Regulation

GDPR and phone number intelligence: lawful basis for fraud prevention

GDPR Recital 47 states that processing personal data strictly necessary for preventing fraud constitutes a legitimate interest of the data controller. That gives fraud prevention a recognised route to a lawful basis under Article 6(1)(f), legitimate interests, but it is not a blank cheque: the processing still has to be necessary, proportionate, and balanced against the individual's rights. This page describes the general framework in plain terms. It is not legal advice and does not tell you whether any specific use of phone number data is lawful for your business.

Legitimate interest as a lawful basis

GDPR Article 6(1)(f) allows processing where it is necessary for the legitimate interests of the controller or a third party, provided those interests are not overridden by the interests or fundamental rights and freedoms of the data subject. Recital 47 gives fraud prevention as a named example: "the processing of personal data strictly necessary for the purposes of preventing fraud also constitutes a legitimate interest of the data controller concerned." That is a recital, which explains how the operative articles should be interpreted, rather than a standalone rule, but it is a direct and often-cited acknowledgement that fraud prevention sits within the legitimate interest basis.

The three-part test this still requires

Relying on legitimate interest is not automatic. It generally requires working through three questions, commonly described as the purpose test, the necessity test and the balancing test:

• Purpose test: is there a genuine, specific interest being pursued, such as preventing account takeover or onboarding fraud, rather than a vague general benefit?
• Necessity test: is the processing actually needed to achieve that purpose, and is there a less intrusive way to achieve the same result?
• Balancing test: do the individual's interests, rights and freedoms, including their reasonable expectations, override the controller's interest in this specific case?

Working through and documenting this test, commonly called a Legitimate Interests Assessment, is the practical output that supports relying on this basis, not the recital text alone.

Where phone number intelligence fits

A phone-based signal check, carrier, number type, active status or a SIM swap check, is generally a narrow, purpose-specific piece of processing: it uses a phone number already provided for a service relationship, to answer a specific fraud-relevant question, rather than building a broad profile of the individual. That fits the shape of processing Recital 47 has in mind, but the assessment is still yours to make and document for your own use case, data flows and jurisdiction. See GDPR-compliant telecom data for KYC for how Telebase's own data handling is structured.

Using a SIM swap check before an OTP is sent, or number type screening at onboarding, are both narrowly scoped to the fraud-prevention purpose, which tends to make the necessity and balancing questions more straightforward to answer than a broader profiling use case would.

What this page does not tell you

This page does not tell you that legitimate interest is the right basis for your specific processing, that your organisation has satisfied the balancing test, or that a Legitimate Interests Assessment is unnecessary. Those are conclusions that depend on your specific data flows, retention, transparency notices and jurisdiction, and they should come from your own data protection advice, not from a vendor's marketing page.

Signals available today