Intelligence - Insights reason code mappings
Telesign Intelligence responses may provide extra explanation of how we calculated the risk recommendation for your number, in the form of insights reason codes. Codes that provide an overall conclusion on the relative transaction risk level associated with your phone number are found in the “category” package. Codes in the other packages provide insights on the factors contributing to that overall conclusion.
NOTE
Intelligence 1.0 never includes reason codes. To upgrade your account to a newer version of Intelligence, contact your Customer Success Manager or [email protected]. See What is different about Intelligence 2.0 for more details.
Use the tables below to look up the meaning of each code.
category
Reason codes that provide an overall conclusion on the relative risk presented by the transaction, by placing the transaction in a risk category. This is determined based on weighting the risk and trust signals indicated by the other reason codes.
| Code | Name | Meaning |
|---|---|---|
| 10010 | low activity | Not enough activity or attributes to classify the transaction as either risky or trustworthy. |
| 10020 | low regular activity | Trustworthy category, based on past behavior. |
| 10021 | regular activity | Most trustworthy category, based on past behavior. |
| 10030 | low-risk irregular activity | Risky category, based on past behavior. |
| 10031 | medium-risk irregular activity | High-risk category, based on past behavior. |
| 10032 | high-risk irregular activity | Highest-risk category, based on past behavior. |
| 10040 | irregular number type | This number has risky static attributes (like VOIP phone type or being on a blocklist). |
a2p
Reason codes specific to application-to-person messaging (a2p). These are automated messages sent to a human, like verification codes, appointment reminders, etc. These reason codes are organized into multiple sub-categories.
activity
Reason codes related to how much activity was observed for this number, compared to what would be expected for a good user. This takes into account the number of communications transactions (calls, SMS, etc.) to or from this number, the quantity of unique numbers communicated with, and the number of accounts communicated with.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 20001 | no long-term activity | Much less than expected activity, or none at all, for this number over the past 90 days. Cannot classify. | ||
| 20002 | high long-term activity | More than expected activity for this number over the past 90 days. | ✔ | |
| 20003 | high short-term activity | More than expected activity for this number over the last 24 hours. | ✔ | |
| 20004 | moderate long-term activity | Expected activity for this number over the past 90 days. | ✔ | |
| 20005 | moderate short-term activity | Expected activity for this number over the last 24 hours. | ✔ | |
| 20006 | sparse long-term activity | Sparse, regular volume of verification traffic on this number over the past 90 days. | ✔ | |
| 20007 | continuous long-term activity | Continuous, regular volume of verification traffic on this number over the past 90 days. | ✔ | |
| 20008 | very high long-term activity | Very high volume of verification traffic on this number over the past 90 days. | ✔ | |
| 20009 | very high short-term activity | Very high volume of verification traffic on this number over the past 24 hours. | ✔ | |
| 20010 | no activity | Very low volume of verification traffic, or none at all, was ever observed on this number. | ||
| 20011 | low long-term activity | Low volume of verification traffic on this phone number over the past 90 days. | ||
| 20012 | low short-term activity | Low volume of verification traffic on this phone number over the past 24 hours. Very low volume of verification traffic, or none at all over the past 90 days. | ||
| 20013 | low activity | Less than expected activity for this number. |
range
Reason codes related to how active a risky range (series of consecutive numbers) that the number belongs to has been, if applicable, compared to a good phone number.
Understanding range
Phone number 13105551 13105552 13105553 13105554 In the example above, let’s say the number you submitted to the service is 13105552. Even if there has been no risky activity for that particular number, there might still be risky activity for most other phone numbers in the 131055xx range. In this case the risky activity of the range would contribute to the overall risk level we determine for the submitted number.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 20101 | no range activity | Very little activity, or none at all, for a risky range that this number belongs to over the past 90 days. Also returned if the number does not belong to a risky range. | ✔ | |
| 20102 | low range activity | Some activity for a risky range that this number belongs to over the past 90 days. | ✔ | |
| 20103 | moderate short-term range activity | Significant activity for a risky range that this number belongs to over the last 24 hours. | ✔ | |
| 20104 | moderate long-term range activity | Significant activity for a risky range that this number belongs to over the past 90 days. | ✔ | |
| 20105 | high short-term range activity | Very significant activity for a risky range that this number belongs to over the last 24 hours. | ✔ | |
| 20106 | high long-term range activity | Very significant activity for a risky range that this number belongs to over the past 90 days. | ✔ | |
| 20107 | very high long-term range activity | Extremely significant activity for a risky range that this number belongs to over the past 90 days. | ✔ | |
| 20108 | very high short-term range activity | Extremely significant activity for a risky range that this number belongs to over the last 24 hours. | ✔ |
risky services
Reason codes related to how much the number has communicated with risky services.
