efore sending a one-time passcode, run one lookup on the number: normalise it, check its line type and carrier, and, if you offer more than SMS, check which of your channels it can receive. Send by default when the answer is mobile or unknown, stop or offer voice when it is fixed-line or toll-free, and add friction when the pattern looks risky. With MobileValidate, a BroadNet brand in private preview, the check is one API request, and the code then goes out through BroadNet's OTP API or MyOTP.App with fallback between channels.
Key takeaways
- A pre-send check costs one lookup and can save a message that could never arrive, or one that feeds a fraud pattern.
- Line type is the most useful single signal: mobile goes ahead, fixed-line, toll-free and premium-rate stop, VoIP gets a closer look.
- Unknown is not a failure: send the code with your normal rate limits. MobileValidate does not charge for unknown answers.
- A short wait keeps sign-up fast: set the lookup wait to a few seconds and treat anything still pending as unknown.
- Channel checks (for example Telegram) help choose where to send the code for customers who opted in to that channel.
- The check supports your fraud defences; it does not replace rate limits, monitoring or fallback.
What should you check before sending an OTP?
| Check | What it tells you | Source |
|---|---|---|
| Format and validity | Whether the input is a valid number, normalised to E.164, or a duplicate | MobileValidate number_status (valid, invalid_number, duplicate) |
| Line type | Mobile, fixed line, VoIP, toll-free, premium rate and others | MobileValidate carrier lookup (beta) |
| Carrier | The current network and, for a ported number, the original one | MobileValidate carrier lookup (beta) |
| Channel registration | Whether the number is registered on an app you send codes on, such as Telegram | MobileValidate messaging-app checks |
| Live network status | Whether the line is reachable on its home network now | BroadNet HLR Lookup |
MobileValidate's carrier lookup explains why line type matters: a fixed-line, toll-free, premium-rate, shared-cost or UAN number "usually" means SMS will fail or cost money for nothing, and a burst of sign-ups from VoIP numbers or a single small carrier is a common pattern in fake account creation and SMS pumping.
How does the routine work, step by step?
- When the user enters a number, before they press "Send code", call POST /v1/lookup with the number and the checks you need, for example carrier plus the app channels you send codes on.
- Set wait to a few seconds. The API waits up to 10 seconds by default (30 at most) and returns 202 with pending checks when it runs out of time; treat pending as unknown.
- Apply the decision table below to the result.
- Send the code through the BroadNet OTP API or MyOTP.App on the chosen channel, with fallback between channels.
- Log the lookup result with the verification attempt so you can review outcomes later.
curl https://api.mobilevalidate.com/v1/lookup \ -H "Authorization: Bearer $MOBILEVALIDATE_API_KEY" \ -H "Content-Type: application/json" \ -d '{"numbers": ["+447700900001"], "checks": ["carrier", "telegram"], "wait": 3}'Each check in the response has registered (true, false or null for unknown), status, a confidence level and checked_at; the carrier check puts line_type, carrier and country in attributes. The number +447700900001 is a MobileValidate test number: test keys answer it with fixed data and are never billed. See real-time lookups for the full response.
What do you do with each result?
| Result | Suggested action |
|---|---|
| line_type mobile | Send the code on the user's chosen channel |
| line_type fixed_line, toll_free, premium_rate, shared_cost or uan | Do not send an SMS; offer a voice code where you support it, or ask for a mobile number |
| line_type voip | Apply your risk policy: extra verification, a lower attempt limit or manual review |
| number_status invalid_number | Ask the user to correct the number; nothing is sent or billed |
| Carrier check unknown or pending | Send the code with your normal rate limits |
| Registered on Telegram and the user chose Telegram | Send through MyOTP.App's Telegram channel, with SMS as fallback |
| Many new sign-ups on one small carrier or number range | Throttle that range and review; see SMS pumping defences |
Keep the rules in your own policy engine so you can tune them; the lookup supplies signals, not verdicts. A VoIP number can belong to a real customer, so step-up verification is usually better than a hard block.
Does a lookup slow down sign-up?
