Sign-ups, payouts and checkouts all ask for a phone number. It feels like a number should reveal everything: social accounts, messengers, the owner's name. The honest answer is more modest. Most sites do not show which number an account is tied to, and the only way to ask a messenger "whose number is this" is a request that touches the number and its owner. Oracul does not do that.
Offline number parsing
The number is parsed locally with the phonenumbers library: no calls, no SMS, no requests to outside services. The output:
- Country and region from the numbering plan.
- The carrier the number range was allocated to.
- Line type: mobile, fixed line, VoIP.
- Validity: whether the number passes format and numbering checks.
- Messenger links for the number, for the analyst to check by hand. Oracul does not query messengers by number itself.
Two flags for your rules
Parsing produces two signals. voip_phone: the number is virtual. Such numbers are easy to get and easy to drop, which is why account farms and throwaway sign-ups like them. invalid_phone: the number fails the checks — a typo, a made-up number or junk in the form field.
Neither flag is a verdict. Ordinary people and companies use VoIP numbers too. A flag is useful in combination: "VoIP number and a footprint under six months" is a reason for manual review, unlike a blunt "VoIP means decline".
A phone in the profile
Sometimes a number shows up in the profile on its own: when the person put it in a public profile field that Oracul found by username or email. The phone then goes into the identity passport next to its source, so you see which site and which account it came from. For security teams that is a signal too: an employee's work number is open to everyone.
Why a phone works better in a pair
A number answers "what kind of line is this"; an email and a username answer "is there a real history behind this application". So pass everything the application has: phone, email, first and last name. One response then holds the number type, the footprint age and whether the name matches in the profiles found.
How to run it
Pass the phone as a seed in POST /v1/scans with the other seeds, or type it into the Phone field in the console. Parsing the number takes a moment; the rest of the scan takes a few minutes in quick mode. Phones never go to external models, and the result is deleted after 30 days or earlier with DELETE /v1/scans/{id}.