Understanding risky services
Both Telesign and other companies designate specialized services to handle transactions with numbers that are judged more likely to be malicious. We call these “risky services”. It’s not that the service itself presents risk; rather it is that if your submitted phone number has had a lot of contact with these services, someone thinks that the number presents risk.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 21001 | moderate activity on risky services | Significant activity on this number to or from risky services over the past 90 days. | ✔ | |
| 21002 | high activity on risky services | Very significant activity on this number to or from risky services over the past 90 days. | ✔ | |
| 21004 | long-term activity on risky services | Verification traffic on risky services on this number over the past 90 days. | ✔ | |
| 21005 | short-term activity on risky services | Verification traffic on risky services on this number over the past 24 hours. | ✔ | |
| 21006 | high long-term activity on risky services | High volume of verification traffic on risky services on this number over the past 90 days. | ✔ | |
| 21007 | high short-term activity on risky services | High volume of verification traffic on risky services on this number over the past 24 hours. | ✔ | |
| 21008 | long-term range activity on risky services | Verification traffic on risky services on the range this number belongs to over the past 90 days. | ✔ | |
| 21009 | short-term range activity on risky services | Verification traffic on risky services on the range this number belongs to over the past 24 hours. | ✔ | |
| 21010 | high long-term range activity on risky services | High volume of verification traffic on risky services on the range this number belongs to over the past 90 days. | ✔ | |
| 21011 | high short-term range activity on risky services | High volume of verification traffic on risky services on the range this number belongs to over the past 24 hours. | ✔ | |
| 21012 | very high short-term activity on risky services | Very high volume of verification traffic on risky services on this number over the past 90 days. | ✔ | |
| 21013 | very high long-term activity on risky services | Very high volume of verification traffic on risky services on this number over the past 24 hours. | ✔ | |
| 21014 | very high short-term range activity on risky services | Very high volume of verification traffic on risky services on the range this number belongs to over the past 90 days. | ✔ | |
| 21015 | very high long-term range activity on risky services | Very high volume of verification traffic on risky services on the range this number belongs to over the past 24 hours. | ✔ |
other
Other A2P reason codes that do not fall into the sub-categories above.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 21003 | machine-like activity | Behavior pattern that suggests this number is being used by a bot. Although we expect a submitted number engaged in A2P traffic to communicate with automated systems, we don’t expect the user of that number to be an automated system. | ✔ | |
| 21016 | machine-like range activity | Extremely high volume of verification traffic in a very short period (less than 1 hour) on the range this number belongs to. | ✔ |
recency
Reason codes related to how recently the number was active.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 22001 | seen in the last 1 day | This number was seen in verification traffic in the last 1 day. | ||
| 22007 | seen in the last 7 days | This number was seen in verification traffic in the last 7 days. | ||
| 22015 | seen in the last 15 days | This number was seen in verification traffic in the last 15 days. | ||
| 22101 | seen in the last 1 month | This number was seen in verification traffic in the last 1 month. | ||
| 22102 | seen in the last 2 months | This number was seen in verification traffic in the last 2 months. | ||
| 22103 | seen in the last 3 months | This number was seen in verification traffic in the last 3 months. | ||
| 22203 | seen more than 3 months ago | This number was not seen in verification traffic in the last 3 months. |
p2p
Reason codes specific to person-to-person messaging (p2p). Two-way messaging between two humans, like one friend texting another.
| Code | Name | Meaning |
|---|---|---|
| 30201 | No P2P data analyzed. | P2P data was not analyzed. Cannot classify. |
number_type
Reason codes related to the number’s type. These are static attributes rather than measurements of behavior.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 40001 | premium number | This is a premium number. | ✔ | |
| 40002 | VOIP number | This is a VOIP number. | ✔ | |
| 40003 | toll-free number | This is a toll-free number. | ✔ | |
| 40004 | invalid number | This is an invalid number. | ✔ | |
| 40005 | payphone number | This number is associated with a payphone. | ✔ | |
| 40006 | voicemail number | This is a voicemail number. | ✔ | |
| 40007 | pager number | This number is associated with a pager. | ✔ | |
| 40008 | high-risk phone type | This number has another phone type that is risky, and that is not covered by any of the other number_type reason codes. | ✔ | |
| 40009 | high-risk carrier | This number is associated with a very risky carrier. | ✔ | |
| 40010 | medium-risk carrier | This number is associated with a risky carrier. | ✔ | |
| 40011 | high-risk prefix | This number has a risky prefix. | ✔ | |
| 40012 | phone too long | This number is invalid because it is too long, even after the application of cleansing rules. | ✔ | |
| 40013 | blacklisted number | This number has been flagged as a source of fraud. Intelligence always recommends to block this number. | ✔ | |
| 40014 | high-risk country | The country code of this number is for a risky country, one that originates a disproportionate share of fraud attacks. | ✔ | |
| 40015 | technical number | This number is used for special technical purposes by telecom companies, such as for roaming. | ||
