One-time passwords (OTPs) were once a new, innovative security measure, and while they’re convenient, the digital world has become a more complicated space. In a hyper-digital environment, more threats emerge. OTPs delivered via SMS are vulnerable to SIM swapping, SMS phishing, message interception with an updated HLR location attack or with IMSI Catchers and multi-factor authentication fatigue.
Instances of SIM swapping, a form of fraud where a bad actor tricks a mobile carrier into switching a customer’s SIM card with theirs to take control of their phone number, have increased by 1,055%. Further, research shows that, depending on geographic region and network conditions, OTP delivery can fully fail via SMS as often as 15-20% of the time, delaying sign-in attempts and placing roadblocks in everyday, essential login and authentication processes, from social media to online banking transactions. These aren’t just inconvenient delays; they’re common tactics that put users and their data at risk.
Luckily, in the fast-moving and constantly evolving digital landscape, there are already more secure and simple alternatives to OTPs: SIM-based Number Verification, which uses the subscriber identity module (SIM) as the trust anchor. This approach puts trust directly in the hands of the authoritative data source on the carrier side and the user to create a more seamless authentication experience that also better protects information.
How SIM-Based Number Verification Works
SIM-based number verification is a method that has recently become more popular with telecommunications companies and businesses in banking, fintech, eCommerce and crypto. The tactic verifies authenticity at the hardware level. It ensures that a phone number is directly associated with a SIM card in the device that made this request before approving a sign-in, rather than solely relying on a password or sending an OTP to another application or device. Both authentication methods verify possession of a device, but while the OTP code processes the check in indirectly and requires user interaction, the latter does it directly and silently, removing the user from the flow.
SIM-based number verification creates a silent, under-the-radar process by proving actual possession of the mobile number. It leverages cryptographic verification to ensure the number belongs to the SIM in the proper device, increasing confidentiality and integrity without the user having to worry about the risk of a code being stolen.
Benefits Beyond Security
Aside from reducing fraud risk, SIM-based number verification can provide crucial benefits in user experience for mobile native authentication. Unlike authentication apps or OTPs, the user does not have to complete any extra steps, like waiting for a message to come through or manually entering a code. SIM-based number verification happens completely in the background.
This process can save users time and avoid potential frustrations associated with challenges like delayed confirmation messages and authentication app update requirements. It also reduces any risk associated with multi-factor authentication fatigue, as any requests come directly from an individual’s device. SIM-based verification is possible on both cellular and Wi-Fi networks, providing users additional flexibility depending on their location.
Implementation Tactics
SIM-based number verification presents a rare value proposition to telecom operators through a new revenue stream that builds on infrastructure that already exists and is constantly in use, while providing major benefits for customers. Mobile networks already authenticate their mobile subscribers constantly through the SIM, occurring any time a phone connects to a cellular tower, or with a new network, on an unmatched scale.
The SIM is already a trusted asset that’s controlled completely by the operator and widely used by customers. This is particularly impactful in applications like banking, e-commerce, and healthcare, given the greater financial consequences of security breaches and the need for strong protection measures.
SIM-based number verification is the simplest option for both the business and the customer at a time when security approaches are being strengthened to protect information and customer preferences continue to shift with the ongoing expectation for more seamless experiences. Given that it’s a rare case in which the tools needed for adoption are already available and just need to be strategically leveraged, and that SIM-based number verification addresses the top security threats impacting customers today, it’s a win-win opportunity. SIM Based Number Verification is built on top of Camara standards, ensuring standard quality and longevity.
______
About Andro Galinović
Andro Galinović is the CISO at Infobip, where he has led information security for six years. His focus is on information and cyber security, risk management, business continuity, IT Governance and business management systems. He holds certifications including CISSP, CISM, CISA, CRISC, and CGEIT, and previously served as president of the ISACA Croatia chapter.
