> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/identity-verification/non-doc-verification/phone-based-verification.md).

# Phone-Based Verification

***

## Overview

Phone-based verification uses the user's mobile number as a verification anchor — confirming both **possession** (the user can receive a signal at that number) and **identity attributes** (the number has been associated with the claimed person, with stable tenure, and isn't a recent SIM-swap or port-out target). It produces a verification result without any document scan, and on most mobile devices it completes in under 30 seconds.

The method is particularly powerful because the data sources — mobile network operators — already perform their own identity proofing when issuing SIM cards in most regulated markets. Reusing that signal at verification time is efficient and effective.

### Two layers of signal

Phone verification combines two distinct types of check:

| Layer                                | What it confirms                                                               | How                                                                                                                                           |
| ------------------------------------ | ------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- |
| **Possession**                       | The user is in control of the phone number right now.                          | One-time passcode via SMS, voice call, or silent network authentication.                                                                      |
| **Attribute / carrier intelligence** | The phone number is associated with the claimed person and isn't a fraud risk. | Queries against MNO records: name and address match, line type (postpaid/prepaid/VoIP), account tenure, recent SIM swap or port-out activity. |

A robust phone-based flow uses both. Possession alone proves the user has a phone; attribute checks prove it's their phone.

### What happens during phone-based verification

{% stepper %}
{% step %}
**The user enters their mobile number**

Captured with country code, normalized to E.164 format. Obvious invalid formats are rejected client-side before any lookup. 
{% endstep %}

{% step %}
**Carrier intelligence checks run**

The platform queries one or more upstream data providers for:

* **Subscriber attributes** — name and address on the carrier account, to match against what the user claims.
* **Line type** — distinguishes postpaid contracts (highest trust), prepaid (medium), VoIP and burner numbers (low trust, often rejected outright).
* **Tenure** — how long the number has been continuously held by the same subscriber. Long tenure is a strong positive signal; sub-30-day tenure is a synthetic-identity red flag.
* **Recent SIM swap activity** — was the SIM card associated with this number recently re-issued? Recent swaps are a leading indicator of account takeover.
* **Recent port-out activity** — was the number recently moved between carriers? Often correlates with takeover attempts.
  {% endstep %}

{% step %}
**Possession is verified**

Depending on the device and the flow's configuration, one of:

* **SMS one-time passcode** — universal but vulnerable to SIM-swap and SS7 attacks; suitable for low-to-medium assurance.
* **Silent mobile network authentication** — on mobile data, the device authenticates directly with the carrier's network without an OTP at all. The user doesn't see or type anything; the flow just confirms the number is the one connected on the cellular link. This is the strongest and lowest-friction option where supported.
  {% endstep %}

{% step %}
**Result is returned**

Pass/fail decision plus the per-check signals: attribute match score, line type, tenure days, SIM swap indicator, possession method used.
{% endstep %}
{% endstepper %}

### Why this method works well

| Benefit                                        | What it means in practice                                                                                                                        |
| ---------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------ |
| **Lowest friction in the catalog**             | With silent network authentication, the user doesn't type anything — the verification happens transparently. With OTP, it's a single short code. |
| **Universal coverage in mobile-first markets** | Nearly every adult in any developed market has a mobile number. No document, no eID, no SSN required.                                            |
| **Strong fraud signals built in**              | SIM swap and port-out detection are leading indicators of account takeover. Getting these signals at verification time is high-leverage.         |
| **Useful as a continuous signal**              | Phone-based checks can run on every login or every high-risk action, not just at onboarding.                                                     |
| **Reusable for re-authentication**             | A user who verified with their phone at onboarding can re-authenticate via the same channel without re-doing the whole flow.                     |

### Use cases where phone-based verification fits

* **Account recovery.** A user has lost access to their email or credentials. A phone-based verification — especially with attribute matching against the original onboarding data — is a defensible recovery path that doesn't require dragging the user through a full re-verification.
* **Step-up before sensitive actions.** Money movement, beneficiary changes, password resets — quick possession + SIM-swap check before allowing the action.
* **Low-friction onboarding for digital products.** Subscription apps, marketplaces, and consumer services that don't need full KYC but want a fraud-resistant signup gate.
* **Composite KYC.** Phone-based verification as one of multiple non-documentary CIP signals (alongside SSN and credit-bureau header match) for US regulated onboarding.
* **Continuous fraud monitoring.** Background SIM-swap monitoring on the user's number, surfacing alerts when a swap is detected so you can pre-emptively step up authentication.
* **Markets where document capture is unreliable.** Regions with high mobile penetration but mixed document quality benefit from phone-first verification.

### Configuration considerations

| Decision                       | Notes                                                                                                                                                          |
| ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Possession method              | Silent network authentication where available (mobile data), with SMS as fallback. Voice call for accessibility and landline support.                          |
| Retry policy                   | Cap OTP retries at 3 to limit brute force. Lock the number out for a cool-down period after consecutive failures.                                              |
| Combination with other methods | Phone-based verification is most valuable as part of a composite. Define the role explicitly: primary verification, fraud signal, possession-only, or step-up. |

### Standards and regulatory context

* **NIST SP 800-63B** treats SMS as a restricted authenticator and recommends against it for new high-assurance deployments. Silent network authentication and out-of-band push approval rank higher.
* **PSD2 Strong Customer Authentication (EU)** accepts possession factors including device-bound mobile authentication; SMS OTP is allowed but increasingly considered weak.
* **FFIEC guidance (US banking)** explicitly calls out the risks of SMS OTP and recommends layered authentication that includes device intelligence and behavioural signals.

Phone-based verification done well combines possession, attribute matching, and risk signals into a single check. Done poorly — SMS OTP alone, with no carrier intelligence — it's a checkbox that fraudsters routinely defeat. The difference is in the configuration.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.1kosmos.com/identity-verification/non-doc-verification/phone-based-verification.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.