| 40016 | number used by application | Telesign reserved this number for use by customers with our applications (for example to send verification messages), but it appears that it is being used for a different purpose. | ✔ | |
| 40017 | number whitelisted by customer | You have flagged this number as safe. Intelligence always recommends to allow this number. | ✔ | |
| 40018 | phone too short | This number is too short to be a valid phone number. | ✔ |
ip
Reason codes related to activity of the IP address you provided for this number (and its associated geolocation IDs), as compared to a good user.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 50001 | moderate short-term activity | Expected level of activity for this IP address over the last 24 hours. | ✔ | |
| 50002 | moderate long-term activity | Expected level of activity for this IP address over the past 90 days. | ✔ | |
| 50003 | moderate short-term activity on risky services | Significant activity for this IP address to or from risky services over the last 24 hours (see risky services above for definition of that term). | ✔ | |
| 50004 | moderate long-term activity on risky services | Significant activity on this IP address to or from risky services over the last 90 days (see risky services above for definition of that term). | ✔ | |
| 50005 | high short-term activity | More than expected activity for this IP address over the last 24 hours. | ✔ | |
| 50006 | high long-term activity | More than expected activity for this IP address over the past 90 days. | ✔ | |
| 50007 | high short-term activity on risky services | Very significant activity for this IP address to or from risky services over the last 24 hours (see risky services above for definition of that term). | ✔ | |
| 50008 | high long-term activity on risky services | Very significant activity on this IP address to or from risky services over the last 90 days (see risky services above for definition of that term). | ✔ | |
| 50009 | very high short-term activity | Very frequent changes of IP address attributes in verification traffic on this number over the past 24 hours. | ✔ | |
| 50010 | very high long-term activity | Very frequent changes of IP address attributes in verification traffic on this number over the past 90 days. | ✔ | |
| 50011 | short-term activity on risky services | Changes of IP address attributes in verification traffic on risky services on this number over the past 24 hours. | ✔ | |
| 50012 | long-term activity on risky services | Changes of IP address attributes in verification traffic on risky services on this number over the past 90 days. | ✔ | |
| 50013 | very high short-term activity on risky services | Very frequent changes of IP address attributes in verification traffic on risky services on this number over the past 24 hours. | ✔ | |
| 50014 | very high long-term activity on risky services | Very frequent changes of IP address attributes in verification traffic on risky services on this number over the past 90 days. | ✔ | |
| 50015 | anonymous proxy | This IP address is associated with anonymous proxies, which can help conceal the true origins of online traffic. | ✔ | |
| 50016 | VPN | This IP address is associated with virtual private networks (VPNs), which can help conceal the true origins of online traffic. | ✔ | |
| 50017 | hosting provider | This IP address is associated with web hosting servers, which have a pattern of activity different than genuine end users. | ✔ | |
| 50018 | TOR exit node | This IP address is associated with Tor anonymous browsers, which can help conceal the true origins of online traffic. | ✔ |
email
Reason codes related to activity of the email address you provided for this phone number.
| Code | Name | Meaning | Risk signal | Trust signal |
|---|---|---|---|---|
| 60001 | moderate short-term activity | Expected level of activity for this email address over the last 24-hours. | ✔ | |
| 60002 | moderate long-term activity | Expected level of activity for this email address over the past 90 days. | ✔ | |
| 60003 | moderate short-term activity on risky services | Significant activity for this email address to or from risky services over the last 24 hours (see risky services above for definition of that term). | ✔ | |
| 60004 | moderate long-term activity on risky services | Significant activity on this email address to or from risky services over the last 90 days (see risky services above for definition of that term). | ✔ | |
| 60005 | high short-term activity | More than expected activity for this email address over the last 24-hours. | ✔ | |
| 60006 | high long-term activity | More than expected activity for this email address over the past 90 days. | ✔ | |
| 60007 | high short-term activity on risky services | Very significant activity for this email address to or from risky services over the last 24 hours (see risky services above for definition of that term). | ✔ | |
| 60008 | high long-term activity on risky services | Very significant activity on this email address to or from risky services over the last 90 days (see risky services above for definition of that term). | ✔ | |
| 60009 | very high short-term activity | Very high volume of verification traffic on this email address over the past 24 hours. | ✔ | |
| 60010 | very high long-term activity | Very high volume of verification traffic on this email address over the past 90 days. | ✔ | |
| 60011 | machine-generated email | Behavior pattern that suggests this email address is being used by a software program. | ✔ | |
| 60012 | invalid email | This email address is invalid and could not have been used by a genuine end user. | ✔ | |
| 60013 | disposable email domain | This email address may have originated from a service providing temporary email addresses; these temporary addresses can be used to conceal the identity of the end user. | ✔ |
Updated 3 months ago