The Threat Hunter team monitors more than 20,000 open-source intelligence (OSINT) channels associated with fraud and cybercrime communities, as well as over 500,000 tools used in malicious operations. Our system automatically identifies and tracks channels frequently used by fraud networks and aggregates intelligence from these sources. Over time, this has enabled us to build a large-scale database of high-risk phone numbers and related activity patterns, providing enterprises with broad coverage and high-precision phone number risk profiling.

High-Risk Phone Number Overview-March

In March 2026, Threat Hunter captured over 5.81 million active high-risk phone numbers from fraud tools, phone-number trading marketplaces, and other cybercrime services. Among these, more than 4.2 million phone numbers were newly observed for the first time, accounting for 72.28% of the total.

This month, high-risk phone numbers detected were primarily used in the social media sector.

Geographically, the majority of these numbers were distributed in Mainland China and the United States.

Trends in High-Risk Phone Numbers-March

Trend 1: Widespread Use of High-Risk Phone Numbers Across Multiple Industries

Threat Hunter researchers analyzed the industry distribution of High-Risk Phone Numbers associated with underground fraud activities in March and found that their usage remains highly concentrated in key sectors. Among these, the social media sector ranked first with a 27% share, continuing to be the primary area where such numbers are actively used.

From a month-over-month perspective, the gap between industries has further narrowed, with the overall distribution becoming more balanced and diversified. Sectors such as e-commerce and retail (15%), entertainment (14%), financial services (13%), lifestyle services (13%), and software services (12%) are now showing increasingly similar proportions.

Despite a slight decline compared to February, the social media sector continues to maintain a clear lead, indicating that it remains a core focus area for fraudsters.

In the financial sector, High-Risk Phone Numbers are widely used by fraudsters across various stages of fraudulent operations, including loan fraud, account registration for transaction laundering, bulk loan applications, account warming for credit limit increases, fake identity registration, and participation in intermediary chains involving debt-related fraud. These numbers serve as a foundational resource for building fraudulent account ecosystems and executing lending-related fraud schemes.

In the social media sector, various platforms are heavily exploited by fraudsters due to their ability to support bulk account registration, account warming, traffic diversion for fraud, and redirection to other illicit services. These social accounts are then used to conduct a wide range of illegal and non-compliant activities.

Threat Hunter’s anti-fraud intelligence team will continue to monitor the evolving usage patterns of high-risk phone numbers across industries and track emerging risks associated with these activities.

Product Capability Improvements-March

Threat Hunter's profiling operation team has continuously expanded its global coverage. This month, further enhancements were made to strengthen coverage in the United States.

Based on the trend in regional coverage, Threat Hunter analysts observed that since March, multiple fraud groups have been posting advertisements about large-scale phone numbers in the U.S. Region. Threat Hunter rapidly reacted and maintained tracking, capturing over 1.27 million traditional OTP phone numbers in the U.S., representing a 154% month-over-month increase.

Data shows that among the new numbers within the fraud network, landline numbers account for as high as 71.37%, becoming the primary source and showing a clear trend of "concentrated large-scale release of landline numbers." This shift further validates the finding from the February 2026 global high-risk phone number trend report, which identified the emergence of new supply sources for U.S. landline numbers and a rebound in newly added volumes.

Threat Hunter will continue to track and monitor abnormal dynamics and material circulation in this region, and dynamically assess its potential impact on relevant industries.

Risks and Prevention Recommendations

If enterprises fail to prevent fraud networks from registering accounts using high-risk phone numbers, several risks may emerge. These accounts can then be used to launch marketing fraud attacks, generate invalid data, and disrupt normal business operations, resulting in the direct loss of marketing budgets. At the platform level, a surge in fake accounts can degrade ecosystem quality, reducing content trust and ultimately driving legitimate users away. In addition, fake accounts registered by fraudsters are often used for fraud and phishing attacks, posing a serious threat to users' property and privacy security. Enterprises may also face fines, lawsuits, or regulatory rectification requirements for violating data protection and anti-fraud regulations.

As fraud networks continuously evolve their tools, infrastructure, and attack resources, malicious activity has become increasingly difficult to detect, significantly raising the complexity of risk monitoring and prevention. To address the growing abuse of high-risk mobile numbers, Threat Hunter provides a "Identity Intelligence-Mobile" service to help enterprises identify and preblock malicious numbers, enabling a shift from "passive response" to "proactive prevention" against fraud attacks.

Explore your organization’s risk profile with a complimentary assessment snapshot.

For media inquiries, please contact marketing@threathunter.com.