In today's digital age, the phone number has become an integral part of our online identities. Whether we are creating accounts on social media platforms, shopping online, or accessing our bank accounts, we are often required to provide our phone number as a means of identification. But why is the phone number so important when it comes to digital identity?
First and foremost, the phone number is unique. Unlike an email address or a username, a phone number is assigned to a specific individual. This makes it a reliable form of identification that can be used to verify a person's identity online. Most people have multiple email addresses but hardly carry two or more phones, with some exceptions in different parts of the world.
Most people today own a mobile phone, which means that phone numbers can be used to verify identities for a large portion of the population. This makes it an efficient and cost-effective way for companies to verify customer identities and protect them from malicious actors. Two-factor authentication (2FA) is an essential security measure for any service you sign into. For the majority of the transaction verifications and sign-ins, SMS OTP (One Time Password) has been the de-facto standard.
SMS OTP has been important for authentication and Multi-Factor Authentication (MFA) because it provides a simple and widely available method for adding an additional layer of security to online accounts.
This means that even if a password is compromised, an attacker would not be able to access the account without also having access to the user's mobile phone to receive the OTP SMS.
However, it's important to note that phone numbers are not immune to security risks. SMS OTP is known to be prone to social engineering attacks and other vulnerabilities.
Developed as part of Vodafone Identity Hub (VIH) Vodafone has developed Number Verify, a next-generation authentication solution that utilizes an API to validate the phone number provided by the individual. This process is done silently at the network level, making the user onboarding experience seamless and secure. Number Verify leverages the cryptographic security provided by the SIM card in every mobile phone, enabling frictionless user onboarding and silent two-factor authentication (2FA) without the need for SMS OTP or magic links. The API has also been adopted by other mobile operators globally to ensure a consistent, frictionless experience for users across different carriers.
Let’s look at the typical flow of “logging in” in today via SMS.
The user types in the phone number, waits for the SMS OTP and then when autofill is not working – type in the code and wait to be verified.
But what if the journey could look like this?
With the Number Verify API, Vodafone instantly verifies the phone number that the user has entered without any user interaction. Our API would simply respond in the background with a True/False response if the number that was entered by the user matches. In the above example, not only would the number of steps required reduce in half, but also the authentication would happen much faster. Implementation of Number Verify not only leads to better security for your app but also 25% higher conversion rates.
The Number Verify API has proven to be a highly effective solution for preventing account takeovers. Three major Tier 1 banks in the UK have already implemented it, eliminating the need for SMS-based verification methods. Instead, Number Verify is used to confirm a user's identity when installing the banking app on a new phone. This approach is not only more secure, but it also reduces the risk of social engineering attacks, as there is no OTP to share.
One of the UK banks that have implemented Number Verify, in combination with the SIM Swap API, has seen significant financial benefits. The bank is estimated to have saved around £1.2 million a year by preventing account takeovers. The implementation of Number Verify has also improved the overall security of the bank's app and provided a seamless user experience.
The API has also been adopted beyond financial services for seamless authentication and detecting real phone numbers linked to a SIM from a cloud number. The outcomes of these deployments will be shared in a future update.
If you want to know more about Number Verify and Vodafone Identity Hub, please visit our website.
