Most fraudulent verification traffic never earns a stateful decision. It fails on the shape of the phone number alone — before any counter, any Redis read, any cost.
That's Layer 1: destination shape. It's free, it's stateless, and it runs first for exactly that reason.
Cheapest check, first position
Verifence decides in four layers, cheapest first, first rejection wins. Layer 1 touches no cache and holds no state, so it costs nothing but CPU. Everything after it — velocity windows, network reputation — pays a Redis round trip.
Ordering follows cost. You don't spend a cache read to reject a number that was never dialable in the first place.
What the shape alone tells you
Parsing a number with libphonenumber-style rules answers a surprising amount before you know anything about the sender.
- Malformed — wrong length, illegal characters, digits that can't form an E.164 number.
- Impossible — a length or prefix no carrier in that country assigns.
- Invalid — well-formed but not a real, in-use number range.
Each of these is a send that would bounce, fail, or route nowhere. There is no legitimate OTP going to an impossible number. Deny it and move on.
Premium-rate ranges bill the sender
The sharper case is premium-rate and special-service ranges. These are valid numbers — they parse cleanly — but a message to them can bill the sender, and that billing is the whole point of an SMS pumping attack.
An attacker drives verification sends into number ranges they profit from. The send "succeeds." The sender pays. Layer 1 recognizes those ranges by prefix and denies before a cent moves.
This is the layer that most directly maps to the product's promise: a deny is a message you never pay for.
Why stateless matters
Statelessness isn't just a performance note — it's what makes the check trustworthy under load.
A shape check gives the same answer for the same number every time, with no dependency on cache health. When Redis is degraded and the stateful layers fail open, Layer 1 is still running at full strength. The cheapest layer is also the most available one.
How much never reaches state
In practice a large fraction of blockable traffic — junk numbers, malformed input from broken clients, and premium-range probing — resolves right here. That traffic never consumes a velocity slot, never touches reputation, never costs a round trip.
Which is the point of putting it first. By the time a request reaches the layers that cost something, it has already earned the right to be there: it's at least a real, sendable, non-premium number.
Everything expensive is reserved for traffic that looks real. The rest fails for free.