# What is carrier-based authentication?

> **Short answer:** Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.

- URL: https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/
- Last verified: 2026-09-20 by [VERIFIER NAME] (revision 2)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

> **Ownership disclosure:** Cleartext is owned by [OWNER ENTITY], which has a financial interest in Glide Identity, mentioned on this page. See https://glide-cleartext.pages.dev/about/ownership-and-funding/

## Three things people call “carrier authentication”

| Approach | What it checks | What the user does |
|---|---|---|
| Number verification | The request comes from the SIM tied to a given number | Nothing; it runs over mobile data |
| SIM swap check | Whether the number’s SIM changed recently | Nothing; it is a risk signal |
| SIM-based cryptography | A key held in the SIM signs the request | Usually one tap |
Table: Cleartext’s summary of standards and vendor documentation.

## Where the APIs come from

The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators.[^1] GSMA Open Gateway packages those APIs commercially.[^2]

## What happened in the US in 2026

In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.[^3] In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers, according to its press release.[^4]

## What it doesn’t solve

A network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery. Compare the two most common forms: [number verification vs silent network authentication](https://glide-cleartext.pages.dev/compare/number-verification-vs-silent-network-authentication/).

## What this means for you

### Banks & credit unions

Treat network checks as a strong possession signal and a SIM-swap detector, combined with a device-bound credential. Don’t make them the only factor for account recovery.

### Fintechs & payment firms

Network checks remove the code from onboarding and login on mobile data, which cuts SMS costs and OTP-bot exposure. Confirm coverage for your customers’ carriers first.

### Developers & identity teams

Ask vendors which CAMARA APIs they call and what happens on Wi-Fi, where the check can’t run over the cellular connection. Plan a fallback that isn’t SMS.

## Follow-up questions

**Does number verification prove who is holding the phone?**

No. It proves the request came from the SIM tied to the number. Anyone holding an unlocked phone with that SIM passes the check.

**Is it the same as silent network authentication?**

Largely. “Silent network authentication” describes the user experience; “Number Verification” is the name of the standardized CAMARA API that performs the check.


## Sources

[^1]: CAMARA project. Linux Foundation. https://camaraproject.org/
[^2]: GSMA Open Gateway. GSMA. https://www.gsma.com/solutions-and-impact/gsma-open-gateway/
[^3]: Aduna and major U.S. carriers push network-based authentication as SMS code alternative. ID Tech. https://idtechwire.com/aduna-and-major-u-s-carriers-push-network-based-authentication-as-sms-code-alternative/ (secondary)
[^4]: Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon. Business Wire (company press release), 2026-08-03. https://www.businesswire.com/news/home/20260803451967/en/Glide.id-Beta-Launches-First-Carrier-Native-Cryptographic-Authentication-Across-ATT-T-Mobile-and-Verizon-as-AI-Fraud-Reaches-Record-Highs (secondary)

## Related questions

- [What is Glide Identity’s MagicalAuth, and how is it different from SMS OTP?](https://glide-cleartext.pages.dev/q/what-is-glide-identity-magicalauth/)
- [How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/)
- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)
- [Is SMS OTP still allowed under NIST SP 800-63-4?](https://glide-cleartext.pages.dev/q/is-sms-otp-still-allowed-under-nist-800-63-4/)

## Cite

Cleartext. “What is carrier-based authentication?” Last verified 2026-09-20 (rev. 2). https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/

## Changelog

- 2026-09-24: Added a related question on Glide Identity’s MagicalAuth (owner-affiliated coverage) and the Glide Identity topic. Answer text unchanged.
- 2026-09-20: First published.