Phone Number: Data Point Intelligence Guide

A phone number is a globally routable identifier attached to a real contract and, increasingly, to every account a person owns. It also lies about its origin more convincingly than almost any other artifact.

Understanding the Phone Number as an intelligence artifact

A phone number in E.164 form is a country code, a national destination code and a subscriber number, up to fifteen digits, written with a leading plus. The numbering plan is administered by the ITU and delegated to national regulators who allocate ranges to operators. The allocation defines the original network and, for fixed lines, a geographic area. Beyond voice and SMS, the number now functions as an account identifier and second authentication factor across banking, messaging and social platforms.

Analytically, the crucial distinctions are line type and portability. Mobile, fixed, VoIP, toll-free, premium rate and machine-to-machine ranges behave differently and carry different subscriber verification requirements. Number portability means the operator that holds the allocation is frequently not the operator serving the number, so only an HLR or number portability lookup reveals the current network. Caller identity presented on an inbound call is unauthenticated by default and easily spoofed.

Why it matters

A phone number links a subject to a contract, an operator and a jurisdiction, and it identifies which legal process reaches the subscriber data. It is also a powerful account pivot: messaging platforms expose profile photos and display names to anyone who has the number, and password recovery flows reveal masked digits that confirm or exclude a candidate number. In fraud work, line type and carrier are direct risk features, since VoIP and recently ported numbers correlate strongly with account takeover.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Country and national area allocation, identifying the jurisdiction and, for fixed lines, an approximate geographic region.
• Line type classification separating mobile, fixed, VoIP and virtual numbers, which is a primary fraud risk feature.
• Original allocated operator from the numbering plan, giving the range holder for the block containing the number.
• Current serving network from a portability or HLR lookup, which frequently differs from the allocation holder after porting.
• Roaming status and network country from HLR responses, indicating whether the handset is operating outside its home network.
• Presence on messaging platforms with an associated display name or profile photo, confirming active use of the number.
• Masked digits revealed in account recovery interfaces, which can confirm or exclude a candidate number without contacting the subject.
• Appearance in breach corpora, business listings, classified adverts or registration records, tying the number to an identity or business.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• Google libphonenumber — Offline parsing, validation, formatting and line-type inference for any international number without querying a third party.
• ITU national numbering plan publications — Authoritative country code and range allocation data identifying the operator holding a number block.
• National regulator numbering databases, for example Ofcom or FCC listings — Range allocation and operator assignment records published by the relevant telecom regulator.
• HLR and number portability lookup providers — Current serving network, portability status, roaming country and line reachability, subject to commercial terms.
• Have I Been Pwned and breach index services — Whether the number appeared in a known breach, giving service registration history.
• Business registries and public directory listings — Numbers published in company filings, adverts and directories, linking to an organisation rather than a private individual.
• Truecaller-style crowdsourced spam databases — Community-reported spam and scam classification for numbers used in mass campaigns.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Establish authority — Confirm the lawful basis for processing a subscriber number, and where subscriber identity is required, plan for legal process rather than open-source inference.
2. Parse and validate — Normalise to E.164, validate the length and prefix against the national numbering plan, and reject malformed or non-allocated numbers early.
3. Classify the line — Determine line type and allocated operator, flagging VoIP and virtual ranges which carry different attribution and evidential value.
4. Check portability — Resolve the current serving network, since the correct operator for legal process is the serving network and not the range holder.
5. Search open records — Look for the number in business filings, adverts, breach indexes and public listings, preferring published business use over private exposure.
6. Check account linkage passively — Where permitted, use masked recovery digits and platform presence to confirm or exclude a candidate, avoiding any contact with the subject.
7. Preserve and escalate — Document each observation with source and time, and route subscriber identification through the proper legal channel for the serving operator.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Human Intelligence — Information from People, Ethically Obtained
• Financial Intelligence — Following Value Through the Financial System
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Geospatial Intelligence — Intelligence Derived from Place
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Identity Intelligence — Resolving and Verifying Who Someone Is
• Telephony Intelligence — Phone Numbers, Networks, and Telephony Data

Investigated in these domains

• Organized Crime
• Human Trafficking
• Gangs & Street Crime
• Kidnap, Hostage & Extortion
• Fraud & Identity
• Counter-Terrorism
• Transnational Repression

Pivots to these data points

• Person / Name — A named individual — the subject of identity resolution and profiling.
• Email Address — Electronic mail address tied to an individual or organization.
• Username / Handle — Screen name or handle used across online platforms and services.
• Physical Address — A physical or mailing address tied to a person, company, or registered entity.
• Social Profile — A social media profile or online account page tied to a persona or identity.
• Device / Advertising ID — A mobile advertising or device identifier used in adtech data to track and locate devices.

