How to Detect and Block Pay-Per-Call Fraud Before You Pay for It

A Medicare broker in Phoenix caught the same phone number calling eleven times across nine different tracking numbers in one week during AEP 2025. Each call lasted exactly 92 seconds — two seconds past the 90-second billing threshold. The caller answered the IVR questions, said enough words to sound qualified, then hung up. Eleven payouts at $35 each. $385 gone. One caller. One week.

That wasn't a confused senior who forgot they'd called. That was fraud.

I'll be honest: I spent way too long thinking junk call filters would catch this stuff. They won't.

Pay-per-call fraud isn't the same as junk calls. Junk is accidental — wrong numbers, pocket dials, confused people who wanted someone else. Fraud is intentional. Someone knows your payout structure and is gaming it. Incentivized caller farms. Repeat-number rings. Duration stuffing. Short-call gaming where callers hang up one second past threshold.

The patterns are different from junk filtering (which we covered in our junk call filtering guide). Fraud detection requires cross-campaign correlation, reputation tracking, and velocity analysis that goes beyond simple duplicate suppression. If you're still figuring out how pay-per-call billing works in the first place, start with our billing mechanics explainer — understanding your payout structure is step zero for fraud detection. I've watched operators set up junk filters and think they're protected — then lose thousands to fraud patterns those filters don't catch. It's frustrating to see, honestly.

Here's how to actually detect and block pay-per-call fraud before you pay for it.

Prerequisites

• A pay-per-call platform with cross-campaign analytics (VeloCalls, Ringba, or similar)
• Access to call detail records with timestamps, duration, and originating numbers
• Historical call data — at least 60 days for baseline patterns
• Understanding of your payout structure and billing thresholds

Step 1: Build a Cross-Campaign Caller Database

The single biggest mistake operators make: analyzing each campaign in isolation.

Fraudsters know this. They rotate through your tracking numbers. Campaign A sees one call from a number. Campaign B sees one call from the same number. Campaign C sees one. Each campaign thinks it's a unique caller. You pay three times. Classic.

Fix: correlate originating phone numbers across ALL campaigns.

Build a lookup table — or use your platform's built-in correlation if it has one. Every time a call comes in, check: has this number called any of your numbers in the last 30 days?

Cross-Campaign Correlation Query:
SELECT
  originating_number,
  COUNT(DISTINCT tracking_number) as unique_tracking_numbers,
  COUNT(*) as total_calls,
  AVG(duration) as avg_duration
FROM calls
WHERE call_date >= NOW() - INTERVAL 30 DAY
GROUP BY originating_number
HAVING total_calls >= 3
ORDER BY unique_tracking_numbers DESC

What you're looking for: numbers that appear across multiple tracking numbers with suspiciously consistent durations. Three calls in 30 days to three different tracking numbers, each lasting 91-94 seconds when your threshold is 90? That's not coincidence.

VeloCalls handles this automatically — the platform tracks originating numbers across campaigns and flags cross-campaign repeats. If you're evaluating platforms, our Ringba alternatives comparison covers how different platforms handle fraud detection. On Ringba, you'll need to build the correlation yourself via reporting exports or webhook aggregation. CallRail's call intelligence doesn't do cross-campaign correlation natively. (This might be my biggest gripe with CallRail, actually. Great for basic tracking. Falls apart when fraud gets clever.)

Step 2: Set Up Velocity Rules

Velocity = how fast calls are coming from the same source. Fraudulent patterns have distinctive velocity signatures.

24-hour velocity thresholds:

7-day velocity thresholds:

Why these numbers? A legitimate caller might call back once or twice — forgot a detail, wanted to compare another quote, had a dropped call. Three calls in 24 hours is pushing it. Five is suspicious. Ten? Fraud.

The velocity check needs to run pre-connect. Don't wait until the call ends to check — by then you might owe a payout. Check velocity before routing to a buyer.

