Verification Methodology

How We Verify Every Forex, Crypto & Casino Lead — Methodology 2026

A 7-step lead verification process that has delivered 250,000+ validated trader contacts to 500+ brokers since 2020. Source vetting, phone verification, GDPR consent capture, fingerprint-based dedup, activity scoring, real-time webhook dedup, and manual QA — every batch, every time. The result is a 95% deliverability guarantee you can take to your compliance team and your DPO.

Why methodology matters

Most lead providers can't tell you how they verify a lead. We can.

When a broker buys 500 leads and only 30% of the emails are deliverable, the problem isn't bad luck. The problem is that the provider has no methodology — they bought scraped data, slapped a "verified" label on it, and pocketed the difference.

ForexBrokerLead was founded by ex-affiliate-network operators who had seen the inside of the lead-reselling industry and were tired of it. We built our 7-step verification methodology because we needed a way to hold ourselves accountable — and because brokers kept asking us "how do you actually know this trader is real?" The honest answer is: we call them. We document their consent. We check them against every other lead we've ever delivered. We score their activity. We run real-time dedup at the webhook layer if they're being delivered live. And we manually sample-audit every batch before it leaves our system.

The result of that process is the 95% deliverability guarantee we put on every batch. It is not a marketing number we invented — it is the measured, audited outcome of running every lead through these seven steps. When a broker receives a CSV from us, they can hand it to their CRM team, their compliance team, and their DPO, and every one of those stakeholders will find what they need: deliverable contacts, documented consent, and zero duplicates from their previous orders.

This page documents each of the seven steps in detail — what we do, why we do it, and what we accept as proof of completion. If anything here is unclear, or if your compliance team needs a deeper dive on a specific step, contact us and we'll arrange a call with our QA lead. We treat our methodology as a living document — every quarter we review rejection rates, source performance, and broker feedback, and we tighten the process wherever the data tells us to.

95%

Deliverability guarantee

Verification steps

100%

Phone-verified leads

48h

Replacement SLA

The 7-step process

From source vetting to final QA — every lead, every batch

Each step below is non-negotiable. A lead that fails any single step is flagged as replacement-eligible and is never delivered to a paying customer.

Step 1 — Source Verification

Before a single lead ever enters our pipeline, we vet the source that produced it. Acceptable sources are limited to: (a) Tier-1 affiliate networks that operate regulated financial-education or comparison-portal websites with their own published privacy policies and demonstrable organic traffic, (b) publisher networks where the publisher is identifiable and the lead capture form is visible on a live URL, and (c) trader communities (Discord, Telegram, niche forums) where the opt-in form is gated behind a clearly-labelled financial-promotion consent checkbox. We do not accept leads from data brokers, scraped databases, "data co-registration" platforms, or any source that cannot produce a live landing-page URL on demand.

Each prospective source undergoes a 14-day onboarding period during which we accept a small test batch (typically 100 leads) and measure rejection rate at every subsequent step of our methodology. Sources with a rejection rate above 12% are rejected entirely. Sources with a rejection rate between 8% and 12% are placed on probation and re-tested quarterly. Only sources that consistently produce sub-8% rejection rates progress to our approved-source list, and even then every source is re-reviewed every 90 days against the same thresholds.

Source verification is the most important step in the methodology because no amount of downstream phone verification or dedup can fully rescue a batch of leads sourced from a sketchy provider. By the time a lead arrives in our system, we already know exactly which affiliate, which publisher site, and which landing-page URL produced it — and we have already vetted that source against our published Tier-1 criteria. This is the difference between a "verified" lead and a lead we can stand behind with a 95% deliverability guarantee.

Step 2 — Phone Verification

Once a lead has cleared source vetting, a trained call-centre agent dials the phone number on file. The call is made in the trader's local language (we operate in 14 languages including English, Spanish, Portuguese, German, French, Italian, Dutch, Swedish, Norwegian, Danish, Finnish, Arabic, Turkish, and Russian) and during local business hours. The agent confirms three things: (a) the trader's identity by repeating their name back, (b) the trader's consent to be contacted by a broker about financial products, and (c) the asset class the trader is interested in (forex, crypto, CFDs, stocks, options, casino, etc.).

If the trader does not answer on the first attempt, the agent attempts three callbacks on three different days at different times of day. If all three callbacks fail, the lead is escalated to a supervisor who reviews whether the phone number is still in service (via HLR lookup) and whether the source has a higher-than-expected unreachable rate. Unreachable leads are never delivered to a customer — they are flagged as replacement-eligible and either returned to the source for correction or removed from inventory permanently. Phone verification is the single biggest reason our 95% deliverability number holds up: we have already heard the trader's voice on the line.