Inside the platform: where Phone Number lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• phone-profile.php — Phone Number profile
• datapoint.php?dp=dp_phone — Data point hub
• domain.php?d=org — Organized Crime dashboard
• human-trafficking.php — Human Trafficking dashboard
• domain.php?d=gangs — Gangs & Street Crime dashboard
• domain.php?d=kidnap — Kidnap, Hostage & Extortion dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Establish authority is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Classify the line turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Preserve and escalate feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Phone Number

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Numbers matter to defence for personnel security, force protection and counter fraud rather than for tracking individuals. Legitimate uses include validating that a claimed contact number matches an allocated range and operator, detecting smishing campaigns against personnel, and assessing whether staff numbers appear in breach corpora. Operational security guidance to personnel about number reuse across personal and professional accounts is a routine and valuable output. Location of a handset is a collection activity requiring specific national authority and is never derived from open sources. Report allocation and line type, and treat any subscriber identification as requiring lawful process through the serving operator.

🕵 National intelligence

A number identifies a contract, an operator and a jurisdiction, which is what determines the collection and legal routes available. Analytically it supports network mapping where numbers appear in seized devices, procurement records or lawfully obtained material, and it identifies which operator holds subscriber and connection records. Portability means the allocation holder is frequently not the serving operator, and that distinction determines who the request goes to. Handling is sensitive because the artifact identifies a person directly. Never use account recovery flows or messaging platform probes that would notify the subscriber, since that is interference rather than collection.

👮 Law enforcement

For law enforcement the number is the primary route to subscriber and communications data, all of which requires production orders, warrants or mutual assistance depending on category. The essential first step is a portability lookup, because serving a request on the range holder rather than the current operator wastes weeks. Preservation requests should precede production because retention periods are short. Evidentially, presented caller identity is unauthenticated and trivially spoofed, so a number appearing in a call log is not proof of who called. Charging requires the operator records, device evidence and payment or registration data tying the contract to a defendant.

🔍 Private investigation and corporate security

Corporate investigators use numbers for fraud triage, verification of counterparties and business due diligence, working with line type and allocation data that is lawfully obtainable. Line type is a legitimate and effective fraud feature, since virtual and recently ported numbers correlate with account takeover. What a private actor may not do is obtain subscriber details, use pretext to extract them from an operator, purchase location data, or use messaging platform lookups and recovery flows to profile an individual. Deliverables should present allocation, line type and portability findings and route any identity requirement to counsel for lawful process.

📰 Journalism and OSINT media

Numbers appear in reporting as verification tools and as evidence of infrastructure, such as ranges used in fraud or spyware campaigns. Verification means establishing the allocation and operator from published numbering plans, recognising that portability may have moved it, and understanding that a displayed caller identity proves nothing. Contacting a subject on a number is normal journalistic practice; enumerating a private individual's accounts through their number is not. Never publish a private individual's number, and be aware that messaging platform lookups expose your interest to the subject and may reveal your own number to them.

🌍 NGO, humanitarian and human rights

Numbers are central to protecting at risk users, because a number now unlocks messaging, banking and social accounts and is the target of interception and account takeover attacks on activists and journalists. Victim centred practice means advising on separation of numbers between public and private roles, on account recovery hardening, and on the risks of number based registration, all with the person's consent and control. Do no harm forbids using a number to locate or enumerate accounts belonging to a defender or survivor. Store numbers of at risk individuals encrypted with strict access control and a plan for office compromise.

