The short answer
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request.
Key takeaways
- Number verification confirms a device holds a number; it doesn’t prove who is using it.
- Standardized APIs come from the CAMARA project and GSMA Open Gateway.
- US carriers began offering these checks through aggregators and vendors in 2026.
Three things people call “carrier authentication”
| Approach | What it checks | What the user does |
|---|---|---|
| Number verification | The request comes from the SIM tied to a given number | Nothing; it runs over mobile data |
| SIM swap check | Whether the number’s SIM changed recently | Nothing; it’s a risk signal |
| SIM-based cryptography | A key held in the SIM signs the request | Usually one tap |
Where the APIs come from
The CAMARA project, hosted by the Linux Foundation, defines common network APIs such as Number Verification and SIM Swap, so developers can call the same interface across operators.[1] GSMA Open Gateway packages those APIs commercially.[2]
What happened in the US in 2026
In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.[3] In August, Glide Identity announced a beta of SIM-based cryptographic authentication across the same three carriers.[4]
What it doesn’t solve
A network check proves something about a SIM, not about the person holding the phone. It is strongest combined with a device-bound credential and weakest as the only factor for account recovery.
Sources
- Linux Foundation. CAMARA project.
- GSMA. GSMA Open Gateway.
- ID Tech. Aduna and major U.S. carriers push network-based authentication as SMS code alternative.
- Business Wire. Glide.id beta launches carrier-native cryptographic authentication across AT&T, T-Mobile and Verizon, Aug 3, 2026.
- Published.