What email and phone checks reveal at signup: disposable domains, missing mail servers, VoIP numbers and how to act without blocking real users.
The first two things almost every marketplace asks for are an email address and a phone number. They are usually checked for one thing only: can we send a code to it? Pass that, and the account exists.
Yet those two fields carry a surprising amount of risk information, available before the user has uploaded a document or listed anything. This post covers what email and phone checks can tell you, what they cannot, and how to use them without turning away good users.
Signup is the cheapest point to spot trouble. Fake and throwaway accounts are used for scam listings, review manipulation, promotion abuse and testing stolen cards. Catching some of them before they are created saves effort further down the line, in review queues, disputes and support.
Email and phone checks are fast, cause no friction for the user, and do not require any documents. That makes them a good first layer, not a final answer.
Is it well formed? Basic syntax validation catches typos and junk input.
Can the domain receive mail? A domain with no mail server records cannot receive email at all. That is either a typo or a made-up address.
Is it disposable? Temporary inbox services give anyone an address that works for minutes or hours. They have legitimate privacy uses, but a seller who intends to trade long term rarely needs one.
Is it a role address? Addresses like info@ or admin@ belong to a function, not a person. For a company seller this can be normal. For an individual it is unusual.
Has it appeared in data breaches? An address that appears in known breaches is not suspicious in itself. Most long-lived addresses have. But it tells you the address's credentials may have been exposed, which matters for account takeover risk.
Is it being used heavily right now? The same address appearing in many signups or checks in a short period is a strong signal of automation or abuse.
Is it a valid number? Validation against international numbering formats catches made-up or malformed numbers.
Which country is it from? The country code should make sense against the user's stated location, card and device.
What type of line is it? Mobile, fixed line, VoIP, 0800-style or premium rate. VoIP and virtual numbers are easy to obtain in bulk, which is why they are popular for fake accounts. They are also used by many legitimate businesses, so treat them as a risk factor, not a block.
They do not prove identity. A real, long-standing email address and a mobile number can belong to a fraudster as easily as anyone else. They also do not tell you that the person using them is the owner. For that you need identity verification, and for existing accounts, signals of account takeover. Our post on marketplace account takeover covers that side.
TrustVerify provides separate email and phone checks. See the email and phone guide.
Email (POST /api/v1/email/check, API reference) checks syntax, looks up mail server records, detects disposable domains, flags role addresses, can look up breach exposure where a breach data source is configured for your account (this sends the full email address to that source), and can measure how often the address has been seen recently. It returns a verdict of deliverable, undeliverable, risky or disposable, and a risk level from low to critical.
One detail is worth noting. If the mail server lookup itself fails, for example because of a DNS timeout, the result says so rather than marking the address undeliverable. A temporary lookup failure should not be held against a real user.
Phone (POST /api/v1/phone/check, API reference) validates the number format, works out the country and classifies the line type as mobile, VoIP, fixed, 0800-style, premium or unknown. VoIP and virtual ranges are flagged as medium risk. The phone check works from numbering-plan data rather than a live network lookup, so it does not confirm that the number is currently active.
Email and phone results work best as inputs to a decision, combined with other signals:
Score, do not gate. A disposable email on its own might mean asking for more verification later. A disposable email plus a VoIP number plus a new device plus a mismatched country is a different picture. TrustVerify's fraud score combines signals into an approve, review or block action.
Match the response to the risk. Ask for more verification before payouts or high-value listings, rather than blocking at signup.
Allow for legitimate exceptions. Businesses use role addresses and VoIP lines. Privacy-conscious users use alias addresses. Your rules should not punish them by default.
Treat unknown as unknown. If a check could not run, do not count it against the user.
Watch velocity. Repeated use of the same email or phone across accounts is often more telling than any single attribute. Our post on device fingerprinting and bot signals covers related device signals.
Review these rules against your own data after a few weeks and adjust.
Email and phone checks process personal data, so tell users about them in your privacy notice. Be clear if any check sends data to a third party, such as a breach lookup service. Keep the results only as long as they are useful for the decision they support. [Planned URL, live on publication.]
If you only remember a few points from this post, make them these:
None of these points requires a large team or a long project. Most can be put in place in a few weeks, and each one makes the next decision easier to explain.
See what TrustVerify's email and phone checks return. Explore email and phone checks.
KYC, KYB, AML screening and fraud prevention in one place, with published pricing.
Fraud Prevention
Device Fingerprinting and Bot Signals on UK Marketplaces
What device fingerprinting and bot signals can tell a UK marketplace about fake sellers and scripted signups, and how to use them without overreacting.
Fraud Prevention
Designing a Fraud Review Queue That Does Not Become a Backlog
How to design a manual review queue for marketplace fraud and verification: what to route, how to prioritise, what reviewers need and how to keep it small.
Fraud Prevention
Account Takeover on Marketplaces: How It Happens and What to Check
How account takeover hits UK marketplaces, from credential stuffing to payout changes, and the signals and controls that catch it early.
