Security · 2026-05-12

Carrier Signal Freshness: TTL Over Signal Strength

By J. W. Bouckaert

A twelve-hour-old signal is not a signal

Every identity stack on the market today proudly enumerates the carrier attestations it consumes: SIM-swap checks, device-binding lookups, Number Verify, Know Your Customer Match, location confidence, roaming flags. The marketing math is simple: more signal types equal more security. The marketing math is wrong.

What actually determines the security value of a carrier attestation is when the signal was observed. A SIM-swap check that returned "no swap in last 24 hours" sounds reassuring until you notice that the check itself ran twelve hours ago. In the eleven hours and fifty-nine minutes since that response was cached, the SIM could have been swapped, a fraudulent OTP intercepted, the password reset, the funds moved, and the session you are now authenticating could be the attacker's, not the user's.

The signal is not stale. The signal is historical. Those are different things, and conflating them is how identity stacks ship CVEs disguised as features.

Freshness is the first-class property

Carrier signals decay. So do device-attestation chains, behavioral-drift scores, and every other "real-time" check that any production identity layer claims to make. The decay is not linear, it is not optional, and it does not respect the cache TTL your platform team set last quarter for cost reasons.

The hierarchy of attributes for any identity signal—in order of how much they actually matter to a security decision—is:

1. Freshness. When was this observed? This is the only attribute that can collapse the security value of every other attribute to zero.
2. Provenance. Who observed it? A carrier-direct lookup carries different weight than an aggregator's cached copy of an aggregator's cached copy.
3. Binding. What does it bind to? A SIM-swap check tied to an MSISDN that is not the MSISDN being authenticated is a curiosity with no control value.
4. Strength. How confident is the underlying observation? This matters, but it matters fourth.

The industry has spent a decade optimizing for #4 and treating #1 as an implementation detail. That ordering is exactly backwards.

The freshness decay curve

The threat model is unforgiving. From the moment a carrier signal is observed, the probability that the underlying state has changed—and that the cached signal is now actively misleading—rises monotonically. The curve is not a smooth exponential, because the underlying events (SIM swap, device handoff, eSIM profile switch, number recycling) are themselves discrete. But across a population, the aggregate decay is well-approximated by a step-rising hazard function.

The empirical shape, calibrated against the same operator-grade telemetry we documented in The Carrier Signal Landscape 2026:

These are not absolute numbers. They drift by carrier, country, and population segment. The shape is what matters: the security value of a carrier attestation collapses inside the first sixty seconds, and is effectively gone by the end of the first hour.

ASCII rendering of the decay, normalized so that "fresh observation" = 1.0:

1.0  ▌
     ▌▌
0.9  ▌▌▌
     ▌▌▌▌
0.8  ▌▌▌▌▌▌
                ▌▌▌▌▌▌▌▌
0.7                     ▌▌▌▌▌▌▌▌
                                ▌▌▌▌▌▌▌▌▌▌
0.6                                       ▌▌▌▌▌▌▌▌▌▌▌▌
0.5  └──┬──────┬──────┬──────┬──────┬──────┬──────┬──→
       0.5s    5s     60s    5m     1h     12h    24h
                              signal age

This is why "we check SIM-swap status" is a meaningless claim until you append "...and the response is no older than N seconds where N is single digits." Anything else is a compliance artifact.

The economics of caching

Caching is not stupidity. Caching is economics.

A typical Tier-1 carrier API charges per query and rate-limits aggressively. Operator-side aggregators (Twilio Verify, Vonage Number Insight, Sinch, Telesign) absorb that cost and resell at a markup. At enterprise scale—millions of authentications per day—the per-call price difference between a fresh lookup and a cached response is the difference between a viable identity layer and a CFO-mandated migration to OTP-only.

So vendors cache. Cache TTLs in the wild, sampled across the seven providers we benchmarked for the Multi-Provider Identity Signal Strategy:

The aggregator that markets a "real-time SIM-swap API" while caching for thirty days is, technically, telling the truth. The query is real-time. The response is from last month. The contract does not require those to be the same thing, and most contracts are written carefully to ensure they are not.

This is the structural reason why the silent number recycling attack class works in 2026, why invisible SIM-swaps routinely defeat carrier-attestation checks, and why "we use SIM-swap detection" appears in every breach post-mortem from the past eighteen months.

Sub-second TTL in practice

Drive the TTL toward zero and the threat model collapses in your favor. The same MSISDN, queried fresh at the moment of authentication, can defeat attacks that an hour-old cached lookup is structurally incapable of seeing.

The differential is starkest on attacks that the industry has already conceded:

Every row in that table is an attack we have personally seen executed in production against systems whose vendors marketed "carrier-grade SIM-swap detection." Every row is also an attack that a fresh, sub-second-TTL lookup would have caught—not because the lookup is smarter, but because the lookup is current.