Phone verification is also where we collect valuable secondary data that goes into the delivery CSV. The agent captures the trader's preferred contact window, their stated account-size interest (small / mid / VIP), and any explicit preferences about broker features they care about (leverage, platform, deposit methods, regulation tier). Premium tier customers receive this enriched data as additional columns in the CSV; Starter and Professional tier customers receive the standard fields. Every call is recorded for internal QA purposes and stored for 90 days in our encrypted call-archive.

Step 3 — GDPR Consent Capture

For every lead originating from the EU or EEA — and for every lead delivered to a broker regulated under EU or EEA law, regardless of the trader's country of residence — we document GDPR consent at the point of opt-in. Specifically, we capture: the source URL where the opt-in form was presented, the IP address of the trader at the moment of consent, the exact UTC timestamp of the consent click, the form version presented to the trader (so the language of the consent text is reproducible), and the privacy policy URL active on the source site at that moment.

Where the source operates a double opt-in flow — which is mandatory under German, Austrian, and Swiss data-protection practice, and which we require for all DE, AT, and CH sourced leads — we additionally capture the timestamp of the confirmation email click and the IP address of the confirmation. This double-opt-in confirmation record is appended to the lead as a supplementary field. For premium tier customers, all of these GDPR fields are included in the CSV delivery. For Starter and Professional tier customers, the consent timestamp and source URL are included by default; the IP and form-version fields are available on request to your DPO.

GDPR consent capture is not a checkbox we tick and forget. We maintain a Data Processing Agreement template that we provide to every customer on request, and we will sign customer-specific DPAs where required. We also support right-to-erasure requests: any trader who contacts us at privacy@forexbrokerlead.com with a verifiable identity claim is removed from our inventory and from any undelivered batch within 72 hours, and we confirm removal to the broker who received that lead in the past 90 days.

Step 4 — Duplicate Detection

A "fresh" lead that you've already received from another provider is not fresh — it is a duplicate, and it is the single most common reason brokers waste acquisition budget. Our duplicate detection is based on a three-key fingerprint: the normalised email address (lowercased, trimmed, plus-addressing stripped), the normalised phone number (converted to E.164 international format with country code), and the source IP at the moment of opt-in. These three keys are concatenated and SHA-256 hashed, and the resulting fingerprint is checked against our entire historical database — not just the current batch.

This historical database includes every lead we have ever delivered to any customer since 2020, plus every lead we have rejected from any source. When a new lead arrives and its fingerprint matches a record we have already delivered to your brokerage in the past 12 months, the new lead is removed from your batch before delivery. When the fingerprint matches a record we have delivered to a different broker in the past 90 days, the lead is flagged for the shared-tier policy (Starter and Professional tier customers may receive leads shared with up to 2 non-competing brokers in different geos; Premium tier customers receive exclusivity by default).

Duplicate detection runs as a continuous background job across our entire inventory. The fingerprint index is rebuilt nightly to ensure sub-200ms lookup times at delivery, and the index is audited weekly by our QA team to confirm that no fingerprint has been silently corrupted or dropped. If you ever suspect a duplicate in a delivery, send us the email and phone of the suspected duplicate and we will trace the full delivery history of that fingerprint within one business day.

Step 5 — Activity Scoring

A verified phone number and a documented GDPR opt-in are necessary but not sufficient — we also need to know whether the trader is actually active. Activity scoring assigns every lead a 1-to-5 score based on three signals: recency of last trade or last deposit, magnitude of historical deposit history, and recent activity on the trading platform the trader uses (MetaTrader 4, MetaTrader 5, cTrader, TradingView, or the broker's proprietary platform). A score of 5 means the trader has traded within the last 30 days, has a cumulative deposit history above €2,000, and has logged into their trading platform within the past 14 days.

The activity score is the single most predictive field in our CSV when it comes to deposit conversion. Across the 250,000+ leads we've delivered since 2020, traders with an activity score of 5 convert to first-time depositors at roughly 3.4× the rate of traders with an activity score of 2, and 7× the rate of traders with an activity score of 1. Premium tier customers can filter delivery by activity score — for example, ordering only score-4 and score-5 leads for a high-LTV acquisition campaign, or mixing scores for a broader top-of-funnel push.

Activity scoring is also where we filter out leads that look "active" but have actually gone dormant. A trader who has not placed a trade or made a deposit in the past 90 days is removed from our active inventory entirely — they are not eligible for delivery regardless of activity score, because the score would necessarily be 1 (no recent activity). This 90-day rule is the reason our leads are, on average, fresher than industry-standard "fresh" data, which can be 6-18 months old by the time it reaches a broker.