🎓 University and research

Research uses numbers for studies of fraud ecosystems, numbering plan structure, portability effects and the security of number based authentication. Numbers are directly identifying personal data, so ethics approval and a data management plan are normally required. Method must state the parsing library and version, the numbering plan data source and date, and how line type was inferred, since inference quality varies enormously by country. Avoid any technique that queries a live subscriber, including messaging platform lookups, which constitutes contact with a person. Publish aggregate distributions and code rather than number lists.

Playbook: working Phone Number end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Establish authority and route

Record the lawful basis for processing the number and, where subscriber identity or location is required, plan the legal process route rather than an open source approach. Note explicitly the prohibited techniques: recovery flows, messaging platform enumeration and any contact that alerts the subscriber. A good output is an authorisation naming the intended process route. Stop if the purpose is to locate or profile a private individual without authority.

Phase 2 — Parse and normalise to international form

Convert the number to full international format with country code, using an offline parsing library so nothing is disclosed to a third party. Retain the original format as observed, since national formatting conventions can indicate the source of the record. A good output is a canonical number plus the raw form and the parsing library version. Stop when normalisation is deterministic across your datasets.

Phase 3 — Validate against the numbering plan

Check length, prefix and structure against the national numbering plan for the country code, rejecting numbers that fall outside allocated ranges. Many numbers in scraped and breach data are malformed or synthetic, and filtering them early prevents wasted work. A good output is a validity verdict with the plan version used. Stop when invalid numbers are excluded and borderline cases are flagged rather than silently dropped.

Phase 4 — Identify the allocated range holder

Resolve the range to the operator it was originally allocated to using regulator published numbering data. This establishes the jurisdiction and the original operator, though not necessarily the current one. A good output is an allocation record with the regulator source and publication date. Stop when the range holder is identified or the range is confirmed as unallocated, which is itself a finding.

Phase 5 — Classify the line type

Determine whether the number is mobile, fixed geographic, non geographic, virtual or internet telephony, machine to machine, toll free or premium rate. Line type governs both the evidential value and the fraud risk, and virtual ranges frequently have minimal subscriber verification behind them. A good output is a line type with the basis for the classification. Stop when the type is established or explicitly recorded as indeterminate.

Phase 6 — Resolve the current serving operator

Where portability exists in the jurisdiction, use a portability lookup to establish which operator currently serves the number, because that is the entity holding subscriber and connection records. This single step prevents the most common cause of failed and delayed requests. A good output is the serving operator with the lookup date. Stop when the serving operator is confirmed; the range holder is not a substitute.

Phase 7 — Check documentary appearances

Search business registries, regulatory filings, published directories, court records and archived advertisements for the number, which links it to an organisation or a documented role rather than to a private individual by inference. A good output is a list of documentary appearances with dates and sources. Stop when the documentary record is exhausted before considering weaker sources.

Phase 8 — Assess breach and fraud reporting exposure

Check reputable exposure notification services for the number appearing in known breaches, and check community spam reporting for classification as a scam or campaign number. Record service names and dates only, never credential material. A good output is an exposure and reputation summary with dates. Stop at metadata; do not retrieve associated records from unverified aggregators.

Phase 9 — Avoid subject alerting techniques entirely

Do not query messaging platforms for profile presence, do not initiate account recovery to reveal masked digits, and do not call or message the number during a covert phase. Each of these notifies the subscriber or an adversary monitoring them, and several may constitute unlawful interference. A good output is a documented decision not to use these methods. Stop and escalate if someone requests them.

Phase 10 — Prepare the legal process package

Where subscriber, connection or location data is required, prepare a request to the serving operator naming the number in international format, the precise time window, the categories sought and the legal basis, preceded by a preservation request. Cross border, use the appropriate mutual assistance route. A good output is a served request with a reference. Stop when the request is lodged and preservation is in place.

Phase 11 — Handle caller identity claims correctly

Treat any presented caller identity as an unauthenticated assertion, since spoofing is trivial and widespread in fraud. Where authentication frameworks are deployed in the jurisdiction, seek the attestation data from the operator rather than relying on what a handset displayed. A good output is a clear statement distinguishing displayed identity from authenticated origin. Stop before presenting a displayed number as proof of the caller.

