Question Identity
What is carrier-based authentication?
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.
What is carrier-based authentication? Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone. Source: https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/ (Cleartext, verified 2026-09-20)
Three things people call “carrier authentication” #
| Approach | What it checks | What the user does |
|---|---|---|
| Number verification | The request comes from the SIM tied to a given number | Nothing; it runs over mobile data |
| SIM swap check | Whether the number’s SIM changed recently | Nothing; it is a risk signal |
| SIM-based cryptography | A key held in the SIM signs the request | Usually one tap |
Where the APIs come from #
The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators.[1] GSMA Open Gateway packages those APIs commercially.[2]
What happened in the US in 2026 #
In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.[3] In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers, according to its press release.[4]
What it doesn’t solve #
A network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery. Compare the two most common forms: number verification vs silent network authentication.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Treat network checks as a strong possession signal and a SIM-swap detector, combined with a device-bound credential. Don’t make them the only factor for account recovery.
Fintechs & payment firms
Network checks remove the code from onboarding and login on mobile data, which cuts SMS costs and OTP-bot exposure. Confirm coverage for your customers’ carriers first.
Developers & identity teams
Ask vendors which CAMARA APIs they call and what happens on Wi-Fi, where the check can’t run over the cellular connection. Plan a fallback that isn’t SMS.
Follow-up questions #
- Does number verification prove who is holding the phone?
- No. It proves the request came from the SIM tied to the number. Anyone holding an unlocked phone with that SIM passes the check.
- Is it the same as silent network authentication?
- Largely. “Silent network authentication” describes the user experience; “Number Verification” is the name of the standardized CAMARA API that performs the check.
People also ask #
What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?
MagicalAuth is Glide Identity’s product for replacing SMS one-time passcodes. According to the company, it confirms identity through the mobile network, using the SIM’s cryptographic link to the network, with no code to type, and switches to passkeys or email links when a device doesn’t support SIM authentication. Cleartext has not independently tested it.
Full answerHow can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerWhat is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerIs SMS OTP still allowed under NIST SP 800-63-4?
Yes, with conditions. NIST SP 800-63B-4 keeps SMS and voice one-time passcodes as “restricted” authenticators. An organization that offers them must provide a non-restricted alternative, explain the risks to users, assess the risk of continuing, and keep a plan to migrate away. SMS codes are not phishing-resistant.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What is carrier-based authentication?” Last verified 2026-09-20 (rev. 2). https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/
Markdown link
[What is carrier-based authentication?](https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/) (Cleartext, verified 2026-09-20)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 2 | Added a related question on Glide Identity’s MagicalAuth (owner-affiliated coverage) and the Glide Identity topic. Answer text unchanged. | |
| Rev. 1 | First published. |