Description

Phone checks evaluate the phone number a user presents during verification to determine whether it is consistent with a real, established identity. The goal is not simply to confirm that a number is well-formed, but to assess whether it is a durable, personally owned line - or a virtual, internet-based number that carries little assurance of identity.

Key indicators include:

• Virtual or VoIP numbers

Numbers issued by internet-based calling services rather than a traditional mobile or landline carrier, which are easy to acquire anonymously and discard.

---

Relevance to Social Engineering Attacks

In social engineering campaigns, attackers frequently use virtual or VoIP phone numbers so they can receive verification codes without tying the number to a traceable identity. Because these numbers can be acquired anonymously and discarded in minutes, they provide no meaningful assurance that the person behind them is who they claim to be.

Common attacker objectives include:

• Attribution avoidance - using virtual numbers that cannot be linked to prior activity.

• Bypassing phone-based verification - acquiring VoIP numbers specifically to receive one-time passcodes.

• Impersonation - presenting a number that appears legitimate while masking the attacker's true identity or location.

By identifying virtual and VoIP numbers, this check surfaces phone-based identities that are unlikely to belong to a genuine user.