Phase 12 — Grade, restrict and review

Record confidence in any linkage between the number and a person or organisation, with the evidence for each, restrict access to the case team, apply retention and schedule deletion. Note excluded candidates. A good output is a graded, access controlled record with a deletion date. Stop when retention is scheduled and no prohibited technique appears anywhere in the case record.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
Google libphonenumber	Open	Offline library for parsing, validating, formatting and inferring line type for numbers across every country, with regularly updated metadata.	Primary normalisation and validation step, performed locally so the number is never disclosed to a third party service.
ITU numbering resources	Open	Authoritative country code assignments and published national numbering plan notifications submitted by member administrations.	Establishes the country and the official structure of the national plan against which a number is validated.
Ofcom numbering data	Open	United Kingdom numbering plan and allocation records showing which communications provider holds each number block and its status.	Identifies the allocated range holder for UK numbers and confirms whether a range is in use or reserved.
North American Numbering Plan Administration data	Open	Numbering plan area, exchange and block assignment records for North America with carrier identification and reassignment data.	Range holder identification for North American numbers and detection of blocks allocated to virtual providers.
National regulator numbering registers	Open	Published allocation registers maintained by telecommunications regulators in most jurisdictions, listing operators and block status.	Jurisdiction specific range holder identification, which is the starting point for any legal process route.
GSMA network and roaming resources	Registration	Industry reference data on mobile network operators, network codes, roaming agreements and numbering practice across markets.	Maps an operator name to its network identity and clarifies which entity would hold subscriber records.
Commercial portability and network lookup providers	Licensed	Services returning the current serving network, portability status and reachability for a number, using operator supplied data.	Determines the operator that actually holds the records, which the allocation register alone cannot tell you.
Have I Been Pwned	Open	Breach notification service which includes numbers where they appeared in known breaches, with dates and affected services.	Establishes which services the number was registered with and when, without any credential material.
Business registries and regulatory filings	Open	Official records where organisations publish contact numbers for registered offices, officers and regulated activities.	Documentary link between a number and an organisation, with a filing date and legal weight.
Internet Archive Wayback Machine (archived)	Open	Historic captures of websites, directory listings and advertisements where a number was published in the past.	Evidences historic association between a number and a business or service that has since removed it.
Action Fraud and national fraud reporting bodies	Open	National reporting mechanisms publishing scam typologies and, in some cases, campaign number patterns and alerts.	Contextualises a number within a known fraud campaign and provides the route for victim reporting.
Ofcom and industry guidance on caller identity authentication	Open	Regulatory and industry material on number spoofing, calling line identity authentication and operator obligations to block invalid numbers.	Explains what a displayed number does and does not prove, and what attestation data operators may hold.
3GPP and SS7 security research literature	Open	Technical material on mobile signalling protocols, subscriber location procedures and the security weaknesses documented in them.	Background for understanding what operator side data exists and why it is accessible only through the operator.
Budapest Convention and mutual assistance guidance	Open	Treaty framework and practical guidance on expedited preservation and cross border production of subscriber and traffic data.	Defines the route to subscriber and connection records held by an operator in another jurisdiction.
Data protection authority guidance on communications data	Open	Regulatory guidance on the treatment of subscriber and traffic data and the conditions attaching to its processing.	Supports the necessity and proportionality assessment recorded before any subscriber related processing.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Phone Number. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• libphonenumber and its language ports — Offline parsing, validation, formatting and coarse line type inference for international numbers. Limitation: line type inference is unreliable in countries with mixed or reallocated ranges.
• phonenumbers Python library — Convenient scripting interface to the same metadata for bulk normalisation of datasets. Limitation: metadata is only as current as the library version installed.
• Regulator numbering plan datasets — Authoritative range to operator mapping published by national regulators. Limitation: reflects allocation, not the serving operator after portability.
• Commercial portability lookup APIs — Return the current serving network and portability status for a number. Limitation: coverage and accuracy vary by country and the queries are billable per lookup.
• Fraud platform line type enrichment — Classifies numbers as virtual, mobile or fixed as a risk feature in transaction scoring. Limitation: classification lags new virtual provider ranges by months.
• Case management with access logging — Stores numbers under purpose binding, restricted access and retention schedules. Limitation: depends on analysts recording purpose at the point of query.
• Spreadsheet and data cleaning pipelines — Normalise large number datasets to international form before analysis or matching. Limitation: silently mangles numbers when country context is assumed rather than derived.
• Archive capture tooling — Preserves directory listings and advertisements where a number was published historically. Limitation: many directory sites block archiving, leaving gaps.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Resolve the serving operator before drafting anything. Portability means the range holder is frequently not the entity holding the records, and requests sent to the wrong operator return empty weeks later with no second chance at the retention window.
• Line type is the highest value cheap signal in fraud work. Virtual and internet telephony numbers carry far weaker subscriber verification than mobile contracts, and recent porting is a strong account takeover precursor.
• A displayed caller number is an assertion by the caller, not an identifier. Treat call logs showing a number as evidence of what was presented, and seek operator side attestation data where the origin genuinely matters.
• Never use recovery flows to confirm a number against an account. Masked digit disclosure through password reset alerts the account holder, may constitute unauthorised interference, and destroys covert investigations.
• Messaging platform lookups are contact, not observation. Querying a platform for a number's profile can reveal your own number to the subject and notifies them that someone is looking, which is a security failure in any sensitive case.
• Numbers are recycled aggressively. Operators reassign disconnected numbers within months, so a number in a two year old record may belong to an entirely unconnected subscriber today, and reassignment is a documented source of misdirected investigations.
• Numbering plan data ages. Regulators publish updates continuously, and a stale plan file will validate numbers into ranges that have been withdrawn or misattribute new virtual ranges to legacy operators.
• Preserve first, request second. Operator retention for connection records is often measured in weeks to months, so a preservation notice sent on day one is worth more than a perfectly drafted production order sent on day thirty.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Phone Number is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of subscriber requests served on the correct serving operator at first attempt, measuring whether portability lookups are being done.
• Rate at which preservation requests preceded production requests, tracked because retention windows are the binding constraint.
• False positive rate of line type classification used in fraud rules, validated against confirmed legitimate customer traffic.
• Number of prohibited techniques attempted, specifically recovery probing and messaging platform enumeration, tracked as a control failure indicator.
• Median time from a fraud campaign number being identified to operator notification and blocking.
• Share of number records carrying a documented lawful basis and retention date at creation, audited periodically.
• Proportion of investigations where a number to organisation link was established from a documentary filing rather than by inference.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Caller ID is unauthenticated, so a displayed number is an assertion by the caller and routinely spoofed in fraud and swatting cases.
• Portability makes the allocated operator misleading, and legal process sent to the wrong carrier wastes weeks of investigative time.
• Virtual and VoIP numbers can be bought anonymously in bulk, so geography and identity inferences from the prefix collapse entirely.
• Numbers are recycled by operators after disconnection, so historic records may relate to a completely different subscriber.
• Adding a number to a contact list to view a messaging profile can notify the subject and expose the investigation.
• Geographic inference from mobile prefixes is unreliable because subscribers keep numbers when they move country or region.

