Should You Block VoIP Numbers at Signup?

Usually not. Blocking every VoIP number at signup removes real users along with the abusers. Block on combined signals instead: a non-fixed VoIP number that also has disposable history. Step up non-fixed VoIP on its own, and allow fixed VoIP. Trueguard's phone validation API returns line.voipType and risk.isDisposable, the two fields that rule needs.

"VoIP" covers two very different kinds of number. One is a line tied to a physical device at an address. The other is a number anyone can claim online. A signup rule that treats them as one category is either too loose for the second or too harsh for the first. The fix is to read the line type, the VoIP type and the number's history together.

What is the difference between fixed and non-fixed VoIP?

The split comes from US 911 law. The FCC's rules require that "Providers of fixed interconnected VoIP services must provide automated dispatchable location with each 911 call." Non-fixed interconnected VoIP can be used from multiple locations, and its providers must send that location only "if technically feasible."

A fixed VoIP number is tied to a place. A non-fixed number is tied to an account. Twilio's line-type documentation describes the two this way:

• Fixed VoIP: "A virtual phone number associated with a physical device. For example, Comcast or Vonage."
• Non-fixed VoIP: "A virtual phone number obtained online without requiring a physical device. For example, Google Voice or Enflick."

Enflick is the company behind TextNow. For a signup form, the non-fixed category is the one to watch, because it needs no device and no address.

Why do fraud teams flag non-fixed VoIP?

Because the abuse is documented. In a 10-month study of phone-verified account abuse, presented at ACM CCS 2014, Thomas et al. at Google bought 4,695 Google phone-verified accounts and sampled 300,000 more. Their finding: "We find that miscreants rampantly abuse free VOIP services to circumvent the intended cost of acquiring phone numbers." Google responded by penalizing the carriers that abusers used most.

That study is from 2014 and covers Google only. No current, cross-industry share of fraud on VoIP numbers has been published with a method behind it.

Large services have acted on the pattern anyway. In December 2022, Twitter stopped accepting Google Voice numbers for SMS two-factor authentication. The company did not announce the change. Users saw the error "We cannot currently register this phone number."

The appeal for an abuser is simple. A non-fixed number can receive the text code, and a free one is easy to replace. A phone-gated free tier assumes each number costs its owner something. Free non-fixed VoIP removes that cost.

Who do you lose when you block all VoIP?

You lose people whose real, long-held number happens to be VoIP. Public complaints about blanket blocks are easy to find. In an Ask HN thread from August 2025, one user wrote: "I've noticed that more and more companies refuse to accept Google Voice numbers when creating accounts." Another, in 2023: "My primary phone number is a Google Voice number, and I am entirely legitimate."

US citizens living abroad

Personal Google Voice is a US product, according to Google's own help pages. In the same Ask HN thread, one commenter wrote: "Those of us who are U.S. citizens who live outside of the U.S. suffer a LOT because growing disallowances like these."

Privacy users with a secondary number

Mainstream privacy advice recommends exactly this setup. The Markup suggested a Google Voice number as a secondary number in January 2024: "If you get spammed, doxxed, or harassed, you can relinquish the Google Voice number and get a new one." A blanket block treats that reader as an abuser.

MVNO customers

A cruder version of the VoIP block catches people on smaller mobile networks. Some services reject anything that looks prepaid or is not on a major carrier. One commenter described the result: "if you have a cheap MVNO like Mintsim and that too is blocked as a "prepaid"". An MVNO line is a mobile line. A rule should read the line type and the carrier type as separate facts.

People who ported their main mobile number into Google Voice

Google Voice lets US users port in an existing mobile number. Google charges a $20 fee, the request needs an active US mobile number, and "Not all mobile numbers can be ported into Google Voice." After the port, the number the person has used for years is served by Google Voice. A line-type lookup now reports a non-fixed VoIP number, even though the owner and the history are unchanged.

