verification or biometric passkeys.

4. **Harness Zero-Knowledge Caching**: Maximize budget efficiency by reusing verified carrier intelligence within compliant 30-to-90-day time horizons.