Every signal ApplySift checks, and why
ApplySift gives each row a weight from the signals below and turns the total into a tier: Likely fraud at five or more, Review at two to four, Clear below two. The reasons are written into the scored file in these exact words, so you can disagree with any of them. The weights were set against one real pool of 1,455 applications to a remote engineering role, where a paid line-type API served as the reference; they will be re-tuned as more pools are seen.
| Reason | Weight | What it means and why it weighs that much |
|---|---|---|
| voip-wholesaler | 3 | The number's thousands-block is held by a carrier that sells numbers by API to VOIP platforms (Bandwidth, Onvoy, Inteliquent, Telnyx, Twilio, Peerless, Level 3 and others). Real applicants almost never give one; in the reference pool it matched the paid API's VOIP verdict on 99% of 1,416 numbers. The strongest single signal, but one short of Likely fraud on its own. |
| voip-app | 1 | A Google Voice block. Real people use Google Voice for job applications, so this only nudges. |
| phone-unassigned | 2 | No carrier holds the block or the exchange, so the number cannot currently ring. Usually a typo or a made-up number. |
| phone-invalid | 2 | Not a dialable North American number at all (wrong length, an N11 code, a 0 or 1 where there cannot be one). |
| phone-shared | 3 | The same number on more than one application. One person applying as several; the number was the thing they did not vary. Two shared signals together reach Likely fraud without anything else. |
| email-shared | 3 | The same mailbox on more than one application, after Gmail's dots and plus suffixes are removed. Same reasoning as a shared phone. |
| email-disposable | 3 | A throwaway domain (Mailinator, Guerrilla Mail and a short list of others). Nobody applies for a job from an inbox that expires in ten minutes. |
| email-provider | 1 | outlook.com, hotmail.com, live.com or msn.com. A fresh account takes a minute. In the reference pool, 90% of Outlook addresses also had a wholesaler phone, against 60% overall. Weak alone, because millions of real people use these too. |
| email-digits | 1 or 2 | Five or more digits in the local part (one point), seven or more (two). Generated addresses carry digits to stay unique; in the reference pool, addresses with five-plus digits were flagged by the phone check 80% of the time. |
| email-no-name | 1 | The local part has no four-letter run from the first or last name. A weak shape signal; plenty of real people have a handle unrelated to their name. |
| name-multi-email | 2 | The same first and last name under several mailboxes in one file. Sometimes a real person who applied twice; often one identity being reused. |
| burst | 0, plus 1 | Applied in an hour that held at least twenty applications and ten times the posting's median hourly rate. A job board syndicating your posting produces the same shape, so a burst never flags a row on its own; it adds one point to a row that already has another reason. |
What is deliberately absent
- Anything from outside your file. No device, IP, location or identity checks; those need the applicant to be interacting with a system that watches them, which a CSV is not.
- Any memory of people. ApplySift does not keep a list of names, numbers or addresses it has seen, and cannot tell you that someone applied elsewhere. A shared list of alleged fraudsters would make it a consumer reporting agency under the FCRA, with obligations neither you nor it wants.
- Résumé and answer text. Template reuse across résumés and identical screener answers are real signals; they need files the export does not carry. Planned, not built.
How to read the tiers
Likely fraud is where to look first, and in a bad pool it is where most of the pile goes. Review is one strong signal or a couple of weak ones; a glance at the résumé usually settles it. Clear means none of these signals fired, which is not proof of a real person, only the absence of the cheap tells.