How Ecommerce Platforms Are Losing Revenue to Fake Signups - and What Stops Them

The entry point for most fake account creation is the signup form. Someone submits a name, email, and phone number to access a free trial, trigger a referral bonus, or test the limits of an account's capabilities before committing to a paid plan. The phone number they enter looks valid - it passes format checks, it accepts an OTP if one is sent - but it is a non-fixed VoIP number: unregistered, disposable, and carrying no real identity. For SaaS products and ecommerce platforms that need to block this category at the point of entry, the Trestle phone validation API for SaaS signup runs a real-time line type check on form submission and returns the classification before the account is created.

The check costs a single API call. The account that does not get created cannot abuse a trial, claim a referral credit, or generate chargebacks. The math is straightforward - and the implementation is lightweight enough that most product teams can ship it in a sprint.

Understanding why non-fixed VoIP numbers are the problem requires understanding what makes them different from real mobile numbers. A mobile number is registered to a carrier, tied to a SIM card, and associated with a subscriber identity. A non-fixed VoIP number requires none of that. It can be generated programmatically, requires no identity verification, and costs almost nothing to create at scale. The number looks identical to a real mobile in any form field that stores only a string of digits.

This is not a niche edge case. Online shopping fraud was the second most commonly reported fraud category in the FTC's 2024 consumer fraud report, with consumers reporting $12.5 billion in total fraud losses - a 25% increase over 2023. The fake account problem that platform operators deal with is a downstream effect of the same fraudulent contact data infrastructure driving those consumer losses.

The line type check that identifies non-fixed VoIP at signup is the same check that surfaces this entire category. A return value of non-fixed VoIP on a signup submission is a reliable indicator that the account being created carries elevated fraud risk - regardless of whether the email looks real or the name passes basic validation.

The common assumption is that requiring an OTP at signup closes the fake account problem. It does not. Non-fixed VoIP numbers can receive SMS messages, which means they pass OTP flows just as cleanly as real mobile numbers. An account created with a non-fixed VoIP number has verified control of that number at the moment of signup - it has not verified that the number belongs to a real person with genuine intent to use the product.

The distinction matters because OTP verification is a control check, not an identity check. It confirms the submitter could access the number at a specific moment. A line type check returns what the number actually is - which is the information that changes whether the account should be created at all.

The practical integration pattern sits between OTP dispatch and account creation: the form submission triggers the line type check, the response comes back, and the application routes based on the result. Non-fixed VoIP returns can prompt a request for an alternative number, route the account to a manual review queue, or block creation outright. The policy is a product decision; the engineering requirement is a single conditional branch.

Line type classification catches the non-fixed VoIP category cleanly. Phone activity score catches the broader category of low-intent submissions - real numbers that have shown no recent usage and are unlikely to belong to someone actively engaged with a product.

A phone activity score reflects recent usage patterns across carrier data sources. A number scoring near zero has shown no activity in the past twelve months - it may be a dormant SIM, a number that has been cancelled and not yet reassigned, or a number entered by someone who has no intention of engaging with the product after signup.

For ecommerce platforms and SaaS tools with free trial models, high-activity mobile numbers are the accounts most likely to convert to paid plans. Low-activity numbers, regardless of line type, represent a conversion risk worth flagging. Routing them to a lighter-touch onboarding sequence - or requiring additional verification before granting full trial access - is a product decision that can be made automatically based on the score without manual review overhead.

The downstream effects of fake account creation extend beyond the direct cost of the account itself. Referral programs are particularly vulnerable: a bad actor who understands the referral mechanics can generate multiple fake accounts, each triggering a credit against a real account, then withdraw or spend the credits before the fake accounts are identified and removed. This is a well-documented attack vector that most referral program designs do not adequately close.

Phone validation at signup closes it structurally. If non-fixed VoIP numbers cannot create accounts, the programmatic generation of fake referral accounts becomes significantly harder - because each account now requires a real mobile number, which carries genuine friction and cost compared to a disposable VoIP number.

The same logic applies to trial economics. If the free trial population contains a high proportion of non-fixed VoIP signups, the conversion metrics derived from that population are misleading - because a significant share of the trial users were never real prospects. Cleaning the intake means the trial-to-paid conversion rate reflects genuine buyer intent rather than noise from fake account creation.

The signup flow is the natural integration point because it is where the phone number is first submitted and where the account creation decision is made. A server-side call on form submission, before account creation executes, keeps the check synchronous and invisible to the user - the page does not reload, the experience is not interrupted, and the decision is made before any downstream state is written.

For teams using React on the frontend, the welcome email and post-signup engagement approach only produces returns when the accounts receiving those emails are real. The phone validation step that runs before account creation is what ensures the audience you are engaging is worth engaging.

The accounts that enter a platform in the first months of a product's growth become the foundation of its conversion data, its cohort analysis, and its understanding of what a good customer looks like. If a significant share of those early accounts are fake, the data they generate degrades every downstream decision built on it.

Phone validation at the point of signup is not just a fraud prevention measure. It is a data quality investment that improves the accuracy of every metric the product team uses to make decisions - conversion rates, lifetime value estimates, churn models, and referral program ROI. The API call is cheap. The quality dividend it produces compounds for as long as the platform runs.