A lead form asks for three things: an email address, a phone number, and a name. Each one can be rented, generated, or borrowed in the time it takes the page to load, and none of the three depends on the other two.
That independence is what makes fake signups detection harder than single-layer validation suggests. Most setups treat a fake lead as one object to accept or reject, when it is an assembly of three separate supplies: a mailbox that can receive, a number that can receive, and fields that read like a person. Remove one and the other two survive the block.
From a buying-side view, the first sign is almost never a rejected submission. It is a cohort that filled the form, cleared validation, landed in the customer relationship management system (CRM), and then did nothing at all.
Contents
- The Email Layer: Throwaway Domains, Catch-All Mail, and Tricks on Real Mailboxes
- The Phone Layer: Numbers That Receive Without Belonging to Anyone
- The Revenue Share That Makes a Passcode Worth Sending
- The Identity Layer: Invented People and the Harder Mixed Case
- Reading the Three Layers as Separate Purchases
- Checks at the Form: What a Pass Actually Establishes
- Checks After the Form: What Only Behavior Reveals
- Why a Clean Database Is Not the Same as Clean Revenue
- What Hardening the Form Costs You
- FAQ
- Two Numbers Worth Putting Side by Side
Key Takeaways:
- Fake leads come from three independent layers (email, phone, identity), so blocking one costs the operator one field, not the lead.
- Catch-all domains, plus-addressing, and dot variants produce genuinely deliverable addresses, so list-based blocking always lags.
- The phone layer holds the operator’s only real cost: receive capacity has to exist on a physical network.
- Form-time validation optimizes for a database that looks correct, so the informative measure is the gap between accepted leads and leads that do anything afterward.
The Email Layer: Throwaway Domains, Catch-All Mail, and Tricks on Real Mailboxes
The cheapest part of a fake lead is the mailbox. Disposable email services hand out an address on a shared domain, keep it alive for minutes or hours, and show the inbox in a browser without asking anyone to register. Nothing is malformed, the mail exchange records work, and a confirmation message arrives and can be clicked.
Catch-all domains are the quieter version. A catch-all domain accepts mail addressed to any local part, so any invented name at it resolves as deliverable whether or not a human reads it. A verification service that asks the receiving server whether an address exists gets a yes for every guess.
Then come the two tricks that need no throwaway service. Plus-addressing appends a tag to a real address, so one inbox produces an unlimited set of distinct-looking addresses, and on providers that ignore dots in the local part, shifting the dots does the same job. Both defeat naive duplicate checks, and both look identical to a real user who tags incoming mail for filtering. Blocking this layer stays list maintenance, and lists lag.
The Phone Layer: Numbers That Receive Without Belonging to Anyone
The phone field gets treated as the serious one, on the theory that a number costs money and ties back to a person. Neither half holds. Virtual numbers are allocated in software over voice over internet protocol (VoIP) infrastructure and short message service (SMS) gateways, and shared receive services publish numbers whose incoming messages anyone can read on a web page.
What separates this layer from the email layer is that receive capacity is physical somewhere: a number has to be allocated inside a numbering range, and a message has to cross a carrier that terminates it. That is where an operator’s cost concentrates, which is why phone signals repay attention more than email signals do.
A line type lookup returns the class of a number rather than a verdict, so the usable findings are combinations: one number confirming several signups, or submissions clustered inside a narrow range on one carrier.
The Revenue Share That Makes a Passcode Worth Sending
Sometimes the number field is the target rather than the obstacle. Twilio’s documentation on SMS pumping fraud, also called artificially inflated traffic, describes the mechanism: fraudsters abuse a phone number input field that triggers a one-time passcode or an app download link by SMS, send to ranges of numbers controlled by a mobile network operator, and take a share of the revenue those messages generate. The operator is sometimes complicit and sometimes exploited without knowing it.
Read against a lead generation funnel, that changes the shape of the fake signup: the operator has no interest in whether the record is ever contacted, because the outbound message volume is the product.
In practice, teams reviewing this pattern find the delivery reports look healthy and everything after missing: no reply, no answered call, and submissions sitting in number ranges the business has never sold into.
The Identity Layer: Invented People and the Harder Mixed Case
Name, company, job title, and interest fields are the cheapest layer, because nothing in them is verified. Persona generators produce internally consistent sets: a plausible name for the region you targeted, a company that sounds like a company, a fitting title.
The harder case is not the fully invented person. The Federal Reserve’s payments improvement resource on synthetic identity fraud records the industry definition: the use of a combination of personally identifiable information to fabricate a person or entity in order to commit a dishonest act for personal or financial gain. It also names the mechanism that a synthetic identity typically mixes real information with fictional information, and points to a series of Federal Reserve white papers.
The payments context is not lead generation, so be exact about what carries over. The definition and the mixed-data mechanic transfer directly: a lead built from one real element (a real company domain, a real mailbox, a real number) plus several invented ones is the same object under another name. The credit build-up and bust-out pattern does not transfer, because nothing at the end of a lead form extends credit. The mixed record is also the one that breaks matching logic, because a single true element returns a partial match instead of a clean failure.
Reading the Three Layers as Separate Purchases
The layers are bought separately and fail separately, which is why single-layer defenses return less than the effort suggests. Marginal cost per identity sits near zero on the email and identity layers and concentrates in the receive infrastructure behind the phone layer. The map below sorts each layer by what a reviewer can observe and what it costs to replace.
