Number verification (silent network authentication)

Number verification, also called silent network authentication, confirms that a device requesting access actually holds the phone number it claims, using the mobile network's own session rather than an SMS code. The check happens without user interaction: the carrier confirms the device's connection maps to the asserted number.

Because no code is typed, there is nothing to phish; because the proof rides the network session, a remote attacker with the victim's credentials but not their device fails silently.

The property that makes this attractive is that there is no secret in transit and no user step to socially engineer. An SMS OTP creates a value that can be read, relayed or typed into the wrong page; a network-level check produces no such value, so the real-time relay attack that defeats codes and push prompts has nothing to relay. That places it alongside phishing-resistant MFA rather than alongside the code-based factors it replaces.

The constraints are the ones common to carrier capabilities. It works on the mobile data session, so a device on Wi-Fi may need the check to run over cellular, and coverage depends on the operator having implemented the API. Both are visible at integration time and neither is visible in a marketing claim, which is why a pilot across real operators tells you more than a specification does.

What the check proves is also worth stating precisely: that the device holding this network session is the one the number currently routes to. It says nothing about who is holding the device, and nothing about whether the number was moved to that device an hour ago. Pairing it with SIM tenure is what closes the second gap.

Standardization through GSMA Open Gateway is what makes the capability reachable the same way across participating networks.

The absence of a user-visible step is also an accessibility benefit, since nothing has to be read, transcribed or completed under time pressure.