Velocity Rule Logic:
ON new_call:
  velocity_24h = COUNT calls WHERE
    originating_number = incoming_number
    AND call_time >= NOW() - 24 hours

  IF velocity_24h >= 5:
    REJECT call
    ADD to suppression_list (7 days)
  ELIF velocity_24h >= 3:
    FLAG call as velocity_warning
    ROUTE normally but no payout on flag

One thing I learned the hard way: velocity rules need to account for legitimate call centers. If you're buying calls that get transferred through a center, the center's outbound number might hit velocity limits. Whitelist your known call centers by originating number to avoid blocking your own traffic. I once blocked 40% of a client's legitimate transfers for three days before we figured this out. Not my finest moment.

Step 3: Detect Duration Clustering

Here's where fraud gets clever. Callers learn your billing threshold and aim for it.

If your threshold is 90 seconds, fraudulent calls cluster at 91-95 seconds. Real calls have natural variance — some are 2 minutes, some are 8 minutes, some are 47 seconds and don't qualify. Fraud calls cluster unnaturally tight.

How to detect:

Pull all qualified calls from the last 30 days. Plot the duration distribution. Look for spikes.

A healthy distribution looks like a wide bell curve — most calls around 3-5 minutes for something like home services, with tails extending to 10+ minutes for complex jobs and dropping off below threshold.

A fraud-contaminated distribution shows a spike right at threshold + 2-5 seconds. That spike is your fraud.

Rule implementation:

Duration Clustering Rule:
IF call_duration BETWEEN threshold AND (threshold + 10 seconds)
  AND source has > 20% of calls in this range
  THEN flag source for review

IF call_duration BETWEEN threshold AND (threshold + 5 seconds)
  AND call_velocity from number >= 2 in 7 days
  THEN flag call as probable fraud

When I ran this analysis on a legal intake campaign, 34% of calls from one publisher ended between 180 and 185 seconds — threshold was 180. That publisher's calls had a 2% close rate. Industry average was 12%. They were sending coached callers who knew exactly how long to stay on the line. Cut the publisher. Saved roughly $8,400/month.

Yeah. $8,400. Monthly. From one publisher.

Step 4: Implement Reputation Scoring

Not all phone numbers are equal. Build a reputation model.

Factors that lower reputation:

• VoIP origination (not disqualifying, but adds suspicion)
• Carrier-reported spam score above 50
• Number age less than 90 days (new numbers used for fraud, then discarded)
• Previous calls from this number that didn't convert
• Number appears in shared fraud databases

Factors that raise reputation:

• Mobile origination from major carriers
• Number has been active 2+ years
• Previous calls from this number converted
• Geographic consistency between area code and campaign target

Scoring model:

Reputation Score (0-100, higher = more trusted):

Base score: 50

VoIP origination: -15
Carrier spam score > 50: -20
New number (< 90 days): -10
Previous non-convert: -10 per occurrence (cap at -30)
Known fraud database match: -50 (auto-reject)

Mobile carrier: +10
Number age > 2 years: +10
Previous convert: +15
Geographic match: +5

Action thresholds:

You don't need to build this from scratch. Services like Nomorobo and Hiya provide number reputation APIs. Twilio's Lookup API returns carrier info and spam scores. ClickzProtect correlates click fraud data with call fraud patterns if you're running paid search campaigns to drive calls — cross-channel fraud correlation is underrated.

Step 5: Watch for Incentivized Caller Patterns

Incentivized callers are people paid to dial your numbers. Someone runs a "get paid to make calls" scheme, gives callers your tracking numbers and a script, and collects your payouts.

Signatures of incentivized traffic:

• Calls cluster geographically. One zip code suddenly generates 40% of calls.
• Calls cluster temporally. Twenty calls between 2pm and 4pm on Tuesdays.
• Caller says "minimum viable words." Just enough to qualify. No natural conversation.
• Call recordings sound scripted or coached.
• Callers hang up immediately after qualification questions — no actual intent.

