SMS-24 is a multi-tenant SaaS that lets every user run their own AI workers across messaging (Telegram, WhatsApp), voice (real-time Telegram calls via Pipecat), and emulated Android devices. It also exposes real-time phone-reputation antifraud — a 50-millisecond verdict on any phone number against a graph of public SMS-receive numbers spanning 55+ countries.

What does an AI Worker do?

You create a Persona with a name, role, system prompt, biography, and knowledge base (free text plus uploaded PDF/DOCX/TXT/MD files). You link it to your Telegram and WhatsApp accounts. Inbound messages get auto-replied by the LLM you picked (OpenAI / Anthropic Claude / Google Gemini), using your own API key. You can also link a voice agent so the persona answers Telegram voice calls in real-time, and link device-action templates that the LLM can call as tools mid-conversation.

Do I bring my own LLM API keys?

Yes. SMS-24 is BYOK — you paste your own OpenAI, Anthropic, Google Gemini, Deepgram, Cartesia, and ElevenLabs keys in Settings. All keys are Fernet-encrypted at rest. Every LLM, STT, and TTS call from your personas bills your own account directly. We do not markup model usage.

What is persona function-calling?

When you link Android device-action templates to a persona, those actions are exposed to the LLM as OpenAI-compatible tools. Mid-conversation the model can decide to call them — for example send_whatsapp_text(phone, body), send_telegram_text(username, body), or install_apk_url(url). The action runs against your Android device(s) and the result is fed back into the conversation.

Can I route traffic through specific countries?

Yes. The operator runs a ProtonVPN orchestrator that spawns per-country VPN tunnels and exposes each tunnel as a SOCKS5 and HTTP proxy on the internal network. Your messenger accounts, voice agent, and emulated Android devices can all be pinned to a country — the matching proxy is auto-selected from the pool.

What is the phone antifraud product?

A REST API that returns a risk verdict on any phone in roughly 50 milliseconds. It draws on 12 orthogonal signals — public-board appearances, OTP collisions across services, fraud-ring cluster membership, carrier line-type, geo inconsistency and more. Used to block bot signups, fake KYC, and airdrop farms before you send an OTP.

How is data isolated between tenants?

Every user-scoped entity — personas, knowledge-base files, messenger accounts, Android devices, voice agents, service keys, action templates, action runs — carries an owner_user_id NOT NULL and is filtered at the SQL level by the authenticated user's id. Cross-tenant access returns HTTP 404, not 403, so the existence of other users' resources is never telegraphed. Secrets are Fernet-encrypted at rest.

Is SMS-24 GDPR compliant?

SMS-24 only ingests SMS messages and phone numbers that are already published on public SMS-receive websites. We never receive or store private SMS content from any user's phone. User-side data (personas, KB files, linked accounts, action runs) lives in your isolated tenant and can be exported or deleted on request. Billing data lives in Stripe.

What is the API rate limit?

Per-second rate limits scale with subscription tier: 2 requests per second on the daily plan, 10 on monthly, 30 on yearly. Limits apply per active API key. 429 responses include a Retry-After header.

How do I cancel my subscription?

Go to Billing in your account, click Cancel, and confirm with the SMS code we send to your verified phone. Cancellation takes effect at the end of your current billing period — access continues until then.

← Back to blog

Real-time phone antifraud: 50 ms, 12 signals

2026-05-22 · 8 min read

Most signup-fraud detection is reactive: bots register, drain your free credit, you find out next morning. Phone-reputation antifraud flips that around — you decide before you spend money sending the OTP at all.

We scrape 55+ public SMS-receive sites continuously and feed every message through a seven-stage NLP pipeline that extracts service name and OTP code. The result lands in a Neo4j graph: PhoneNumber nodes connected to Service nodes by OBSERVED_ON timestamp edges.

Twelve risk signals: public-board appearance, service diversity, category mix, cross-source presence, OTP volume, spam ratio, OTP-code collision rate, cluster membership, carrier line type, Telegram presence + age, geo inconsistency, composite risk score.

curl -H "X-API-Key: $KEY" https://sms-24.net/api/v1/lookup?number=+14155550132 returns risk_score, is_disposable, service_diversity, sources, services_used, cluster_tag, verdict — all in roughly 50 milliseconds.

Explainable: every flagged number ships with the list of signals that fired and their weights. We do NOT ingest private SMS, do NOT store OTP codes past 24h, do NOT ship a third-party tracker, do NOT resell user data.

Start free trial → · All features →

Real-time phone antifraud: 50 ms, 12 signals

Related