How to Verify Phone Numbers and Stop Fake Leads Reaching Your CRM

Every business with a web form eventually meets the junk. “Asdf asdf” with phone number 111-111-1111. Twenty sign-ups in two minutes from the same range of numbers. A competitor’s intern submitting fake quote requests. Each one creates a contact, triggers a follow-up, and maybe sends a text you pay for.

Phone number verification is one of the more reliable ways to separate real people from noise. It checks that a number exists, what kind of line it is, and, in its strongest form, that the person filling out the form actually holds that phone. This guide explains the options, where to use each, and how to avoid adding friction for genuine leads.

What fake leads actually cost

It’s tempting to treat spam submissions as a minor annoyance. Add up the knock-on effects and the picture changes:

• Wasted sales time. Reps call dead numbers and chase people who never existed.
• Polluted reporting. Lead counts look healthy while conversion rates look terrible, and nobody trusts the numbers.
• Automation misfires. Every fake contact can enter a nurture sequence, send texts and create tasks.
• Messaging costs and risk. Texts to invalid numbers still cost money, and a spike of failed sends can hurt your sender reputation.
• SMS pumping fraud. Bots submit forms that trigger outbound texts to premium or international numbers, and someone else profits from the traffic you pay for.

That last one surprises many small businesses. If your form sends a code or a confirmation text to any number entered, it can be abused at scale.

Three levels of phone verification

Verification isn’t one thing. Think of it as a ladder, from lightweight checks to proof of possession.

Level 1: Format validation

The form checks that the number has the right number of digits for its country and isn’t obviously fake, like repeated digits. This catches typos and lazy spam. It’s free, instant and invisible to the user, but it can’t tell a real number from a made-up one that happens to be formatted correctly.

Level 2: Carrier and line-type lookup

A lookup service queries carrier data to confirm the number is assigned and whether it’s mobile, landline or VoIP. Twilio’s Lookup API is a common example. This tells you:

• Whether the number can receive texts (mobiles can, most landlines can’t)
• Whether it’s a VoIP number, which some businesses treat with extra caution
• Sometimes the carrier name and country

Lookups cost a small amount per query, so run them once per number and cache the result.

Level 3: One-time passcode (OTP)

The user receives a short code by text or automated voice call and types it into the form. Only then is the submission accepted. This proves the person has the phone in hand right now. Twilio Verify and similar services handle the code generation, delivery and expiry for you.

Comparing the options

Method	Stops typos	Stops made-up numbers	Proves ownership	Friction for user
Format validation	Yes	Partly	No	None
Line-type lookup	Yes	Mostly	No	None
One-time passcode	Yes	Yes	Yes	Moderate

Choosing the right level for each form

Not every form deserves an OTP step. Match the strength to the risk and value.

• Newsletter or content download: Format validation, maybe a lookup. Friction here costs more than the occasional fake.
• Quote or consultation request: Line-type lookup, so you know whether to call or text first.
• Account creation, free trials, giveaways: OTP. These attract bots and people gaming promotions.
• Anything that sends a text immediately: Strong protection, because the form itself can be turned into a texting cannon.

An invented roofing company, Redbird Roofing in Tulsa, found this balance after a spam wave. Its free-inspection form now runs a silent line-type lookup. Mobiles get an instant text-back; landlines go to a call task. A separate storm-damage giveaway uses an OTP, because that’s where the fake entries were concentrated.

Protecting against SMS pumping and bot abuse

If any form sends a text, add these safeguards:

1. Rate limit by IP and by number. Cap how many codes one visitor or one number can request per hour.
2. Restrict destination countries. If you only serve US customers, block international SMS in your provider settings.
3. Add a bot check before sending. A CAPTCHA or invisible challenge before the code goes out stops most automated abuse.
4. Watch for patterns. Many requests to sequential numbers, or from one country you don’t serve, are a red flag.
5. Set spending alerts with your messaging provider so a spike doesn’t go unnoticed overnight.

Keeping the CRM clean after capture

Verification at the form is the first gate. A few habits keep the database healthy afterwards:

• Store the verification result as a field: verified, line type, date checked.
• Deduplicate on phone number so a real person who submits twice doesn’t become two contacts.
• Route by line type. Send texts only to mobile numbers; queue calls for landlines.
• Scan older contacts once. Legacy lists often contain dead and landline numbers that silently fail every text campaign.

SaaSVisionary can label numbers by line type through your own Twilio account, check new numbers automatically and run a one-time scan of existing contacts. Results are cached so each number is looked up once. That fits naturally with lead forms and a custom CRM setup where fields like “line type” drive routing. For outbound prospecting lists, the same check helps on the find leads side before you dial or text.

Verification checklist

• Every form validates phone format for the countries you serve
• High-value or high-risk forms run a line-type lookup
• Trial, giveaway and account forms use a one-time passcode
• Rate limits and a bot check sit in front of any form that sends a text
• International SMS is blocked unless you need it
• Verification result and line type are stored on the contact
• Duplicate contacts merge on phone number
• Provider spending alerts are switched on

A note on privacy and consent

Verifying a number is not the same as having permission to market to it. An OTP proves ownership; it doesn’t grant consent to promotional texts. Keep your consent checkbox separate and clear, and store when and how consent was given. Lookups also process personal data, so mention them in your privacy policy, especially if you serve people in the EU where GDPR applies. This is general information, not legal advice.

Frequently asked questions

Does phone verification hurt form conversion rates?

Silent checks like format validation and line-type lookups add no visible friction, so they rarely affect conversion. One-time passcodes add a step and can reduce completions somewhat, which is why they fit best on forms with real abuse or high value, such as free trials and giveaways, rather than every contact form.

What is SMS pumping fraud?

SMS pumping happens when bots use your forms to trigger texts to numbers controlled by fraudsters, often premium or international ranges. The fraudster earns a share of the messaging fees you pay. Rate limits, bot checks, country restrictions and spending alerts are the main defenses for any form that sends texts automatically.

Should I block VoIP numbers on my forms?

Usually not outright. Many real customers and small businesses use VoIP lines legitimately. VoIP numbers are also easy for fraudsters to obtain, so some companies require an OTP for VoIP numbers or flag them for review instead of blocking. Choose based on how much abuse you actually see.

Is a line-type lookup the same as verifying a number?

Not quite. A lookup confirms that a number is assigned and tells you whether it is mobile, landline or VoIP. It does not prove the person filling out the form owns that phone. Only a one-time passcode sent to the number and entered back confirms possession.

Want cleaner leads from day one? Start a free 14-day trial.