How to Validate Phone Numbers in E.164 & Block VoIP Burner Lines Before Sending SMS OTPs in Node.js

// ❌ Warning: This only checks characters, not reality.
const phoneRegex = /^\+?[1-9]\d{1,14}$/;

if (!phoneRegex.test(userInput)) {
  throw new Error("Invalid phone number");
}

npm install express dotenv

import express from "express";

const app = express();
app.use(express.json());

const RAPIDAPI_KEY = process.env.RAPIDAPI_KEY || "YOUR_RAPIDAPI_KEY";
const PHONEGUARD_HOST = "phoneguard-phone-validation-and-carrier-fraud-detector.p.rapidapi.com";

/**
 * Validates a phone number using PhoneGuard API on RapidAPI
 */
async function inspectPhoneNumber(phone, defaultCountry = "US") {
  const url = `https://${PHONEGUARD_HOST}/v1/validate`;

  const response = await fetch(url, {
    method: "POST",
    headers: {
      "Content-Type": "application/json",
      "X-RapidAPI-Key": RAPIDAPI_KEY,
      "X-RapidAPI-Host": PHONEGUARD_HOST
    },
    body: JSON.stringify({ phone, defaultCountry })
  });

  if (!response.ok) {
    throw new Error(`PhoneGuard returned HTTP ${response.status}`);
  }

  return response.json();
}

/**
 * POST /api/auth/request-otp
 * Verifies phone legitimacy before triggering your SMS gateway
 */
app.post("/api/auth/request-otp", async (req, res) => {
  try {
    const { phone, countryCode = "US" } = req.body;

    if (!phone) {
      return res.status(400).json({ error: "Phone number is required." });
    }

    // 1. Inspect the phone number with PhoneGuard API (< 2ms)
    const inspection = await inspectPhoneNumber(phone, countryCode);

    if (!inspection.success) {
      return res.status(400).json({ error: "Invalid phone number." });
    }

    const { data, meta } = inspection;
    console.log(`[PhoneGuard] Inspected in ${meta.execution_time_ms} ms`);

    // 2. ⚡ Block high-risk, burner, or fraudulent numbers in ONE line
    if (data.fraudAnalysis.recommendation === "block") {
      return res.status(400).json({
        error: "This phone number cannot be verified.",
        reasons: data.fraudAnalysis.reasons
      });
    }

    // 3. Verify if the line type is actually capable of receiving SMS
    if (!data.canReceiveSms) {
      // Landline or Toll-Free: suggest alternative verification
      if (data.lineType === "FIXED_LINE") {
        return res.status(400).json({
          error: "Landlines cannot receive SMS. Please request a voice call verification.",
          lineType: data.lineType
        });
      }

      // VoIP or Virtual Burner Line: flag for manual review or email OTP
      return res.status(400).json({
        error: "Virtual VoIP numbers are not permitted. Please use a mobile carrier number.",
        lineType: data.lineType
      });
    }

    // 4. Retrieve canonical E.164 and IANA timezones for quiet-hours enforcement
    const e164Number = data.formats.e164; // e.g., "+14155552671"
    const userTimezones = data.country.timezones; // e.g., ["America/New_York", "America/Chicago", ...]

    console.log(`Sending SMS OTP to canonical E.164: ${e164Number}`);
    console.log(`User country: ${data.country.name} | Timezones: ${userTimezones.join(", ")}`);

    // 5. Safe to trigger Twilio / AWS SNS without burning budget!
    // await twilioClient.messages.create({ body: 'Your code is 482910', to: e164Number, from: '...' });

    return res.status(200).json({
      success: true,
      message: "OTP dispatched successfully.",
      carrierFormat: e164Number
    });

  } catch (error) {
    console.error("OTP Request failed:", error);
    return res.status(500).json({ error: "Internal server error." });
  }
});

app.listen(3000, () => {
  console.log("Server listening on http://localhost:3000");
});

{
  "success": true,
  "data": {
    "phone": "+14155552671",
    "isValid": true,
    "isPossible": true,
    "lineType": "FIXED_LINE_OR_MOBILE",
    "canReceiveSms": true,
    "formats": {
      "e164": "+14155552671",
      "international": "+1 415 555 2671",
      "national": "(415) 555-2671",
      "rfc3966": "tel:+14155552671"
    },
    "country": {
      "code": "US",
      "name": "United States of America",
      "callingCode": "+1",
      "continent": "North America",
      "timezones": [
        "America/Adak",
        "America/Anchorage",
        "America/Boise",
        "America/Chicago",
        "America/Denver",
        "America/Detroit",
        "America/Los_Angeles",
        "America/New_York",
        "Pacific/Honolulu"
      ],
      "primaryTimezone": "America/Adak",
      "totalTimezones": 29
    },
    "fraudAnalysis": {
      "riskScore": 15,
      "recommendation": "allow",
      "reasons": [
        "AMBIGUOUS_MOBILE_OR_FIXED_PREFIX",
        "SMS_DELIVERY_SUPPORTED"
      ]
    }
  },
  "meta": {
    "execution_time_ms": 0.42,
    "timestamp": "2026-11-08T07:45:00.000Z"
  }
}