How to Stop Fake Leads From Online Forms in 3 Simple Setups (Step-by-Step)

Hook: Here’s exactly how to stop fake leads from your online forms-step by step. Pick your setup (Meta Instant Form, Landing Page with OTP, or Landing Page with validation) and follow the instructions.

Setup A: How to enable phone OTP on Meta Instant Forms (5 steps)

1) Create or edit your lead form

• Go to Ads Manager > Create > Leads > Instant Form (or edit an existing form).
• Choose the form type you normally use (e.g. Higher Intent is fine).

2) Add the phone number field

• Make Phone number a required field.
• Ensure the correct country format is applied for your audience.

3) Turn on OTP/Contact field verification for phone

• In the form builder, open Settings or the field-level options.
• Look for a setting labeled Verify phone, Contact field verification, or OTP. Toggle it ON for phone numbers.
• If available, set the verification to Required so the form only submits after a correct code is entered.

4) Add clear copy for users

• In the form intro or near the phone field, add: “We’ll text you a one-time code to confirm your number.”

5) Test the full flow

• In Ads Manager, use Preview to open the form on your phone and desktop.
• Enter a real phone number > receive code > enter code > submit.
• Confirm the lead arrives in your CRM with the verified phone number.

Setup B: How to add OTP to your landing page form (8 steps)

1) Pick an OTP provider

• Options: Twilio Verify, MessageBird Verify, AWS SNS/Pinpoint, Firebase Phone Auth.
• Create an account and get API credentials.

2) Validate the phone on the front end

• Use a library like libphonenumber to format and validate the number (e.g. E.164 format).
• Disable the “Send code” button until the number passes basic validation.

3) Build the Send Code endpoint (server)

• Endpoint: POST /otp/send
• Inputs: phone_number, country (optional)
• Actions:

 - Generate a 6-digit code.  - Store a hashed version with a 5-10 minute TTL (e.g. Redis/DB) keyed by phone_number + session.  - Rate-limit by IP/phone (e.g. 1 request per 30-60 seconds, max 3-5 attempts per hour).  - Call your OTP provider to send the SMS.

• Response: success or error message for the UI.

4) Build the Verify Code endpoint (server)

• Endpoint: POST /otp/verify
• Inputs: phone_number, code
• Actions:

 - Lookup hashed code, check match and TTL.  - On success, mark phone_verified = true (session flag or signed token returned to client).  - Invalidate used codes.

• Response: verified flag or a short-lived token you’ll require to submit the form.

5) Update your form UI

• Fields: Name, Email, Phone, OTP code input, Submit.
• Flow:

 - User enters phone > clicks Send code.  - Show timer (e.g. “Resend in 30s”) and display the OTP input field.  - On code entry, call /otp/verify and show “Phone verified” if successful.  - Enable the Submit button only when phone_verified = true.

6) Secure the final submit (server)

• On form submit, verify the phone_verified flag/token server-side before accepting the lead.
• Reject submissions without a valid verification token.

7) Handle edge cases

• Allow resend after 30-60 seconds with a visible countdown.
• Limit wrong code attempts (e.g. lock after 5 tries, ask to resend).
• Optional fallback: offer a voice call OTP if SMS fails.

8) Test the end-to-end journey

• Real number: should receive code and submit successfully.
• Wrong code: blocked with a clear error.
• Expired code: prompt to resend.
• Multiple rapid attempts: rate-limit errors appear.

Setup C: How to reduce fake leads without OTP using real-time checks (7 steps)

1) Front-end validation for phone and email

• Phone: use libphonenumber for format and length.
• Email: basic syntax check (HTML5 email input or a proven validator).

2) Server-side hard checks (don’t rely only on the browser)

• Re-validate phone and email server-side.
• Block obvious fakes: repeated digits (e.g. 1111111111), known test values (test@test.com), and empty/invalid patterns.

3) Use email verification APIs

• Options: Kickbox, ZeroBounce, NeverBounce, Emailable.
• On submit, run a quick verify call for deliverability and disposable-domain detection.
• If undeliverable or disposable, reject or ask for a different email.

4) Use phone intelligence APIs (optional)

• Options: numverify, AbstractAPI, Twilio Lookup.
• Check line type (mobile vs. VoIP), country match, number validity.
• Reject invalid numbers and prompt for correction.

5) Block disposable and typo domains

• Maintain a list of disposable domains (regularly update) and suggest fixes for common typos (e.g. gmail.com vs. gmial.com).
• Show inline suggestions: “Did you mean gmail.com?”

6) Add friction for bots, not humans

• Add a hidden honeypot field and time-on-page check (reject forms submitted in <2-3 seconds).
• Use reCAPTCHA v3 or hCaptcha with server-side verification.
• Rate-limit by IP/device for rapid, repeated submissions.

7) De-duplicate and throttle

• Before saving, check if the same phone/email was submitted recently (e.g. last 24-72 hours).
• If duplicate, merge or flag instead of creating a new lead record.

Copy you can paste (for clarity and trust)

• Near phone field: “We’ll send a one-time code to confirm your number and keep spam away.”
• Near email field: “We verify email to make sure we can reach you.”
• Error examples:

 - “That code is incorrect. Try again or resend a new code.”  - “We couldn’t verify this email. Please use a valid, non-disposable email.”

Test checklist (run this before going live)

• Meta Instant Form OTP:

 - Preview on iOS and Android, verify code arrival and submission.  - Confirm CRM receives verified phone.

• Landing Page OTP:

 - Valid number flow, wrong code, expired code, resend limit, voice fallback (if enabled).  - Server rejects submit without verified token.

• Validation-only setup:

 - Block disposable email, suggest typo fixes, block obvious fake numbers, pass a real contact.  - CAPTCHA score/response is logged and validated server-side.

Quick implementation plan

• If you use Meta Instant Forms: 20-30 minutes to enable OTP and test.
• If you add OTP to a landing page: 2-6 hours to wire provider, endpoints, UI, and tests.
• If you add validation only: 1-3 hours to integrate libraries/APIs and rules.

Want help implementing any of these setups? Book a free consultation: https://kratos.marketing/kratos-consultation/

KEY STEPS RECAP

• Meta Instant Forms: Turn on phone OTP and test the submission flow.
• Landing Pages (OTP): Add send/verify endpoints, gate submit until verified, and rate-limit.
• Landing Pages (No OTP): Add real-time email/phone validation, anti-bot checks, and de-duplication.