Detection rules:

Incentivized Traffic Rules:

Geographic cluster:
IF zip_code accounts for > 20% of calls in 7 days
  AND zip_code is not major metro
  THEN flag source for review

Temporal cluster:
IF > 5 calls from same source in 2-hour window
  AND pattern repeats across multiple days
  THEN flag source for review

Minimal engagement:
IF call qualifies (meets duration)
  BUT caller spoke < 30 seconds total
  THEN flag call for recording review

I spent a weekend listening to flagged recordings once. Painful. Hours of it. But I caught a pattern: callers saying "yes" to every qualification question in the exact same cadence. Same person? Different people with the same script? Either way, fraud. That source had been running for two months before we caught it.

Pro tip: AI transcription makes this easier now. VeloCalls' transcription add-on (4¢/min) lets you search call content. Look for callers who answer every question with single-word responses or repeat IVR prompts back verbatim — coached behavior. We've seen operators cut IVR abandonment rates while also catching more fraud — better IVR design naturally screens out low-intent callers.

Step 6: Build Publisher Quality Scores

The source of your traffic matters more than individual calls.

Track fraud signals by publisher/affiliate/source. Some sources are clean. Some are dirty. Cut the dirty ones instead of playing whack-a-mole with individual calls.

Publisher scorecard metrics:

• Conversion rate vs campaign average
• Fraud flag rate (what % of their calls get flagged?)
• Duration variance (narrow variance = suspicious)
• Cross-campaign repeat rate (their callers hitting multiple campaigns)
• Geographic distribution (concentrated = suspicious)

Scoring:

If a publisher hits 2+ red flags, put them on probation. 3+ red flags, cut them.

I've seen operators reluctant to cut high-volume publishers. "But they send us 500 calls a week!" Yeah, and 150 of those are fraud. Your effective CPL from that publisher is 40% higher than you think. Do the math. Our publisher ROI tracking guide shows how to calculate true CPL by source — essential for catching underperforming publishers before fraud compounds the problem.

Strong opinion: most operators wait too long to cut dirty publishers. Six weeks of "monitoring" while you're bleeding money. If they hit 3 red flags, cut them today. You can always re-enable later if the data was wrong. It almost never is.

Step 7: Set Up Real-Time Alerts

Don't wait for weekly reports. Fraud accelerates when it's working. A fraud ring that finds a vulnerability will hammer it until you notice.

Alert triggers:

• Velocity spike: any number generating 5+ calls in 24 hours
• Geographic anomaly: 10+ calls from an unexpected zip in 4 hours
• Duration clustering spike: threshold-adjacent calls up 50% vs baseline
• Publisher quality drop: sudden conversion rate decline
• Cross-campaign repeats: single number hitting 3+ campaigns same day

Push these to Slack, email, or SMS. When fraud is running, hours matter.

On VeloCalls, these alerts are configurable per campaign. On Ringba, you'll need to build webhook-to-notification flows yourself — their alerting is limited to basic billing notifications. Annoying. For the analytics backend that surfaces these patterns, JustAnalytics can aggregate call data across platforms if you're running multiple.

Common Errors and How to Fix Them

Error: Blocking legitimate callbacks as fraud

Cause: Velocity rules too aggressive, no same-buyer exception.

Fix: Add a bypass for calls where the previous call from that number routed to the same buyer. A homeowner calling back the same plumber isn't fraud.

Error: Geographic rules blocking legitimate rural traffic

Cause: Concentration thresholds too tight for thin markets.

Fix: Adjust thresholds per campaign. A national campaign hitting 40% concentration from one zip is suspicious. A campaign targeting only Maricopa County, Arizona hitting 40% from Phoenix is normal.

Error: Reputation scoring rejects too many VoIP calls

Cause: VoIP penalty too heavy for your traffic mix.

Fix: Reduce VoIP penalty from -15 to -5. Or segment: allow VoIP on lower-value campaigns, block on high-payout verticals where fraud incentives are higher.

