Phone Number Risk Scoring: How It Works And How To Use It

Nearly all online journeys involve a phone number. It’s an identifier that customers sign up with, the channel that receives one-time passcodes and the key that unlocks a forgotten password. That makes it one of the first things a fraudster tries to control.

The figures show how often they succeed. Cifas recorded more than 78,000 account takeover cases in the UK in 2025, 18% of all filings to the National Fraud Database, with mobile phone products among the most targeted. Unauthorised SIM swaps rose by 38% over the same period.

Phone number risk scoring gives businesses a way to judge a number before they trust it. This guide explains what a risk score is, which signals go into it, how those signals become a single value and how to use that value in real decisions. It forms part of TMT ID’s complete guide to mobile number intelligence and draws on how TMT’s own Score product works.

What is a phone number risk score?

A phone number risk score is a single value that sums up how trustworthy a phone number is. It is based on what the mobile network and wider data sources reveal about the number: whether it is live, how long it has been in use, what has happened to it recently and whether it is linked to known fraud.

You will see the same idea called a phone fraud score, a reputation score or a credibility score. The labels differ mainly in direction. Some scores measure risk, so a high number means danger. Others measure credibility, so a high number means the phone number is more likely to be genuine. 

TMT offers both as Score expresses credibility from 0 to 100, while the Fraud Risk Score within TeleShield measures risk (so a higher score means greater danger). Whichever product is used, the job is the same, to turn a large set of signals into something a decision engine or an analyst can act on in seconds with confidence.

One thing to mention at this stage – the score describes the number, not the person. It shows whether a number behaves like one belonging to a real, established customer, not whether the person in front of you holds the phone.

The signals behind a risk score

Each signal on its own tells you something small. Together they build a clear picture. The main groups are:

Validity and live status. Is the number correctly formed under the international numbering plan, allocated to an operator and currently connected? A number that could not exist should never pass, and TMT’s Score returns 0 for any number that is not valid.

Tenure and activity. How long has the number been in use, and does it show the regular calls and messages of a real subscriber? Fraudsters favour disposable clean numbers: new numbers with no fraud history precisely because they have no history at all. Long, steady use is very hard to fake.

Recent change events. Porting to a new operator and swapping a SIM are ordinary events for genuine customers. A change in the days before a login from a new device or a high-value payment, however, is one of the strongest indicators of account takeover.

Line type. Whether a number is mobile, fixed or VoIP, and prepaid or contract, changes the level of risk. Virtual numbers can be created in bulk at almost no cost, which is why they appear so often in fake account creation.

Reputation and fraud history. Some numbers are already known through shared fraud lists, links to premium rate abuse or repeated reports of scam calls and smishing. TMT’s customers can contribute confirmed fraud numbers, which improves detection for everyone who uses the service.

Digital footprint. In some countries, whether a number is registered with business or social media platforms is a useful sign that a real person has built their online life around it.

Where each of these signals comes from, and how fresh it is, is covered in our guide to the data sources behind mobile number intelligence.

How signals become a score

Raw signals only become useful once they are weighed against each other. Two principles matter most.

The first is the difference between deterministic and probabilistic signals. Deterministic signals are facts from the network: the number is connected or it is not, the SIM changed on a given date or it did not. Probabilistic signals are patterns, such as traffic that looks automated or a number that has only just started to be used. Good scoring treats facts as facts and weighs patterns by how strongly they have predicted fraud in the past.

The second is context. A port on its own usually means a customer has moved provider for a better deal. A port followed by a SIM swap, on a number with little history, used to reset a password, tells a very different story. TMT’s Score is built on this principle. It looks at the significance of each data set on its own and alongside the others, then blends the result into one easy to digest value.

The algorithm also adjusts for regional differences, because normal behaviour for a prepaid number in one country can be unusual in another. It is refined continuously as new fraud patterns emerge. 

Score combines real-time network lookups with TMT’s own stored data, including its record of how often and when each number has been seen across billions of queries. Customers who wish to can share labelled outcome data with TMT to help improve the model further. [are we ready to add a link to allow people to request to upload data?]

Reading the score and setting thresholds

TMT’s Score runs from 0 to 100, from least to most credible. As a starting point, the bands below are a useful guide.

These bands are guidance rather than rules and can be customised based on the use case. The right threshold depends on what is at stake. A newsletter sign up can tolerate more risk than a loan application, and a loan application more than a large payment to a new payee. In practice, most businesses:

• test the score against historic data where the outcome is already known
• set different thresholds for different journeys
• send the middle band to extra checks rather than declining it outright
• review false positives and missed fraud regularly and adjust.

TMT’s product guidance suggests treating scores above 70 as a pass and referring lower scores for additional checks or declining them.

Recent change events deserve their own rules alongside the score. As a guide, TMT advises treating any number ported in the last 72 hours with extreme caution, automatically referring transactions on numbers ported within the last 24 hours, and requiring additional security checks where the SIM has changed in the last seven days.

Where risk scoring fits in the customer journey

Because a score needs only the phone number and runs in the background, customers never know the check has happened. Genuine customers get a faster journey, and friction is saved for the small minority who warrant it. The most common points to score a number are:

Onboarding. Scoring at sign up stops fake and synthetic accounts before they reach identity checks that cost money. Our article on mobile first risk scoring for BNPL platforms shows how this works in one of the most heavily targeted sectors.

Login and account recovery. Checking the score, and any recent SIM swap, before sending a passcode or allowing a password reset closes the route most takeovers rely on.

Payments and transactions. A change in a number’s risk between onboarding and a high value payment is a strong prompt to pause and verify.

What a risk score cannot tell you

A risk score is powerful, but it has limits, and knowing them leads to better decisions.

It does not prove possession. A high score says the number is established and genuine. It does not say that the person in front of you holds it. Pair scoring with a possession check such as a one time passcode or Authenticate, which confirms the device silently through the mobile network.

It does not confirm identity. Score does not match the number to a name or address. Verify checks those details against mobile operator records where a stronger link to identity is needed.

New does not mean fraudulent. Young people, people new to the country and anyone who has just changed number can all look thin. Treat a low score as a reason to add a step rather than an automatic decline. This is the same problem that shuts thin file customers out of traditional credit checks.

Coverage varies by country. Score works for numbers worldwide, but it is most accurate where there is more telecoms activity to draw on.

Risk scoring, privacy and regulation

Risk scoring fits comfortably with data protection principles because it needs so little data. A Score request requires only the phone number, with no name, address or date of birth. That supports data minimisation under UK GDPR and makes the check easier to justify in a data protection impact assessment.

It also helps regulated firms show a risk based approach. The Money Laundering Regulations 2017 expect firms to apply checks in proportion to risk, and a phone number score gives a consistent, documented input to that assessment. Score needs no consent from the end user, and TMT is certified to ISO/IEC 27001 for information security. 

Getting started with Score

TMT Score delivers the whole assessment through a single API call. Send a phone number in international format and receive a credibility score from 0 to 100. Fully enriched results typically return in around two seconds. Where speed matters most, such as screening sign ups at high volume, the TeleShield Fraud Risk Score returns in under 60 milliseconds.

Score sits within TMT’s wider family of mobile number intelligence products, alongside Live for real time network status, Authenticate for possession, Verify for identity matching and TeleShield for telephony fraud. You can find more detail in the Score FAQs.

To see how Score performs on your own traffic, talk to the TMT team.