Businesses on fixed VoIP lines

Fixed VoIP numbers, such as Twilio's Comcast and Vonage examples, are tied to a physical device. Under the FCC's 911 rules their providers must send a dispatchable location with every 911 call. A B2B product that blocks all VoIP rejects these lines along with Google Voice.

What rule should you use instead?

Grade the response by signal combination. Block only when two risk signals agree, step up when one is present, and allow the rest. The table below uses Trueguard's field names.

Step up means you still send the code and add friction around it. Check the email address as well, rate limit signups per number, or delay free credits until the account shows normal use. A real Google Voice user clears those steps once. A farm of throwaway numbers has to clear them for every account.

Indeed's published policy is a real-world example of a graded rule. Indeed "no longer allows non-fixed VoIP numbers for account verification," and a VoIP number it accepts "must be fixed, which means it's linked to a physical address." That policy still rejects every non-fixed number. The table above goes one step further and blocks only non-fixed numbers with disposable history.

If the cost you are fighting is the SMS bill itself, the destination country matters as much as the line type. risk.smsDestinationRisk rates 23 countries at country level, and the SMS pumping prevention guide covers that side.

Check a number before you send the code. The free VoIP number checker runs 5 checks a day in the browser with no account. A free API key for Trueguard's phone validation API covers 100 checks a month. No credit card required.

How Trueguard handles this

Trueguard flags VoIP and leaves the block to you. A VoIP line type never changes risk.status on its own. Only a disposable number or a premium-rate line makes a valid number risky. The decision to allow, step up or block stays in your code.

The phone validation API returns a line object and a risk object. line.type gives mobile, landline, voip, tollFree, premiumRate and other types. line.voipType is fixed, nonFixed or unknown, and null when the line is not VoIP. line.carrierType is a separate field with the values mno, mvno, cpaasVirtual, fixedIsp, m2m, satellite and unknown, so an MVNO is reported as its own carrier type. For US numbers, line.currentCarrier and line.isPorted show a number that has moved carrier, as a ported-in Google Voice number has. The carrier lookup tool shows the carrier fields for a single number.

risk.isDisposable is true when Trueguard saw the number on a public receive-SMS site in the last 30 days. risk.previouslyDisposable covers 31 to 180 days ago. Trueguard monitors those sites itself.

Here is the line and risk part of the real response for +14159929960. The number is non-fixed VoIP, ported from Lumen to Twilio, and its status is still safe:

{
  "line": {
    "type": "voip",
    "voipType": "nonFixed",
    "smsCapable": true,
    "carrierType": "cpaasVirtual",
    "originalCarrier": "Lumen",
    "currentCarrier": "Twilio",
    "isPorted": true
  },
  "risk": {
    "status": "safe",
    "isDisposable": false,
    "previouslyDisposable": false,
    "smsDestinationRisk": null
  }
}

The rule from the table, in a few lines of JavaScript:

const decideSignup = ({ line, risk }) => {
  if (risk.status === "invalid") {
    return "reject";
  }
  const nonFixed = line.type === "voip" && line.voipType === "nonFixed";
  if (risk.status === "risky" || (nonFixed && risk.previouslyDisposable)) {
    return "block";
  }
  if (nonFixed || line.voipType === "unknown" || risk.status === "unknown") {
    return "stepUp";
  }
  return "allow";
};

A non-fixed number with risk.isDisposable true already arrives as risky, so the first block condition covers it. The phone check is a standalone endpoint. For the step-up path, use the phone and email endpoints together. Trueguard does not sell SMS. The check runs before you call your SMS provider. Request details are in the phone validation API docs, and the phone validation page has the full picture. A free key covers 100 checks a month, and Standard is $49.99 a month for 20,000 checks, then $0.0025 a check.

Stop paying to text throwaway numbers. Run a number through the free VoIP number checker, or get a free API key for Trueguard's phone validation API with 100 checks a month. No credit card required.