A network traffic monitoring system detects an identity associated with a telephone call that enters a network and queries a first identity source list that includes entries representative of illegitimate identities and a second identity source list that includes entries representative of legitimate identities to determine whether the detected identity associated with the telephone call matches an entry included in the first identity source list or an entry included in the second identity source list. If the detected identity matches the entry included in the first identity source list, the network traffic monitoring system automatically determines that the detected identity is fake. If the detected identity matches the entry included in the second identity source list, the network traffic monitoring system analyzes one or more attributes of the telephone call other than the detected identity to determine whether the detected identity is fake.