How SaaS Companies Reduce Account Fraud by 73% with Phone Verification

// Phone-First Security Verification System
import { PhoneCheckClient } from '@phone-check/sdk';

class SecurityVerificationService {
  private phoneCheck: PhoneCheckClient;
  private riskScoring: RiskScoringEngine;

  constructor() {
    this.phoneCheck = new PhoneCheckClient({
      apiKey: process.env.PHONE_CHECK_API_KEY,
      timeout: 5000,
      retries: 3
    });
    this.riskScoring = new RiskScoringEngine();
  }

  async performSecurityVerification(userInput: UserInput, context: RequestContext): Promise<VerificationResult> {
    const startTime = Date.now();

    try {
      // Step 1: Primary phone validation
      const phoneValidation = await this.phoneCheck.validatePhone({
        phone: userInput.phoneNumber,
        includeCarrierInfo: true,
        includeRiskScoring: true,
        includeGeolocation: true
      });

      // Step 2: Calculate comprehensive risk score
      const riskProfile = await this.calculateRiskProfile(phoneValidation, userInput, context);

      // Step 3: Determine verification strategy
      const verificationStrategy = this.determineVerificationStrategy(riskProfile);

      // Step 4: Execute verification based on risk level
      const result = await this.executeVerification(userInput, verificationStrategy);

      // Step 5: Log security event for monitoring
      await this.logSecurityEvent({
        eventType: 'VERIFICATION_ATTEMPT',
        userId: userInput.userId,
        riskScore: riskProfile.totalScore,
        strategy: verificationStrategy.level,
        result: result.success ? 'PASSED' : 'FAILED',
        processingTime: Date.now() - startTime,
        metadata: {
          phoneType: phoneValidation.type,
          carrierRisk: phoneValidation.carrier?.riskLevel,
          geographicRisk: phoneValidation.geography?.riskScore,
          deviceFingerprint: context.deviceFingerprint
        }
      });

      return {
        success: result.success,
        riskProfile,
        verificationLevel: verificationStrategy.level,
        recommendedActions: result.actions,
        processingTime: Date.now() - startTime
      };

    } catch (error) {
      console.error('Security verification error:', error);

      // Fail securely - block on system errors
      await this.logSecurityEvent({
        eventType: 'VERIFICATION_ERROR',
        error: error.message,
        userId: userInput.userId
      });

      return {
        success: false,
        error: 'Verification service temporarily unavailable',
        requiresManualReview: true
      };
    }
  }

  private async calculateRiskProfile(phoneValidation: PhoneValidationResult, userInput: UserInput, context: RequestContext): Promise<RiskProfile> {
    let riskScore = 0;
    const riskFactors: string[] = [];
    const qualitySignals: string[] = [];

    // Phone validation risk factors (primary)
    if (!phoneValidation.valid) {
      riskScore += 100;
      riskFactors.push('invalid_phone_number');
    }

    if (phoneValidation.type === 'VOIP') {
      riskScore += 40;
      riskFactors.push('voip_number_detected');
    } else if (phoneValidation.type === 'MOBILE') {
      riskScore -= 10;
      qualitySignals.push('legitimate_mobile_number');
    }

    if (phoneValidation.isDisposable) {
      riskScore += 80;
      riskFactors.push('disposable_phone_number');
    }

    if (phoneValidation.isTollFree) {
      riskScore += 25;
      riskFactors.push('toll_free_number');
    }

    // Carrier intelligence scoring
    if (phoneValidation.carrier) {
      const highRiskCarriers = ['google-voice', 'textnow', 'textfree', 'pinger'];
      if (highRiskCarriers.includes(phoneValidation.carrier.name.toLowerCase())) {
        riskScore += 60;
        riskFactors.push('high_risk_carrier');
      }

      if (phoneValidation.carrier.isPrepaid) {
        riskScore += 30;
        riskFactors.push('prepaid_carrier');
      }
    }

    // Geographic risk assessment
    if (phoneValidation.geography) {
      const highRiskCountries = ['XX', 'YY']; // Configurable based on business needs
      if (highRiskCountries.includes(phoneValidation.geography.countryCode)) {
        riskScore += 35;
        riskFactors.push('high_risk_geography');
      }

      // Check for geographic inconsistencies
      if (context.ipCountry && context.ipCountry !== phoneValidation.geography.countryCode) {
        riskScore += 45;
        riskFactors.push('geographic_inconsistency');
      }
    }

    // Behavioral risk factors
    if (context.isNewDevice) {
      riskScore += 15;
      riskFactors.push('new_device');
    }

    if (context.isSuspiciousIP) {
      riskScore += 50;
      riskFactors.push('suspicious_ip_address');
    }

    // Velocity checks
    const recentAttempts = await this.getRecentVerificationAttempts(context.ipAddress);
    if (recentAttempts.length > 5) {
      riskScore += 70;
      riskFactors.push('high_velocity_attempts');
    }

