Fake accounts rely on disposable email domains and VoIP numbers because both are free, instant, and untraceable. Block the known disposable domains, verify the phone line type, and require a second signal, like a payment method or a device with history, before the account can act.
The disposable email economy
A disposable email service gives anyone an address in seconds, receives the verification code, and then disappears. The address never belonged to a person, and it never will again. Bot operators use them because they are free and because they defeat the simplest verification: send a code, get the code, create the account. The email check passes, and the account is fake.
The defense is a blocklist of known disposable domains, checked at signup. The lists are maintained by several providers and updated constantly, because new disposable domains appear every week. A blocklist from last year is half useless. The check should run against a current list, and it should flag, not just block: a disposable domain on an otherwise clean signup is a signal, and a disposable domain plus a VoIP number plus a burst pattern is a farm.
Related reading on this site: Home and Credential Stuffing at the Login Form: Akamai's 26 Billion Attempts a Month cover the neighbouring problems in more depth.
VoIP numbers and verification farming
A VoIP number is a phone number that lives in software, not on a carrier network, and it can be created in bulk for pennies. Verification farming is the business of creating VoIP numbers, using them to pass SMS verification, and then discarding them. A phone check that only confirms the number can receive a text will pass a VoIP number every time, because VoIP numbers receive texts just fine.
The check that works is line-type verification: is this number a mobile, a landline, or a VoIP line, and which carrier owns it. A real buyer gives a mobile or landline that exists on a carrier network. A bot gives a VoIP number from a range known for verification farming. The line-type check is cheap, it runs in milliseconds, and it is the single most effective filter against fake accounts that pass SMS verification.
The second signal rule
No single check should decide an account. The rule is two signals: an email and a phone number are the first signal, and the second has to come from somewhere else. A payment method that verifies, a device with browsing history, a social account with age, or a purchase that clears. A fake account can fake one signal cheaply. Faking two costs real money, and faking three is usually not worth it.
The practical version is a tiered account. A new account with one signal can browse and wishlist. It cannot claim a bonus, enter a drop, or withdraw funds until the second signal clears. The tiers protect the valuable actions, which are the ones the farms want, and they leave the ordinary actions open, which are the ones real buyers need on day one.
Frequently asked questions
What is a disposable email address?
An address from a service that creates it in seconds, receives the verification code, and then disappears. It never belonged to a person, and bot operators use them because they are free.
How do I block disposable emails?
Check the domain against a current blocklist of known disposable domains at signup. The list must be updated constantly, because new disposable domains appear every week.
What is verification farming?
The business of creating VoIP numbers in bulk, using them to pass SMS verification, and discarding them. A phone check that only confirms a text was received will pass a VoIP number.
What is a line-type check?
A check that confirms whether a phone number is a mobile, a landline, or a VoIP line, and which carrier owns it. It is the most effective filter against fake accounts that pass SMS verification.