Legal and ethical considerations

Phone numbers are personal data and, when linked to communications, sit close to communications data regimes that require specific authorisation for subscriber and traffic data. Open-source enrichment must not become a substitute for lawful process where the law requires it. Avoid any technique that contacts, alerts or deceives the subject, including silent SMS and pretext calls, unless specifically authorised. Restrict access, log queries, and set retention accordingly, since number-based lookups can expose location and social graph data of considerable sensitivity.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Phone Number, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 9 intelligence disciplines, 7 mission domains, 6 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Why does the operator I identified say the number is not theirs?

Almost always portability. The number range was allocated to that operator by the regulator, but the subscriber has since ported to a different provider who now serves it and holds the records. Allocation registers show the range holder, not the serving network. Run a portability lookup before drafting any request, and record the lookup date because subscribers port again. In markets without portability the allocation holder is the serving operator, but that is now the exception rather than the rule for mobile numbers in most developed markets.

Can I find out who a number belongs to?

Through the serving operator under legal process, and realistically not otherwise. Publicly available links between a number and an organisation exist in filings, directories and advertisements, and those are documentary and usable. A private individual's subscriber details are held by the operator and disclosed only under a production order, warrant or equivalent. Commercial services that claim to identify subscribers typically rely on crowdsourced address book uploads or breach data of uncertain lawfulness, and using them can taint your investigation as well as breaching data protection law.