Enforcing sub-second TTLs

Our architectural commitment is straightforward: every carrier signal that contributes to an authentication decision is observed during the decision rather than ahead of it.

The mechanism is documented in detail in our Edge-First Identity Verification writeup. In outline:

1. Edge-resident lookup. Carrier signal queries originate from the Cloudflare edge node nearest to the authenticating device, bypassing any centralized backend. This collapses the round-trip from ~200 ms to single-digit milliseconds at the edge, which is what makes the "fresh per request" model economically viable.
2. Per-request invalidation. The carrier-signal client treats every authentication event as a cache-miss by default. Cache exists—for cost-control on idempotent retries within the same request envelope—but it is invalidated on the next authentication ceremony, every time, without exception.
3. Hard TTL ceiling. The freshness threshold is enforced as a hard ceiling. A soft target would let stale signals through. A signal older than 1500 ms (configurable down to 500 ms for high-assurance tenants) cannot contribute to a positive trust decision. It can contribute to a negative one—a stale signal that did show a SIM swap is still useful as a deny signal—but it cannot, structurally, vouch for anyone.
4. Multi-provider freshness fusion. When two providers return signals at different ages, the fusion engine weights the fresher signal exponentially. A signal at age T contributes weight e^(-T/τ) where τ is the per-signal decay constant. That weighting is the same exponential decay the underlying state actually obeys, and it produces the only honest answer in cases where two providers disagree.
5. Freshness in the audit trail. Every trust decision recorded in the audit log carries the age of every contributing signal at the moment of decision. Forensic reconstruction can therefore answer "was this decision defensible at the time it was made"—a question that signal-strength-only logs cannot answer at all.

The result is verification inside the request rather than against a cache. The performance number was never the point. The point was always that anything slower would have to cache, and anything that caches has to lie.

The tradeoff

The honest tradeoff is cost. Sub-second TTL means roughly two orders of magnitude more carrier-API calls than a 60-minute cache. At the per-call rates Tier-1 carriers charge directly, the unit economics only close when:

• The request is multiplexed across multiple signals in a single round trip (which requires direct carrier integration in place of aggregator passthrough)
• The infrastructure runs at the edge so the carrier-API leg is the only meaningful latency contributor
• The pricing model passes the carrier cost through transparently rather than blending it into a per-seat subscription that incentivizes the vendor to cache aggressively to protect margin

PasskeyBridge made this tradeoff explicitly. We sized our pricing tiers around real-time lookup economics from day one, which is why our enterprise tier is more expensive per authentication than competitors that quietly cache for an hour. The competitors' pricing models cannot afford fresh lookups. Ours cannot afford stale ones.

That is a structural constraint. Any identity vendor selling "carrier-grade SIM-swap detection" at a price point that requires aggressive caching is, by construction, selling stale signals dressed up as fresh ones. The freshness numbers in their marketing decks are about the API endpoint, not the underlying observation.

Questions for your identity vendor

Five questions that will distinguish a freshness-first identity layer from a strength-first one:

1. What is the maximum age of a carrier signal that can contribute positively to an allow decision? If the answer is in minutes or hours, the vendor is selling historical artifacts.
2. What is the median observed age of the signals you used in my last 1,000 authentications? If the vendor cannot answer, the data is not in the audit log, which means the audit log cannot answer "was this defensible at the time."
3. When two providers return conflicting signals at different ages, how do you reconcile? "Highest confidence wins" is the wrong answer. "Freshest signal wins, weighted by decay constant" is the right one.
4. Is your cache TTL configurable per tenant? If not, the vendor has chosen the cache TTL that maximizes their margin.
5. What is your carrier-direct integration ratio versus aggregator passthrough? Aggregators introduce a second layer of caching the vendor cannot see, let alone control.

The answers will tell you, in about four minutes, whether you are buying real-time identity verification or expensive nostalgia.

Direction of the standards

Freshness as a first-class property is the direction the standards bodies are already moving and no invention of ours: OpenID SSE/CAEP, SCIM 2.0 event signaling, GSMA Open Gateway's CAMARA APIs, and the eIDAS 2.0 EUDI Wallet all assume push-based, freshness-stamped signaling rather than pull-based polling against stale caches.

The vendors that built their pipelines around aggressive caching are about to discover that the standards trajectory is incompatible with their business model. The vendors that built around sub-second freshness will discover that their architecture is the standard, and the migration cost is zero.

Bearer tokens were a 2012 design for a 2012 threat model. So were minute-and-hour cache TTLs on carrier signals. The threat model moved on. The signals have to move with it.

---

Implementing freshness-first carrier signaling? Start with the Carrier Provider Setup guide for sub-second integration patterns, then read the Multi-Provider Signal Fusion writeup for the math behind decay-weighted reconciliation across Tier-1 carriers.

Start free · Test the API