Number Verification API

A Number Verification API lets an app or website ask a user's mobile operator whether the phone number the user entered belongs to the SIM in the device they are using right now. The operator answers from its own network data, so no code is sent and the user types nothing. The open standard is the CAMARA NumberVerification API, part of the telecom industry's network-API programme known as GSMA Open Gateway.

#How does the Number Verification API work?

The CAMARA project, hosted by the Linux Foundation, publishes the specification. It enables consumers to "verify the phone number associated with the SIM used in the device connected to the mobile data network" (CAMARA NumberVerification). Its latest public release is r3.2, with API version v2.1.0.

The flow, simplified:

1. The user enters their number in your app.
2. The app starts an operator authorization flow over the mobile data connection, so the operator can see which SIM is making the request.
3. Your backend calls the API with the number, in plain text or as a SHA-256 hash.
4. The verify operation returns devicePhoneNumberVerified: true or false. A second operation, device-phone-number, returns the number the operator associates with the SIM, where the operator and the law allow it.

Operators expose the API directly or through aggregators, under the GSMA Open Gateway umbrella of "common network APIs". CAMARA also standardizes related APIs, such as SimSwap, which reports recent SIM changes on a number.

#Where does it stop working?

• Wi-Fi. The standard flow needs a mobile data connection. Other connections work only with extra SIM-based token mechanisms.
• Operator coverage. Availability is per operator and per country, and many users' operators don't offer it yet.
• Desktop. A laptop has no SIM, so desktop sign-ups need another method or a hand-off to the phone.
• Dual SIM and eSIM. If the data SIM isn't the SIM for the entered number, an honest user gets false.

See silent authentication and flash call for the full list and the alternatives.

#Why does it matter for fraud and deliverability?

Number verification proves possession without an OTP, so it removes three problems at once: no SMS fee, no SMS pumping target, and no code to phish. It can't tell you everything, though:

• It proves the device holds the number now. A recent SIM swap looks like a legitimate match.
• It doesn't tell you the line type or whether the number is a good contact channel.
• The fallback path, usually an SMS code, is where cost and fraud concentrate once the silent path is in place.

#How does MobileValidate fit in?

MobileValidate doesn't offer operator number verification. Our checks run before it: a carrier lookup tells you the country, current network and line type, which decides whether a silent check is worth trying and how to protect the fallback. The OTP and sign-up fraud use case shows where each check fits. Unknown answers are free.