Number Verification API
What is a Number Verification API?
The Number Verification API is a Network API that enables an application to verify or retrieve the mobile phone number currently associated by a mobile network operator with the SIM in the user’s device.
Instead of sending an SMS One-Time Password and asking the user to enter a code, the API uses silent network-based or SIM-based authentication. This enables a business to confirm possession of a mobile number in the background, without interrupting the user’s onboarding, login or transaction journey.
The official CAMARA Number Verification description defines the API as a service that allows businesses to confirm ownership of a mobile number or retrieve the number directly from the user’s device. The technical CAMARA Number Verification API specification describes it more precisely as verifying or retrieving the number allocated by the operator to the SIM in the end user’s device.
The Number Verification API can perform two principal operations:
- Verify a supplied phone number: The application sends a phone number, or a supported hash of that number, and receives a true-or-false result indicating whether it matches the number associated with the authenticated device.
- Retrieve the device phone number: Where permitted, the API returns the phone number associated with the authenticated device so the application can perform the comparison itself.
The current CAMARA specification exposes these capabilities through the /verify and /device-phone-number operations. Phone numbers are represented in international E.164 format, and the verification operation can accept either the number itself or its SHA-256 hash.
A full Number Verification API framework typically includes:
The API verifies the relationship between a device, SIM and mobile number. It does not, by itself, confirm a person’s legal identity, postal address or other Know Your Customer information.
How does Number Verification API work?
The application first obtains an access token for the user through a supported operator authentication flow. The user’s mobile subscription is authenticated through the mobile network or through a supported SIM-based mechanism.
The application can then call the Number Verification API in one of two ways.
Number matching
The application already has a phone number supplied by the user or stored against the customer’s account.
It sends that number to the API’s verification operation. The operator compares it with the number associated with the authenticated mobile subscription and returns a Boolean result:
-
true means the supplied number matches the authenticated device phone number
-
false means the numbers do not match
The CAMARA specification also permits the application to send a SHA-256 hash of the E.164-formatted number rather than transmitting the number as plain text.
Number retrieval
Where the use case, operator policy and applicable privacy requirements permit it, the application can request the phone number associated with the authenticated device.
The operator returns the number in E.164 format, allowing the application to populate a registration field, confirm the customer’s number or perform its own comparison.
The complete request, response and authentication requirements are available in the GSMA Open Gateway Number Verification API reference and the CAMARA Number Verification repository.
Network-Based and SIM-Based Number Verification
The Number Verification API supports two general methods of silently authenticating the mobile subscription.
Network-based authentication
With network-based authentication, the operator identifies the subscriber through the device’s mobile-data connection.
Because the operator manages the connection, it knows which subscription is using it and which mobile number is associated with that subscription. The application can use this operator-authenticated context to verify the number without sending an SMS code.
When no temporary SIM-based token is available, the CAMARA specification requires the device to be connected through the mobile network for this authentication method to work.
SIM-based authentication
SIM-based authentication identifies the subscription through the SIM installed in the device.
A supported implementation may use a temporary operator token based on GSMA TS.43 Service Entitlement Configuration and related GSMA specifications.
The temporary token can be passed from the application to its backend and used during the operator authorisation process. This can allow Number Verification to operate over connections such as Wi-Fi, because the SIM has already been authenticated through the temporary operator token.
The CAMARA specification describes support for temporary-token authentication through CIBA or JWT Bearer-based flows, subject to the operator and API provider’s implementation.
Why is the Number Verification API important for Mobile Operators & Enterprises?
Traditional phone-number verification commonly relies on SMS OTPs. Although familiar, this process introduces several steps:
-
The user enters a phone number
-
The application generates an OTP
-
An SMS provider delivers the code
-
The user waits for the message
-
The user leaves the application or changes screens
-
The user copies or memorises the code
-
The application validates the submitted code
Each step can create delay, abandonment or failure. Messages may also be delayed, filtered, delivered to the wrong device or exposed to phishing and social-engineering attacks.
The Number Verification API replaces this journey with a network-confirmed result. The operator verifies the mobile subscription in the background, allowing the application to continue without requiring the user to read and enter a code.
The CAMARA Number Verification use cases include application onboarding, login, password reset, customer support, two-factor authentication and device binding.
For enterprises, the API can improve user experience and reduce OTP-related friction. For mobile operators, it provides a standardised way to expose trusted mobile-network identity capabilities to banks, fintech platforms, eCommerce companies, marketplaces, social applications and other authorised API consumers.
Key Benefits / Features of a Number Verification API
- Real-time verification of the number associated with a device
- Code-free and passwordless user journeys
- No manual SMS OTP entry
- Faster registration and login processes
- Reduced reliance on A2P SMS for routine verification
- Fewer failures caused by delayed or undelivered OTP messages
- Operator-confirmed mobile-subscription information
- Support for plain-text or hashed number matching
- Secure phone-number retrieval where permitted
- Standardised implementation through CAMARA APIs
- Cross-operator exposure through GSMA Open Gateway
- Integration with SIM Swap and other fraud-risk signals
The API should still be used as one component of a wider authentication and fraud-management strategy. It verifies possession of the mobile subscription but does not establish every aspect of identity or eliminate all account-takeover risks.
Examples of Number Verification API
App sign-up and onboarding
A banking, fintech, social-media, ride-sharing or mobile-wallet application asks a new customer to enter a phone number.
Instead of sending an SMS OTP, the application authenticates the mobile subscription and sends the entered number to the Number Verification API.
The operator compares the number with the number associated with the user’s device and returns a true-or-false result. When the result is true, the application can continue the registration process without requiring the user to type a verification code.
CAMARA lists app onboarding as a primary Number Verification use case, particularly where SMS OTP creates unnecessary friction in proving possession of the registered mobile number.