Only as long as you let it. Run the lookup while the user is still on the phone-number field, cap it with the wait parameter, and treat a pending answer as unknown so the code is never held back. MobileValidate caches answers per account within each service's freshness window, and a cached answer is free, so a user who asks for a second code does not trigger a second billed check.
Put the lookup in front of the send, not in front of the whole sign-up form: if the lookup service is unreachable, fall through to sending the code with your normal limits.
How does it fit with SMS pumping and fraud defences?
SMS pumping (artificially inflated traffic) abuses OTP forms to send messages to numbers that earn the attacker a share of the fee. A pre-send line-type and carrier check removes numbers that should never receive an SMS and makes clusters visible, but it is one layer. Keep rate limits per number, IP address and device, cap attempts per session, monitor destination mixes and set spend alerts. Our guide to SMS pumping and AIT fraud covers the other layers, and what SMS pumping is explains the scheme in short.
MobileValidate does not offer SIM-swap checks. For account-takeover risk on high-value actions, BroadNet covers operator network APIs in SIM swap and Number Verify in the Middle East.
How do you pick the OTP channel?
Offer the channels your users trust and record their choice. MyOTP.App sends codes by SMS, WhatsApp or Telegram from one account with automatic fallback, and the BroadNet OTP API falls back across SMS, WhatsApp, voice and Flash Call. A Telegram registration check helps you show the Telegram option only to users who can receive it; SMS remains the fallback that reaches any mobile number. For a deeper comparison of channels, read our multichannel OTP verification guide.
What does the check cost, and is it lawful?
MobileValidate charges per check and only for conclusive answers: unknown, unsupported country, timeout, invalid and duplicate results are free, as are cache hits and test keys. Current prices, which may change during the private preview, are on the pricing page. Check only what you act on: every extra check on a number can be billed separately.
Screening a number the user just gave you in order to send them a code is fraud prevention, which MobileValidate's acceptable-use policy allows. Under the GDPR, Recital 47 says that "the processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned". Other laws differ, so confirm your legal basis for each market; this is general information, not legal advice.
Frequently asked questions
Why check a number before sending an OTP?
To avoid paying for codes that cannot arrive, such as to fixed-line or toll-free numbers, to spot patterns linked to fake sign-ups and SMS pumping, and to choose a channel the user can receive.
Which check matters most?
Line type. A mobile number can receive the code; fixed-line, toll-free and premium-rate numbers usually cannot receive SMS; VoIP numbers deserve a closer look.
What if the lookup returns unknown?
Send the code with your normal rate limits. Unknown answers are not charged by MobileValidate, and blocking on unknown would hurt real users.
Will the lookup slow down sign-up?
It does not have to. Run it when the number is entered, cap it with the wait parameter and treat pending answers as unknown.
Should I block VoIP numbers?
Usually not outright. Use VoIP as a risk signal for extra verification, a lower attempt limit or manual review.
Does MobileValidate check for SIM swaps?
No. MobileValidate states that it does not offer a SIM-swap check; operator network APIs cover that.
Does the check send anything to the user?
No. A MobileValidate check never sends a message, call or e-mail to the number.
Which BroadNet products send the code?
The BroadNet OTP API, with fallback across SMS, WhatsApp, voice and Flash Call, and MyOTP.App, which sends by SMS, WhatsApp or Telegram from one account.
We read every source below on 27 September 2026. See our editorial standards.
Sources
- MobileValidate — real-time lookups (request fields, wait, results, caching), last updated 25 September 2026: mobilevalidate.com/docs/lookups.
- MobileValidate — carrier and line type lookup, last updated 25 September 2026: mobilevalidate.com/services/carrier-lookup.
- MobileValidate — OTP and sign-up fraud prevention use case, accessed 27 September 2026: mobilevalidate.com/use-cases/otp-and-signup-fraud.
- MobileValidate — facts (what it does not offer, billing), accessed 27 September 2026: mobilevalidate.com/facts.
- MobileValidate — acceptable-use policy, accessed 27 September 2026: mobilevalidate.com/legal/acceptable-use.
- GDPR Recital 47 (legitimate interests; fraud prevention), accessed 27 September 2026: gdpr-info.eu.