Is checking whether a number is on a messaging platform acceptable?

It is contact rather than observation, and should be avoided in investigative work. Such lookups can expose your own number to the subject, may add them to your contacts and notify them, and constitute processing of their personal data for a purpose they would not expect. In a covert investigation it is a security failure. Where establishing platform presence genuinely matters, the route is legal process to the platform, which produces a defensible record rather than an alert to the subject.

How reliable is line type detection?

Good for distinguishing broad categories in mature markets and poor in others. Offline libraries infer type from the numbering plan structure, which works where regulators maintain clean separations between mobile, fixed and virtual ranges, and works badly where ranges have been reallocated or where the plan mixes types. Newly allocated virtual provider ranges are the most common gap, often taking months to appear in metadata. State the library and metadata version with any classification, and validate against known samples before using it as a fraud feature.

What does a spoofed caller number mean for my evidence?

That the displayed number is only evidence of what was presented to the recipient, not of who called. Spoofing is trivial with internet telephony and is standard in impersonation fraud. Regulators in several jurisdictions now require operators to block calls presenting invalid or unallocated numbers, and authentication frameworks are being deployed that let operators attest to caller identity. Where origin matters, request the operator side call detail and any attestation data. Present the displayed number in your report as a claim, with that qualification stated.

How long do operators keep connection records?

It varies enormously by jurisdiction, operator and data category, from a few weeks for some signalling data to a year or more where retention obligations apply. That variability is exactly why preservation requests matter: a preservation notice freezes the records while the production process runs. Establish the operator's retention position early, prioritise the categories that expire soonest, and never assume that because a request is in progress the data will still exist when it is granted.

Is a phone number personal data?

Yes, where it relates to an identifiable individual, which a subscriber number plainly does. Business switchboard numbers are more arguable but often still identify a person in a small organisation. The practical implications are the same: record a lawful basis and purpose, minimise enrichment to what the question requires, restrict access, set a retention period and delete on schedule. Publication is a separate and higher threshold, and publishing a private individual's number is effectively never justifiable in investigative or journalistic output.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• ITU-T Recommendation E.164, defining the international public telecommunication numbering plan and the structure of a number.
• ITU-T Recommendation E.212, defining mobile subscriber identity and network codes used to identify serving operators.
• National numbering plan instruments published by regulators such as Ofcom, the FCC and their equivalents, governing allocation and use of ranges.
• Number portability regulations in each jurisdiction, which determine whether the range holder or a different operator serves the number.
• Caller identity authentication frameworks and regulatory anti spoofing obligations requiring operators to block invalid presented numbers.
• Budapest Convention on Cybercrime Articles 16 to 18, providing preservation and production routes for subscriber and traffic data.
• GDPR and ePrivacy provisions on communications data, governing lawful basis, minimisation and retention for subscriber related processing.
• GSMA operator guidelines on signalling security and subscriber data handling, which shape what operator side data exists and how it is protected.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. libphonenumber — Google. Open source library for parsing, validating and formatting international telephone numbers offline.
2. ITU numbering resources — International Telecommunication Union. Authoritative country code assignments and national numbering plan notifications.
3. Telephone numbering information — Ofcom. United Kingdom numbering plan, allocation records and guidance on number misuse.
4. North American Numbering Plan Administration — NANPA. Assignment records for numbering plan areas, exchanges and blocks in North America.
5. GSMA industry resources — GSMA. Mobile industry reference data on operators, network codes and signalling security practice.
6. Have I Been Pwned — Have I Been Pwned. Breach exposure notification service covering numbers included in known breaches.
7. Convention on Cybercrime — Council of Europe. Treaty framework for preservation and cross border production of subscriber and traffic data.
8. 3GPP specifications — 3GPP. Technical specifications for mobile network signalling and subscriber management procedures.
9. Action Fraud reporting service — City of London Police. United Kingdom national fraud and cybercrime reporting centre publishing scam typologies.
10. Guidance on communications and personal data — Information Commissioner's Office. Regulatory guidance on processing subscriber and communications related personal data.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: validates, classifies and enriches numbers with carrier, line type and portability context while routing subscriber identification to lawful process. Explore the platform, or browse the rest of the library by following any tag above.