    // Quality signal bonuses
    if (phoneValidation.activityScore > 0.7) {
      riskScore -= 15;
      qualitySignals.push('active_phone_number');
    }

    if (phoneValidation.ageInDays > 365) {
      riskScore -= 10;
      qualitySignals.push('established_phone_number');
    }

    // Business pattern detection
    if (this.isBusinessNumber(phoneValidation)) {
      riskScore -= 20;
      qualitySignals.push('business_phone_pattern');
    }

    return {
      totalScore: Math.max(0, Math.min(100, riskScore)),
      riskFactors,
      qualitySignals,
      phoneIntelligence: {
        isValid: phoneValidation.valid,
        type: phoneValidation.type,
        carrier: phoneValidation.carrier,
        geography: phoneValidation.geography,
        activityScore: phoneValidation.activityScore
      }
    };
  }

  private determineVerificationStrategy(riskProfile: RiskProfile): VerificationStrategy {
    if (riskProfile.totalScore >= 70) {
      return {
        level: 'HIGH_RISK',
        requires: ['phone_verification', 'document_upload', 'manual_review'],
        allowedActions: ['limited_access']
      };
    } else if (riskProfile.totalScore >= 40) {
      return {
        level: 'MEDIUM_RISK',
        requires: ['phone_verification', 'additional_questions'],
        allowedActions: ['full_access_with_monitoring']
      };
    } else if (riskProfile.totalScore >= 20) {
      return {
        level: 'LOW_RISK',
        requires: ['phone_verification'],
        allowedActions: ['full_access']
      };
    } else {
      return {
        level: 'TRUSTED',
        requires: [],
        allowedActions: ['full_access', 'elevated_privileges']
      };
    }
  }

  private async executeVerification(userInput: UserInput, strategy: VerificationStrategy): Promise<VerificationResult> {
    if (strategy.level === 'TRUSTED') {
      return { success: true, actions: ['grant_full_access'] };
    }

    // Execute phone verification if required
    if (strategy.requires.includes('phone_verification')) {
      const otpResult = await this.sendOTPVerification(userInput.phoneNumber);
      if (!otpResult.success) {
        return { success: false, actions: ['block_access'] };
      }
    }

    // Execute additional verification steps as needed
    for (const requirement of strategy.requires) {
      switch (requirement) {
        case 'document_upload':
          const docResult = await this.requestDocumentUpload(userInput.userId);
          if (!docResult.success) return { success: false, actions: ['block_access'] };
          break;

        case 'additional_questions':
          const qaResult = await this.requestAdditionalQuestions(userInput);
          if (!qaResult.success) return { success: false, actions: ['block_access'] };
          break;

        case 'manual_review':
          await this.flagForManualReview(userInput.userId, strategy);
          return { success: false, actions: ['pending_review'] };
      }
    }

    return {
      success: true,
      actions: strategy.allowedActions
    };
  }

  private isBusinessNumber(phoneValidation: PhoneValidationResult): boolean {
    // Heuristics for business number detection
    const businessPatterns = [
      /^\+?[1-9]\d{1,14}$/, // Standard international format
      /^\d{3}-\d{3}-\d{4}$/, // North American business format
      /^\+44 \d{4} \d{6}$/ // UK business format
    ];

    return businessPatterns.some(pattern => pattern.test(phoneValidation.number)) &&
           phoneValidation.type === 'FIXED_LINE' &&
           phoneValidation.carrier?.type === 'business';
  }

  // Additional helper methods for monitoring, logging, and analytics
  private async logSecurityEvent(event: SecurityEvent): Promise<void> {
    // Implementation for security event logging
  }

  private async getRecentVerificationAttempts(ipAddress: string): Promise<VerificationAttempt[]> {
    // Implementation for velocity checking
    return [];
  }

  private async sendOTPVerification(phoneNumber: string): Promise<OTPResult> {
    // Implementation for OTP verification
    return { success: true };
  }

  private async requestDocumentUpload(userId: string): Promise<DocumentResult> {
    // Implementation for document verification
    return { success: true };
  }

  private async requestAdditionalQuestions(userInput: UserInput): Promise<QAResult> {
    // Implementation for additional security questions
    return { success: true };
  }

  private async flagForManualReview(userId: string, strategy: VerificationStrategy): Promise<void> {
    // Implementation for manual review flagging
  }
}

// Usage example in user registration flow
const securityService = new SecurityVerificationService();

app.post('/api/register', async (req, res) => {
  try {
    const verificationResult = await securityService.performSecurityVerification(req.body, {
      ipAddress: req.ip,
      userAgent: req.headers['user-agent'],
      deviceFingerprint: req.headers['x-device-fingerprint'],
      isNewDevice: true,
      isSuspiciousIP: await checkSuspiciousIP(req.ip)
    });

    if (verificationResult.success) {
      // Proceed with user registration
      const user = await createUser(req.body);
      res.json({ success: true, userId: user.id });
    } else {
      // Handle verification failure
      res.status(403).json({
        error: verificationResult.error || 'Verification failed',
        requiresManualReview: verificationResult.requiresManualReview
      });
    }
  } catch (error) {
    res.status(500).json({ error: 'Registration failed' });
  }
});