Error: Publishers disputing fraud flags

Cause: No evidence trail.

Fix: Log everything. Timestamp, originating number, duration, fraud rule triggered, score breakdown. When publishers dispute, show them the data. They'll still argue. Some of them lie. But at least you've got receipts.

Next Steps

You've got fraud detection in place. What now?

Layer conversation intelligence. Duration and velocity catch obvious fraud. Sophisticated fraud talks long enough with enough words to pass basic filters. AI transcription and sentiment analysis catch the patterns — coached responses, scripted language, inconsistent intent. Our AI voice qualification guide covers when AI screening adds to CPL vs when it cuts it. VeloCalls includes AI conversation intelligence with transcription at 4¢/min and AI summaries at 10¢/call.

Correlate with click fraud. If you're running paid search to drive calls, the click and the call might both be fraudulent. One network runs fake clicks AND incentivized callers. ClickzProtect flags fraudulent clicks; correlating those with downstream call fraud catches fraud rings operating across channels.

Share intelligence with your network. Some operators share fraud phone numbers across buyers. If three unrelated buyers all get hit by the same number, everyone benefits from knowing. Industry-shared suppression lists exist — ask your platform or network if they participate.

Audit your billing structure. Per-call flat payouts incentivize duration stuffing. Per-minute billing (like VeloCalls' 4¢/min Managed tier dropping to 2¢/min at 200K+ minutes) means a fraudulent 91-second call costs you less than $0.07, not $35. The billing model itself shapes the fraud you attract.

Frequently Asked Questions

What's the difference between pay-per-call fraud and junk calls?

Junk calls are unintentional garbage — wrong numbers, accidental dials, confused callers. Fraud is intentional. Someone is gaming your system for payout: incentivized callers paid to dial, repeat-number rings from the same person across tracking numbers, or duration stuffing to hit your billing threshold. Junk calls cost you money through inefficiency. Fraud costs you money by design. The detection methods overlap but the intent is different — and fraud patterns require more aggressive blocking since the caller is actively trying to evade your filters.

How do I identify incentivized callers in my pay-per-call campaigns?

Look for clusters of calls from the same geographic area to the same tracking numbers within tight time windows — incentivized caller farms often batch their work. Check for calls that follow an identical script or say nearly nothing beyond minimum qualification. Cross-reference caller phone numbers against known fraud databases and look for VoIP origination on campaigns targeting mobile users. Duration patterns matter too: if 80% of calls from one source end within 5 seconds of your billing threshold, that source is coaching callers.

What velocity rules should I set to catch repeat-number fraud?

Start with a 24-hour rolling window: flag any phone number that generates more than 3 calls within 24 hours across any of your tracking numbers. For 7-day windows, flag at 5+ calls. Auto-block at 10+ calls per week from the same originating number. The key is tracking across ALL your campaigns — fraudsters rotate through tracking numbers assuming you're not correlating. Cross-campaign correlation is what catches them.

Should I block calls from VoIP numbers entirely?

Not entirely — legitimate callers use VoIP (Google Voice, business lines). But VoIP calls should face extra scrutiny. Require IVR interaction (bots fail DTMF input), check for geographic consistency between the VoIP provider region and the caller's stated location, and weight VoIP calls lower in your fraud scoring model. For high-value verticals like legal or Medicare where fraud payouts are larger, some operators block VoIP entirely during AEP or mass tort peaks when fraud spikes. Test the conversion rate on VoIP traffic vs mobile before making that call.

Try VeloCalls for Your Vertical

Pay-per-call platform built for HVAC, plumbing, roofing, PI lawyers, Medicare brokers, and insurance. Smart routing, real-time bidding, visual IVR builder, AI conversation intelligence (AI sales agents coming soon). Per-minute pricing — Managed starts at 4¢/min and drops to 2¢/min at Enterprise volume. BYOC starts at 2¢/min, goes down to 0.5¢/min.

See pricing → · Book a demo