A sales rep dials a demo request and gets a disconnected tone. The number was formatted perfectly. It passed every check on the form. It just doesn't belong to anyone who asked for a demo.
That gap is the difference between phone validation and phone verification. Validation asks whether a string looks like a phone number. Verification asks whether the person on the form can receive a message at that number right now. HubSpot does the first out of the box. It doesn't do the second.
What HubSpot's phone validation checks
HubSpot validates phone number properties against a set of format rules. According to HubSpot's knowledge base, a valid number must:
- Include a valid country code, starting with a plus sign (+)
- Match number formatting for the chosen country code
- Include a valid area code or regional equivalent
- Contain between 4 and 15 digits
- Contain only numbers and a leading plus sign
These rules are useful. They catch typos, missing country codes and letters in the phone field, and they keep your CRM data consistent enough to dial and to sync with other tools.
None of them touch the phone network. The check runs on the characters, so any number that is shaped correctly passes, including:
- A number that was never assigned, or was disconnected last year
- A real number that belongs to someone else, typed by mistake or on purpose
- A number copied from a website, a lead list or a "fake number generator"
- Whatever a bot fills in, as long as it picks a plausible format
For a sales team the last three are the expensive ones. The record looks clean, it routes to a rep, and the problem only surfaces when someone dials.
Where reCAPTCHA fits
CAPTCHA answers a different question. HubSpot forms use Google's invisible reCAPTCHA v2: most visitors see nothing, and anyone Google considers suspicious has to solve a challenge before the form submits.
That targets automated traffic. It says nothing about the data a human types. A person who doesn't want a sales call can enter a fake number and pass CAPTCHA every time, because they are, in fact, human. And because CAPTCHA works on a risk score, some bots pass and some real visitors get a puzzle they abandon.
One HubSpot detail worth knowing: when CAPTCHA is on, HubSpot stops accepting submissions to that form from the Forms API and other form integrations. If anything else posts to the form, turning CAPTCHA on breaks it.
What verification adds
Verification is an active check. The form sends a one-time passcode (OTP) to the number by SMS or WhatsApp, and the submission only goes through once the visitor types the code back. To pass, the person filling the form has to be holding a phone that receives messages at that number.
That closes the gaps validation leaves open. An unassigned or disconnected number can't receive the code. Someone else's number sends the code to someone else. A bot filling random digits gets nothing back.
It has limits too, and it's worth being clear about them:
- Burner numbers that receive messages pass. OTP proves the visitor can receive at the number now, not that they will answer it next week. WhatsApp raises the bar slightly, since the number needs a WhatsApp account, but it doesn't remove the gap.
- It adds a step. Real visitors spend a few seconds entering a code. That's why it belongs on high-intent forms like demo and quote requests, not on a newsletter signup.
- A client-side gate can be skipped by posting straight to HubSpot. Verification that runs in the visitor's browser raises the cost of junk but isn't a server-side firewall. Marking verified contacts in HubSpot makes anything that skipped the check easy to filter out.
Validation, CAPTCHA and verification side by side
| Check | What it answers | Catches | Misses |
|---|---|---|---|
| Phone validation | Is this shaped like a phone number? | Typos, missing country codes, letters | Unassigned, disconnected and other people's numbers |
| reCAPTCHA | Is this probably a human? | A share of automated bots | Humans typing fake data, bots that score as human |
| Carrier lookup | Is this number assigned, and to what kind of line? | Unassigned numbers, landlines, some VoIP | Real numbers that belong to someone else |
| OTP verification | Can the submitter receive a message at this number now? | Fake, mistyped and borrowed numbers; bots | Burner numbers that receive messages |
The layers don't compete. Validation is free and keeps your data tidy. CAPTCHA filters a share of bots at no cost to most visitors. A carrier lookup, which some teams run in a workflow after submission, tells you whether a number is live and what kind of line it is. Verification is the only one that ties the number to the person on the form, so it's the one to put in front of the forms that feed your sales team.
Adding verification to HubSpot forms
HubSpot has no built-in OTP step for forms. FormVerify adds one to the HubSpot forms you already have, without rebuilding them:
- A visitor submits a protected form.
- FormVerify sends a six-digit code to the number on the form, over WhatsApp or SMS, from your own Meta or Twilio account.
- The visitor enters the code in a small popup on your page.
- Only then does the submission reach HubSpot, and the contact can be marked as verified.
You choose which forms are protected, so a demo request can require a code while a newsletter signup stays one click. Layered rate limits stop anyone from using your form to send messages in bulk, and messages bill at your provider's rates with no markup. It works on HubSpot pages and on HubSpot forms embedded in WordPress, Webflow and other sites (install guides).
For which channel to send codes on, see WhatsApp OTP vs SMS for HubSpot forms. To try it on a real form first, the live demo takes about a minute.