Checks at the Form: What a Pass Actually Establishes
Validation at submission is fast, cheap, and narrower than its output implies. Each check answers one question, and the answer is easy to over-read as a verdict on the lead.
| Check at the form | What a pass establishes | What a pass leaves open | Friction for a real user |
|---|---|---|---|
| Disposable domain list | The domain is not on a list you hold | Domains newer than the list, and catch-all domains | Low, until a real forwarding service is listed |
| Mailbox verification | The server accepts mail for that address | Whether a person reads it, since catch-all domains accept every guess | None |
| Line type lookup | The number class: mobile, fixed, or virtual | Whether a real number was borrowed for one message | Low, unless fixed lines are refused |
| Passcode confirmation | Someone could read a message sent there | Who read it, and whether they want your product | High, and it rises on weak connections |
Mitigations at this layer do exist. Twilio’s guidance on preventing fraud in verification flows documents line type intelligence so messages go only to mobile numbers, carrier-level blocking, and automated detection of unusual traffic patterns. Those reduce abuse of the sending path, a different problem from judging whether a record represents a buyer.
Checks After the Form: What Only Behavior Reveals
Post-submission checks read what a record does once it exists: whether the mailbox opens anything, whether a reply comes, whether a call connects, whether a meeting happens. None of that exists at submission, and all of it is cheap later.
Grouping matters more than individual records. A single lead that never replies is ordinary; a domain, a number range, or a source with a reply rate near zero across a cohort is a finding. Exposure is highest on unfiltered open programmatic supply and in long chains with opaque resellers.
The comparison below sets the two stages side by side, and the band underneath is where a synthetic lead does its damage.
Why a Clean Database Is Not the Same as Clean Revenue
Form-time validation optimizes for a database that looks correct. Revenue is a different objective, and under pressure the two separate. A record with valid syntax, a deliverable mailbox, and a routable mobile number is valid by every definition available at submission, and whether anyone behind it wants the product is not a question the form can ask.
That makes the rejection rate at the form a weak measure. It counts what your lists already knew, so it rises with sloppy fakes and falls with careful ones. A drop in rejections reads like an improvement and can equally mean the fakes got better.
The measure that carries information is the gap between accepted leads and leads that do anything afterward, tracked per source and per campaign. Two suppliers with identical acceptance rates and a wide difference in first-reply rate are not the same purchase. Analysts who inherit these records describe the same order of discovery: almost no rejections at the form, a CRM that looked healthy, and a problem that surfaced only when somebody divided contacted leads by leads that answered.
One consequence is uncomfortable. The carefully assembled synthetic lead is invisible to form-time checks, so the money is usually committed before engagement data exists, and the realistic goal is to shorten the time between accepting a cohort and knowing what it is worth.
What Hardening the Form Costs You
Every check has a false positive class, and most cost conversions from real people. Disposable domain lists catch legitimate privacy forwarding services and regional providers on a shared domain, rejecting catch-all domains rejects real companies that run catch-all mail on purpose, and refusing plus-addressing blocks a habit careful users adopted. The phone layer is worse. Restricting delivery to mobile numbers is a reasonable defense against abuse of the sending path, and it also refuses real customers whose main number is a landline or a business VoIP line. A passcode step costs conversions wherever a message is slow.
There is no single setting that removes synthetic leads without removing real ones. The choice is which error you would rather pay for, priced as cost per lead against the cost of a sales hour spent on a record that was never a person. Naming that trade-off is more useful than treating a single threshold as the answer.
Two limits are worth stating flatly. Partial matches, the record anchored to one true element, are where scoring a single record on its own is least reliable, and settling them takes cohort-level context or a reviewer who has it. And nobody publishes the exact signal that flagged a record, because naming it is how an operator learns what to change next.
FAQ
What is fake signups detection?
Fake signups detection is the practice of separating lead form submissions that represent a real person from submissions assembled out of throwaway data. It runs at the form (syntax validation, domain lists, line type lookups) and after it (whether the mailbox opens anything, whether the number answers).
How can you tell if an email address is disposable?
The reliable indicators are the domain and the behavior, not the address itself. Domains that appear only in new signups, and addresses that pass a deliverability check but never open a message, are both worth flagging. Public lists help and always lag.
Does a virtual phone number always mean a fake lead?
No, and treating it as proof will cost you real customers, since plenty of legitimate buyers use VoIP or business numbers as their main line. It becomes strong evidence alongside other artifacts: one number confirming several signups, or a passcode confirmed with no engagement after.
What is SMS pumping and why does it target lead forms?
Twilio’s documentation describes SMS pumping fraud, also called artificially inflated traffic, as abuse of a phone number input field that triggers a one-time passcode or app download link by SMS, with the fraudster taking a share of the revenue from messages sent to number ranges controlled by a mobile network operator. The tell is volume in unfamiliar ranges with no activity after.
Should you block catch-all domains on your lead form?
Usually not as a hard block, because a catch-all domain accepts mail for any address and many real companies run their mail that way. Accepting them, marking them, and reading their engagement as a group is more workable.
Two Numbers Worth Putting Side by Side
Acceptance rate at the form and the share of accepted leads that ever respond describe the same funnel, and they can move in opposite directions for weeks. A supplier sending carefully assembled synthetic leads improves the first number while flattening the second, which looks like progress in a validation report.
So the question to put to any lead source is not how many submissions were rejected. It is what happened to the ones that were accepted, grouped by where they came from, and how fast you can know. A fake lead is cheap to rebuild, but it cannot manufacture a reply.
Join our Telegram for more insights and share your ideas with fellow-affiliates.