Twilio Lookup v2 for AI Caller Validation: SIM Swap, Fraud, Identity Match (2026)

TL;DR — Hit Lookup v2 with the inbound caller ID before the AI says hello. line_type_intelligence, sim_swap, identity_match, reassigned_number, and sms_pumping_risk give you a 200 ms fraud and trust signal — score it, route on it.

Background

Lookup v2 evolved v1 with a richer data-package model. You request only what you need: validation, caller_name, sim_swap, call_forwarding, line_status, line_type_intelligence, identity_match, reassigned_number, sms_pumping_risk, phone_number_quality_score, pre_fill. Basic validation (E.164 + format) is free.

Architecture / config

flowchart LR
  CALL[Inbound] --> EDGE[Edge webhook]
  EDGE --> LOOK[Lookup v2 multi-package]
  LOOK --> SCORE[Trust score]
  SCORE -->|trusted| AI[AI greeting]
  SCORE -->|suspicious| STEP[Step-up auth via Verify]
  SCORE -->|fraud| END[End call / escalate]

CallSphere implementation

Every inbound call across Twilio across all products runs Lookup v2 in parallel with the TwiML response (we cache the result for 24 h per number).

Trust score input (simplified):

• VOIP & SIM-swap < 7 days → −40
• Reassigned number warning → −30
• Identity match high → +30
• Carrier mobile, no SIM-swap, no forwarding → +20

Healthcare requires score ≥ 30 before the AI exposes PHI tools; below that, Verify SMS step-up. Sales filters cold-outbound lists by line type to drop landlines (which ignore most SMS-based reactivations). 37 agents · 90+ tools · 115+ DB tables · 6 verticals · HIPAA + SOC 2 · $149 / $499 / $1499 · 14-day trial · 22% affiliate.

Build steps with code

const r = await twilio.lookups.v2.phoneNumbers(e164).fetch({
  fields: "line_type_intelligence,sim_swap,identity_match,reassigned_number,sms_pumping_risk",
  identityMatchFirstName: firstName,
  identityMatchLastName:  lastName,
});

const score =
  (r.lineTypeIntelligence?.type === "mobile" ? 20 : 0)
  + (r.simSwap?.lastSimSwap?.swappedInPeriod ? -40 : 0)
  + (r.reassignedNumber?.lastVerifiedDate ? -30 : 0)
  + (r.identityMatch?.firstNameMatch === "exact_match" ? 30 : 0);

// Cached response shape (truncated)
{
  "phone_number": "+15555550100",
  "valid": true,
  "line_type_intelligence": { "type": "mobile", "carrier_name": "Verizon" },
  "sim_swap": { "last_sim_swap": { "swapped_period": "P30D", "swapped_in_period": false } },
  "identity_match": { "first_name_match": "exact_match", "summary_score": 90 }
}

Pitfalls

• Buying every package on every call — costs add up fast. Buy on a budget.
• Trusting one signal — score, don't single-feature gate.
• Running lookup synchronously inside TwiML — race it; do not block the answer.
• Forgetting consent for identity match — some regions require explicit basis.
• Caching too long — SIM swap freshness is the whole point; 24 h is the max we'd cache.

FAQ

Q: Cost? Basic validation is free. Per-package pricing in 2026 ranges $0.0025–$0.05.

Q: Can I run it on outbound dialing? Yes — pre-flight checks before calls.create() saves spam-likely costs.

Q: Latency? P50 ~100 ms in us-east-1. Run in parallel with TwiML.

Q: Do all packages support all countries? No — sim_swap and identity_match coverage varies. Check the country matrix.

Q: Can I build on it for KYC? Combined with Verify, yes — many fintechs do.

Sources

• Twilio Docs — Lookup v2 API
• Twilio — Lookup product page
• Twilio Blog — 5 reasons to use Lookup
• Twilio — Migrate from Lookup V1 to V2

## Twilio Lookup v2 for AI Caller Validation: SIM Swap, Fraud, Identity Match (2026): production view Twilio Lookup v2 for AI Caller Validation: SIM Swap, Fraud, Identity Match (2026) forces a tension most teams underestimate: agent handoff state. A single LLM call is easy. A booking agent that hands a confirmed slot to a billing agent that hands a follow-up to an escalation agent — that's where context loss, hallucinated IDs, and double-bookings live. Solving it well means treating the conversation as a stateful workflow, not a chat. ## Serving stack tradeoffs The big fork is managed (OpenAI Realtime, ElevenLabs Conversational AI) versus self-hosted on GPUs you operate. Managed wins on cold-start, model freshness, and zero-ops; self-hosted wins on unit economics past a certain conversation volume and on data residency for regulated verticals. CallSphere runs hybrid: Realtime for live calls, self-hosted Whisper + a hosted LLM for async, both routed through a Go gateway that enforces per-tenant rate limits. Latency budgets are non-negotiable on voice. End-to-end target is sub-800ms ASR-to-first-token and sub-1.4s first-audio-out; anything beyond that and turn-taking feels stilted. GPU residency in the same region as your TURN servers matters more than choosing a slightly bigger model. Observability is the unglamorous backbone — every conversation produces logs, traces, sentiment scoring, and cost attribution piped to a per-tenant dashboard. **HIPAA + SOC 2 aligned** isolation keeps healthcare traffic separated from salon traffic at the storage layer, not just the API. ## FAQ **What's the right way to scope the proof-of-concept?** Real Estate runs as a 6-container pod (frontend, gateway, ai-worker, voice-server, NATS event bus, Redis) backed by Postgres `realestate_voice` with row-level security so multi-tenant data never crosses tenants. For a topic like "Twilio Lookup v2 for AI Caller Validation: SIM Swap, Fraud, Identity Match (2026)", that means you're not starting from scratch — you're configuring an agent template that's already been hardened across thousands of conversations. **How do you handle compliance and data isolation?** Day one is integration mapping (scheduler, CRM, messaging) and prompt tuning against your top 20 real call transcripts. Day two through five is shadow-mode running, where the agent transcribes and recommends but a human still answers, so you can compare side-by-side. Go-live is the moment your eval pass-rate clears your internal bar. **When does it make sense to switch from a managed model to a self-hosted one?** The honest answer: it scales until your tool catalog gets stale. The agent is only as good as the integrations it can actually call, so the operational discipline is keeping schemas, webhooks, and fallback paths green. The platform handles the rest — observability, retries, multi-region routing — without your team owning the GPU layer. ## Talk to us Want to see how this maps to your stack? Book a live walkthrough at [calendly.com/sagar-callsphere/new-meeting](https://calendly.com/sagar-callsphere/new-meeting), or try the vertical-specific demo at [salon.callsphere.tech](https://salon.callsphere.tech). 14-day trial, no credit card, pilot live in 3–5 business days.