Number Risk Score response attributes
This page describes every field in the Number Risk Score API response in more detail than the API reference. Use it to understand what each attribute means, the values it can return, and how to interpret it in your fraud logic.
For prerequisites, input parameters, and how to act on the risk level, see Get started with Number Risk Score.
Request and response structure
You submit a phone number to the API and receive a single response object that contains all the fields described on this page.
| Field | Description | Possible values or example |
|---|---|---|
phoneNumber | The phone number submitted for risk scoring. This is the request input, not a field returned in the response. | E.164 format without the + prefix. Example: 639050387416 |
response | The full API response for the submitted number. Contains all the fields described in the sections below. | See the following sections |
Top-level fields
These fields describe the request outcome and the overall risk assessment for the phone number.
| Field | Description | Possible values or example |
|---|---|---|
status | Indicates whether the API call was processed successfully and whether data is available for the number. | OK (data returned), NO_DATA (number was not found in Infobip's platform data) |
riskLevel | Overall risk assessment for the phone number. This is a composite score calculated by Infobip from all the signals below. It applies uniformly across all clients and is not configurable per client in the current Early Access version. | LOW, MEDIUM, HIGH, UNKNOWN |
requestId | Unique identifier for this API request. Use it for traceability and support queries. | "1774880861348563482" |
Carrier information
The carrierInfo object describes the network, country, ported status, and line type associated with the number.
| Field | Description | Possible values or example |
|---|---|---|
originalNetwork.networkName | Name of the mobile network the number was originally assigned to. | "Globe Telecom" |
originalNetwork.networkPrefix | Network prefix, the digits immediately following the country code. | "905" |
originalNetwork.countryName | Country where the number is registered. | "Philippines" |
originalNetwork.countryPrefix | International dialing code for the country. | "63" |
ported | Whether the number has been ported to a different network from its original carrier. | true / false |
portedNetwork.networkName | Name of the network the number was ported to. Present only when ported is true. | "Tomato" |
portedNetwork.networkPrefix | Network prefix of the ported network. Present only when ported is true. | "92" |
portedNetwork.countryName | Country of the ported network. Present only when ported is true. | "Croatia" |
portedNetwork.countryPrefix | International dialing code of the ported network. Present only when ported is true. | "385" |
lineType | Type of phone line associated with the number. VoIP and shared line types often carry higher fraud risk than standard mobile lines. | FIXED_LINE, MOBILE, FIXED_LINE_OR_MOBILE, PAGER, TOLL_FREE, PREMIUM_RATE, SHARED_COST, PERSONAL_NUMBER, VOIP, UAN, VOICEMAIL, UNKNOWN |
Number age
The tenure object shows how long the number has been observed on the Infobip platform. A number seen for the first time, or with no history, is a stronger risk signal than an established number.
| Field | Description | Possible values or example |
|---|---|---|
firstSeen | Date when this phone number was first observed in Infobip's traffic logs, across all channels. Returns null if the number has never been observed. | "2025-12-02" |
lastSeen | Date when this phone number was last seen in Infobip's traffic logs, across all channels. Returns null if the number has never been observed. | "2026-03-24" |
Number velocity
The numberVelocity object reports the traffic volume this specific phone number received, with a separate risk level for each time window. Each risk level is relative to typical phone number behavior in that country.
| Field | Description | Possible values or example |
|---|---|---|
last24Hours.count | Number of messages received by this phone number in the last 24 hours, across the Infobip platform. | 0 |
last24Hours.riskLevel | Risk assessment for 24-hour number velocity, based on phone number behavior in that country. | LOW, MEDIUM, HIGH |
last90Days.count | Total messages received by this phone number in the last 90 days. | 61 |
last90Days.riskLevel | Risk assessment for 90-day number velocity, based on phone number behavior in that country. | LOW, MEDIUM, HIGH |
Range velocity
The rangeVelocity object reports the traffic volume received by the number's 1K range. The 1K range is the block of 1,000 consecutive numbers the queried number belongs to. For example, the range of 5512345678 is 5512345, covering numbers 5512345000 to 5512345999. High range velocity can reveal coordinated attacks across a block of numbers even when a single number looks normal.
| Field | Description | Possible values or example |
|---|---|---|
last24Hours.count | Messages received by the 1K range in the last 24 hours. | 8 |
last24Hours.riskLevel | Risk assessment for 24-hour range velocity, based on phone number range behavior in that country. | LOW, MEDIUM, HIGH |
last90Days.count | Total messages received by the range in the last 90 days. | 683 |
last90Days.riskLevel | Risk assessment for 90-day range velocity, based on phone number range behavior in that country. | LOW, MEDIUM, HIGH |
Trust and behavior signals
These top-level signals adjust the overall risk in opposite directions: a trusted interaction lowers risk, while bot-like behavior raises it.
| Field | Description | Possible values or example |
|---|---|---|
trustedInteraction | Whether this number has previously received messages from trusted senders, such as banks, telecoms, or government entities. A true value is a positive trust signal and reduces overall risk. | true / false |
botLikeBehavior | A behavioral signal that reflects whether the phone number has previously shown patterns consistent with automated or bot-driven activity, such as receiving high volumes of OTP messages in short, repetitive bursts typical of Artificially Inflated Traffic (AIT) fraud. | true (bot signal detected), false (no bot signal detected), null (no assessment available) |
Behavior and edge cases
Keep the following in mind when you interpret the response:
- Consent required. Every lookup requires explicit end-user consent, collected by you before the API call. See Data and privacy.
- Data window. Velocity analysis covers only the last 90 days. Other attributes, such as tenure, remain available for as long as the phone number has activity within that 90-day window. All data is derived from Infobip traffic, across all channels.
- Data expiry. After 90 days with no interaction, data is no longer available, because the mobile network operator might recycle the number after that period. This applies only if the phone number was not active at all for 90 days.
- Platform scope. The
riskLevelis a composite score calculated by Infobip. Client-side configuration of risk thresholds is not available in the current Early Access version.
If all data contributors for a given number have opted out of data sharing, the risk scores return null. This is expected behavior, not an error. Treat missing or null values as meaningful signals in your fraud logic.
Get started with Number Risk Score
Review API requirements, availability, and input and output parameters before you integrate.
Data and privacy
Review consent wording and data retention policies before you go live.