Inbound call fraud playbook: filters that don’t kill leads

Build your inbound call fraud playbook with light layers: line-type checks, a one-digit IVR, mild per-number rate limits, and per-target caps. Watch spam scores weekly and tune only where abuse shows; you can ship this baseline in about 30 minutes.

Inbound call fraud playbook: a layered build you can apply today

Start simple and stack controls. For most teams, begin with four quick wins: line-type checks, a short press-1 IVR, mild per-number rate limits, and per-target caps. These spot non-fixed VoIP and low-quality routes, defeat bots, slow floods, and protect buyers and agents. Check per-number spam scores weekly so you don’t keep using a number that starts to show “Spam Likely.”

Use one clear example to guide the build. Say you run a US plumbing pay-per-call campaign. You take calls on one main number and route to two buyers. Floods tend to hit at night and during TV ads. Your goal is to keep good callers moving with little friction while junk dies early.

Most routing platforms give you these controls. In CallFlow, you can enable HLR/line-type lookup, VoIP-caller blocking, per-number rate limits, per-target caps, spam-score tracking, and blocklists. The same playbook works in the US, India, the Philippines, Thailand, Bangladesh, Pakistan, and nearby markets, with small differences noted below.

The safe default filters: line-type check, VoIP screen, one-digit IVR

A line-type or HLR lookup (a quick check that tells you if the caller ID belongs to a mobile, fixed line, fixed VoIP, non-fixed VoIP, or similar) is your first filter. It doesn’t decide the whole call. It tells you how to treat it. The safe move on day one is not to hard-block large groups. Instead, flag non-fixed VoIP and known low-quality routes or sources for an extra screen. Let the rest pass.

Your VoIP-caller blocking strategy should separate hard blocks from soft challenges. Hard-block only what you know is bad: repeated abusers, known bad ranges, or sources you have already verified in your own logs. For the gray area—app-based numbers and similar—use a soft screen: route them through a one-digit IVR. That way, honest people still get through, and most bots do not.

A one-digit IVR (press 1 to connect) breaks the bulk of automated floods. Keep it short. Use the same words your ad used, in the same language, so a real caller won’t second-guess it. For example: “Plumbing service. Press 1 to connect now.” Set a quick repeat every 3–5 seconds, give two chances, then route to voicemail if there’s no input. Keep the voicemail greeting clear: “Leave your name, ZIP code, and a callback number.”

Country differences are small but important. Outside the US, an HLR check is common for mobile and can also confirm number status. In the US, rely on carrier/line-type lookup for the same insight. In India, the Philippines, Thailand, Bangladesh, and Pakistan, match the IVR prompt to local languages if your ad also ran in them. In every market, do not block all VoIP by default. Many honest callers use app numbers.

Rate limits vs caps: slow floods, protect buyers

Rate limits and caps do different jobs. A rate limit is a gate on how many calls per minute (or per a short time window) can reach an entry number. It slows floods so your buyers and agents don’t get spiked. A cap is a limit per target or buyer. You set a daily cap (the total calls one buyer will take in a day) and a concurrent cap (how many calls one buyer handles at the same time). Caps keep one buyer from being swamped when traffic is real and heavy.

Safe defaults look like this. Start with a mild per-number rate limit—low enough to slow a bot burst, not so low that it delays a wave of TV-driven callers. Then give Buyer A a concurrent cap of 1–2, matched to how many people they have ready to pick up. Set a daily cap that fits their budget and quality goals. Put Buyer B as the overflow when A is at cap or doesn’t answer. If both are busy or capped, send callers to a short queue or to voicemail.

Success is easy to spot. Spikes smooth out, so you don’t see ten rings hit in one second. Aim to keep any queue under about 20–30 seconds. Buyers report steadier flow and better answer rates. Your logs show fewer sub-10-second calls. That’s junk you filtered before it rang a person.

Edge cases come up. If you buy TV or radio, you’ll get short, sharp bursts. In those windows, you can raise the rate limit in small steps while keeping the same per-target caps. This keeps your buyers safe. Seasonal spikes (storms for roofers, holidays for HVAC, monsoon season in South Asia) behave the same way. Expect them and adjust the rate limit for the event window only. Do not lift caps without talking to the buyer.

If you need a deeper primer on this control, see our note on call rate limiting.

Spam score monitoring: a weekly workflow that works

A per-number spam score is a risk signal from major carriers and analytics sources that says how likely a number is to show as “Spam Likely.” Even if your main line is for inbound, you may also use it for callbacks. Those callbacks can change the score. That’s why you track it.

Run a short weekly routine. Export your numbers and their scores. Sort by the ones that rose the most in the last week. Park any number that trends bad. Rotate in a fresh number for the same campaign and test it with a few live calls. Keep the old number in your account, but don’t put it back in ads until the score recovers. A slow return to normal is common when you stop outbound on that line.

If a number gets flagged hard, act in three steps. First, pause aggressive outbound from that number. Second, move inbound to an alternate number you already own for that campaign. Third, watch for recovery for a week or two before you reuse the old number anywhere public. You avoid showing as “Spam Likely” on callbacks and you protect conversion on your ads.