Step 6 — Real-Time Dedup (for API delivery)

For Premium tier customers who opt for real-time API delivery (webhook or REST endpoint), the static duplicate-detection step from Step 4 is supplemented with a real-time dedup layer running at the webhook. This means every lead is fingerprint-checked against our historical database again, in real-time, at the moment we attempt to deliver it to your endpoint — typically in under 50 milliseconds. If the lead's fingerprint was delivered to your endpoint in the past 12 months, the webhook call is blocked and the lead is removed from your batch.

Real-time dedup matters because the gap between batch assembly and batch delivery can be hours or even days, and during that gap a lead can theoretically be re-sourced by another affiliate and re-entered into our pipeline. Without real-time dedup, you could theoretically receive the same lead twice in the same week — once from a Tuesday batch and once from a Thursday batch. With real-time dedup at the webhook, that scenario is impossible: the second delivery attempt is blocked at the wire.

The real-time dedup layer also enforces your exclusivity policy. For Premium tier customers, if the lead's fingerprint was delivered to any other broker in the past 90 days, the webhook call is blocked and the lead is routed to the broker who has exclusivity on that fingerprint. This is the technical mechanism by which we honour the exclusivity guarantee on Premium tier orders — it is not a contractual promise we make in the MSA, it is a code-level enforcement that runs on every single webhook call.

Step 7 — Final QA & Manual Sample Audit

Before any batch is released to a customer, a human QA analyst pulls a random 10% sample and reviews it manually. The analyst re-opens the source URL to confirm the opt-in form is still live and the privacy policy URL is still valid. The analyst dials a random phone number from the sample to confirm the trader answers and confirms consent. The analyst checks the GDPR consent timestamp against the source's published opt-in form to confirm the form was operational at that moment. And the analyst cross-references the activity score against the trader's stated platform activity to confirm the score is defensible.

If any sample lead fails any of these manual checks, the entire batch is held — not just the failed lead. The batch goes back to the source for review, and the source's rolling 30-day rejection rate is recalculated. If a single batch fails manual QA more than once in a 30-day window, the source is suspended and reviewed by our compliance team. This is the strictest step in our methodology, and it is the reason we have suspended 19 sources since 2020 — we do not deliver batches that fail final QA, even if the failure rate is technically within tolerance.

The final QA step also produces the replacement-eligible flags that flow into our replacement policy. Any lead that fails any step in the methodology — source verification, phone verification, GDPR consent, dedup, activity scoring, real-time dedup, or manual QA — is flagged in our internal system as replacement-eligible. These leads are never delivered to a paying customer. If a customer reports a lead that they believe should have been flagged (an unreachable phone, a bounced email, a duplicate from a previous order), we honour the replacement guarantee and ship a replacement within 48 hours, no questions asked.

Compliance

Regulatory awareness across the jurisdictions we serve

Our methodology is designed to satisfy the strictest of the regulators our customers operate under — GDPR (EU/EEA), CCPA (California), and the data-protection principles expected by BaFin (Germany), FCA (United Kingdom), CySEC (Cyprus), ASIC (Australia), and the relevant GCC authorities.

GDPR compliance is the baseline. Every EU/EEA lead we deliver is accompanied by documented opt-in consent, source URL, IP at opt-in, UTC timestamp, and — where required — double opt-in confirmation. We will sign a Data Processing Agreement (DPA) with any customer on request, and we maintain our own DPA template that has been reviewed by external EU counsel. Right-to-erasure requests are honoured within 72 hours of verified identity, and we will confirm removal to any broker who received the trader's data in the past 90 days.

CCPA compliance applies to leads sourced from California residents and to brokers operating under California jurisdiction. We support "Do Not Sell My Personal Information" requests, and we do not sell lead data to third parties in any sense that would qualify as a "sale" under CCPA. Our relationship with each broker is a service-provider relationship governed by a written contract that prohibits the broker from reselling the leads we deliver.

BaFin and FCA awareness means we understand the financial-promotion rules that apply to brokers in Germany and the United Kingdom, and we structure our consent text accordingly. For German-sourced leads, the opt-in form is in German and includes the explicit "I consent to be contacted by financial services providers" language required under German law. For UK-sourced leads, the opt-in form complies with FCA financial-promotion rules including the requirement for clear risk warnings on the source page. We do not deliver leads to UK brokers that were sourced in a way that would put the broker's FCA compliance at risk.