Passwordless app login
A returning user opens an application from a device containing the registered SIM.
The application initiates silent mobile-network authentication and calls the Number Verification API. When the number associated with the device matches the number registered to the account, the result can be used as an authentication factor.
Depending on the account’s risk level, the application may combine this result with device binding, biometrics, a passkey or behavioural risk analysis.
Number Verification can therefore support passwordless login, but the enterprise remains responsible for deciding whether number possession alone provides sufficient assurance for the requested action.
Automatic phone-number entry
An application can use the phone-number retrieval operation to obtain the number associated with the authenticated device, where supported and permitted.
This eliminates the need for the customer to manually enter a number and reduces problems caused by typing errors, incorrect country codes or inconsistent formatting.
The retrieved number can be used to pre-populate a registration form or create a smoother onboarding journey. The CAMARA /device-phone-number operation returns the operator-associated number in E.164 format.
Transaction validation
A bank, payment provider or eCommerce platform can verify the mobile number associated with a device before approving a sensitive transaction.
For example, the platform can compare the number authenticated by the operator with the number registered to the customer’s account. A mismatch may trigger additional checks or step-up authentication.
For higher-risk transactions, Number Verification can be combined with the GSMA Open Gateway SIM Swap API, device intelligence and transaction-monitoring controls.
Number Verification confirms the number associated with the current subscription, while SIM Swap checks whether the SIM associated with a number has recently changed. The two APIs provide different but complementary signals.
Password reset and account recovery
Account-recovery journeys often use SMS OTP to prove access to the customer’s registered number.
The Number Verification API can instead check whether the mobile subscription accessing the application is associated with that number. A successful match provides a possession signal without requiring the user to receive and enter an SMS code.
The result can be evaluated alongside known-device status, recent SIM changes, login history and other risk indicators before the password is reset.
Device binding
An application can use Number Verification when linking a customer account to a new device.
The operator-confirmed number is compared with the number registered to the account. When they match, the application can create a binding between the account, application installation, device and mobile subscription.
Future access from another device may then require additional authentication.
Customer-support verification
A customer-support application can use Number Verification as part of the process for confirming that a customer is contacting support from a device associated with the number on the account.
This can reduce the need to ask the customer to repeat an OTP over a voice call or manually type a code into a support interface.
It should not be treated as the sole identity check for sensitive account changes, because possession of a mobile subscription is not equivalent to full identity verification.
Two-factor authentication
Number Verification can act as a possession factor within a multi-factor authentication process.
Instead of proving possession through an SMS code, the application receives a network-confirmed indication that the current device is associated with the expected mobile number.
A separate factor—such as a passkey, biometric or application PIN—can then be used to provide stronger authentication.
Number Verification API vs. SMS OTP
Number Verification and SMS OTP can both help confirm possession of a phone number, but they work differently.
With Number Verification, the operator authenticates the mobile subscription and returns a match result or the device phone number. No verification code needs to be delivered or manually entered.
With SMS OTP, the application sends a time-limited code to a phone number, and the user must submit that code to prove access to the message.
The GSMA maintains a separate One Time Password SMS API for use cases that specifically require an SMS-based code. Number Verification is designed for silent authentication and excludes SMS OTP or username-and-password authentication from the intended no-interaction flow.
Number Verification may provide a smoother journey, while SMS OTP can remain useful as a fallback when silent network authentication is unavailable.
Common questions about Number Verification API
- What does the Number Verification API verify?
It verifies whether a supplied mobile number matches the number currently associated by the operator with the SIM in the authenticated user’s device. Where permitted, it can also retrieve that number.
- Does Number Verification check whether any phone number is active?
Not in the same way as a general telephone-number lookup or HLR service. The CAMARA API verifies or retrieves the number associated with the authenticated device and access token. It is not designed as a bulk database for checking arbitrary phone numbers. - Does the user need to enter an SMS code?
No. The intended Number Verification journey uses silent network-based or SIM-based authentication. The CAMARA specification states that the API provider must guarantee no user interaction and that SMS OTP or username-and-password methods are incompatible with this specific authentication journey.
- Can the API return the user’s phone number?
Yes, where the operation is supported and the application has the required scope, permission and legal basis. The /device-phone-number operation returns the number associated with the authenticated access token.
- Can the phone number be submitted as a hash?
Yes. The /verify operation can accept either a plain-text E.164 phone number or a SHA-256 hash of the E.164-formatted number. Only one format should be provided in a request.
- Does Number Verification work over Wi-Fi?
Network-based authentication normally requires the device to use its mobile-data connection. A supported SIM-based flow using a GSMA TS.43 temporary operator token may allow Number Verification to work while the application is connected through Wi-Fi. Availability depends on the operator, device and API provider.
- Is Number Verification the same as Silent Authentication?
No. Silent Authentication is the background authentication method or user journey. Number Verification is a specific Network API that uses silent authentication to verify or retrieve the number associated with the device.
- Does Number Verification prevent all fraud?
No. It reduces certain risks and usability problems associated with SMS OTP, but it should be combined with other controls for sensitive use cases. These may include SIM Swap, Device Swap, device binding, passkeys, behavioural analytics and transaction-risk monitoring.
Related Terms
Silent Authentication; Number Verify; Network-Based Authentication; SIM-Based Authentication; Mobile Identity; Network API; CAMARA; GSMA Open Gateway; Mobile Network Operator; MSISDN; E.164; GSMA TS.43; Operator Token; OAuth 2.0; OpenID Connect; Three-Legged Access Token; CIBA; JWT Bearer; One-Time Password; SMS OTP; Passwordless Authentication; Two-Factor Authentication; Device Binding; SIM Swap; Device Swap; Account Takeover; Know Your Customer; Consent Management.
Last Updated: August 2026