Toll-free and local behave differently. Toll-free tends to attract more non-US spam if you advertise abroad because it’s free to call from many places. Local numbers are more likely to be targeted by region, not globally. For global teams, split testing both is fine. Just track their scores and call mix separately so you don’t blame the wrong source.

Live eyes help too. Use live call dashboards and spot-check recordings to confirm how real callers sound during a flood window. This can surface a new bot pattern before scores react. We cover that workflow in live call monitoring for fraud prevention.

Blocklist maintenance that doesn’t backfire

A blocklist is useful when you apply it with care. Use this policy: block the least you must, for the shortest time that works. Start with caller-ID-level blocks tied to clear evidence, like repeat sub-10-second calls from the same number or abuse captured in recordings. Avoid wide-net blocks, like entire area codes, unless you’ve proven the bad outweighs the good. In many US and Asian regions, the same area codes that spam you may also convert well.

Give your blocklist a simple process so it stays clean. Tag each block with a reason and a date. Review for unblocks every 30 to 60 days. If the bad behavior stops, take the block off. Keep a small allowlist for partners and buyers who use app-based VoIP numbers, so they don’t get caught in your soft screen during testing.

Avoid “trap lists” you find on the web. They go stale and often include real customers. Rely on your own logs, your own repeat patterns, and notes from your agents and buyers. If you see abuse from a range or a country you don’t serve, it’s fine to block that pattern for a set period. Just write down the “why” and “until when.”

For more detail on how to tune this safely, see our guide on VoIP caller blocking.

A safe-default call path you can copy

Here’s a simple route for the plumbing campaign we’ve used as the running example. Your main number takes the call, runs a line-type and VoIP screen, then asks the caller to press 1. If they pass, it rings Buyer A with a concurrent cap of 1. If Buyer A is busy, it overflows to Buyer B. No answer sends the call to voicemail. Keep each ring leg at 20–25 seconds before moving on. If you use a queue, keep it short or off during floods to avoid stacking bots.

Keep the IVR prompt in the same language as your ad. In US campaigns, English or Spanish may make sense. In South and Southeast Asia, match Hindi, Urdu, Bengali, Thai, Tagalog, or English to your audience. That small match cuts drop-off and keeps friction low for honest callers.

If you want more background on number intelligence and how to use it upstream in your funnel, we cover that for forms here: line type lookup for lead forms. The logic is similar for calls.

What to do next: ship the 30-minute setup, then a weekly check

Follow this quick build to get the inbound call fraud playbook live today. You’ll add one filter at a time, test it, and confirm traffic still flows.

1. Turn on line-type lookup and VoIP screening. Mark non-fixed VoIP and low-quality sources for an IVR challenge, not an auto-block. Place a known good test call from a mobile and from a VoIP app to confirm both reach the IVR.

2. Add a one-digit IVR. Record a short “Press 1 to connect” message in the same language as your ad. Set a 3–5 second repeat and route no-input to voicemail. Place a test call and let it time out once to check the voicemail path.

3. Set a mild per-number rate limit. Start conservative so floods slow but real callers still get through. Use your last week’s peak minute as a guide and trim a bit below it to smooth spikes. If you run TV or radio, raise the limit slightly during those windows only.

4. Enforce per-target caps. Give Buyer A a concurrent cap of 1–2 and a daily cap matched to their budget. Make Buyer B your overflow. Set each ring leg to 20–25 seconds before overflow.

5. Turn on spam score reports. Export scores weekly. If one number trends worse, park it, rotate in a fresh number, and run a few live tests. Pause outbound on any number that starts to show flags until it recovers.

6. Define a blocklist policy and cadence. Block only when you have evidence. Tag each block with a reason and date. Review every 30–60 days to unblock if the pattern stops. Keep a small allowlist for partners and buyers using app numbers.

7. Watch live during your high-risk windows. Use live call views and spot-check recordings when floods usually hit (night, during TV ads). Confirm that the IVR catches bots and that caps protect buyers. If floods persist, increase IVR friction slightly (add one more prompt cycle or slow the repeat by a second) while keeping caps in place.

To confirm it worked, look for three signs. First, your short-call rate drops and stays down. Second, buyers report steadier flow and fewer nuisance rings. Third, your logs show fewer call bursts, and any queue time you do allow stays low. If you still see heavy floods getting through, raise the rate limit in small steps for the event window. Keep per-target caps firm. You can also move the soft screen to more of the flagged line types. If you see false positives (real callers failing the IVR), shorten the prompt, match the language to the ad, and check your blocklist for accidental catches.

One last note: the same layers apply across the US and Asian markets. The checks you run (line type/HLR, VoIP screen, IVR, rate limit, caps, spam score, blocklist) are stable. What you tune are the messages, the rate limit level during known bursts, and the cap values for each buyer.

Ready to try it with real traffic? Create an account at CallFlow or contact us if you route at scale and want help mapping your caps and limits.