What you get

Every lead is delivered with these data fields

Standard fields on every CSV. Premium tier adds IP-at-opt-in, language preference, and activity score.

Name

Full name of the trader as confirmed during phone verification. We do not deliver pseudonyms or partial names.

Email

Normalised email address (lowercased, trimmed, plus-addressing stripped) with confirmed deliverability.

Phone

E.164 international format with country code. Verified as in-service via HLR lookup and confirmed callable by our agents.

Country

Country of residence as confirmed by the trader during phone verification. Used for geo-targeting compliance.

Lead Type

Forex, crypto, casino, depositor, recovery, etc. — the asset class the trader consented to be contacted about.

Consent Timestamp

UTC timestamp of the trader's opt-in click. GDPR Article 7(1) evidence for your compliance team.

Source URL

The live URL of the page where the trader opted in. Verifiable by your DPO at any time after delivery.

Deposit History

Where available from the source: broker name, last deposit amount, last deposit date, and trading platform used.

Activity Score

1-to-5 score based on trade recency, deposit history, and platform activity. Premium tier only.

FAQ

Questions about our methodology

The most common questions compliance teams, DPOs, and growth leads ask before placing their first order.

It means that at least 95% of every batch of leads we deliver will have a valid, callable phone number and a working, deliverable email inbox. If your deliverability comes in below 95% on any batch, we replace the failed contacts free of charge within 48 hours, no questions asked. The metric is measured at the point of delivery and verified by our internal QA team before the file is ever sent to you.

Yes. For every lead originating from the EU or EEA, we store the source URL where the opt-in occurred, the IP address at the time of consent, the exact timestamp in UTC, the form version presented to the trader, and the privacy policy URL active at the moment of opt-in. Where the source operates a double opt-in flow (mandatory in DE, AT and CH), we capture the confirmation click as well. These records are available on request for your DPO and are also supplied as a supplementary column inside the CSV for premium tier customers.

We fingerprint every lead on three signals: normalised email address, normalised phone number (E.164 format), and source IP. These three keys are hashed and checked against our entire historical database — not just the current batch. If a fingerprint matches a lead already delivered to you or to any other broker in the past 12 months, the duplicate is removed before delivery. For real-time API customers, dedup is enforced at the webhook layer in under 50 milliseconds.

Yes. A trained call-centre agent dials every phone number in the batch before delivery. The agent confirms the trader's identity, confirms consent to be contacted by a broker, and confirms the asset class they're interested in (forex, crypto, CFDs, stocks, etc.). Calls are made in the trader's local language and local business hours. If the trader does not answer, we attempt three callbacks on three different days before the lead is escalated to a supervisor or removed from the batch.

Every lead is delivered with: full name, email address, phone number (E.164), country of residence, lead type (forex, crypto, casino, etc.), consent timestamp in UTC, source URL where the opt-in was captured, and — where the source provides it — deposit history (broker name, last deposit amount, last deposit date, trading platform used). Premium tier deliveries also include IP at opt-in, language preference, and a 1-5 activity score.

Leads that fail any of the seven verification steps are flagged as 'replacement-eligible' in our internal system. They are never delivered to a paying customer. Instead, they go back to the source for correction, or they are removed from our inventory permanently. If a source consistently fails QA — defined as more than 8% of leads rejected in a rolling 30-day window — that source is suspended and reviewed by our compliance team before any further inventory is accepted from them.

Free leads demo

Request a free 25-lead demo to see the methodology in action.

Tell us your target market and we'll send a real sample of 25 matched leads — sourced, phone-verified, GDPR-documented, deduplicated against your previous orders, activity-scored, and QA-audited by the same process described on this page. You'll see the exact CSV format and data fields you'll receive when you place a paid order.

There is no card required, no commitment, and no obligation. The demo is the same product we sell — not a stripped-down version. We deliver demos within 24 hours of request, and we follow up with a single email to ask whether you'd like to proceed to a paid Starter or Professional tier order. If the answer is no, we mark you as "demoed — not yet ready" in our CRM and we don't chase. We've found that brokers who see the methodology in action tend to come back when their next acquisition cycle starts.

Free leads demo — no card required

Your free leads demo — 25 leads in 24h

Tell us your target market. We'll send a real sample of 25 matched leads so you can see the exact format, data fields, and quality we provide — before you pay for anything.

Performance figures shown on this site are historical or internal benchmarks where stated. Actual results vary by market, offer, sales process and compliance requirements; no conversion, revenue or funding outcome is guaranteed. Read our verification and benchmark methodology.