Reimagining authentication: how can the telco network support financial institutions?

For the past few decades, mobile telecommunications, banking, and digital transactions have been converging around a shared digital identity infrastructure. Eric Drury, founder & principal consultant at ForthCo.io, shares more on how the telco network can support financial institutions.

Driving this convergence perhaps more than anything else are authentication flows, where telecom networks are increasingly relied upon to supply the identity, or ‘trust’ signals - e.g., number possession, SIM integrity, device location - that let banks and other service providers verify, in real time, that the customer transacting is the same person the account was opened for.

So how did telcos come to be part of the authentication process, and how is their role evolving at a time when the fraud and scam epidemic is accelerating?

From AML to SIM registration: how telcos inherited identity duties

Twenty-five years ago, the horrific attacks on the World Trade Center in New York led to a major expansion of existing AML policies, and the introduction of the formal KYC policies that we recognise today.

The US government introduced new laws that mandated banks and financial institutions to verify customer identity before allowing an account to be opened. Most governments around the world soon followed suit, updating their own financial laws to match these new regulations.

In the years following 9/11, mandatory SIM registration laws became increasingly widespread, with many governments requiring ID documents in order to link a SIM with a verified legal identity before activating an account. And with the introduction of mobile money in the mid-2000’s (M-Pesa in Kenya, Smart Money, and GCash in the Philippines), AML and KYC obligations began to be retrofitted to include mobile money operators.

By the end of the first decade of the 2000s, telecoms had begun to take on some of the same identity-verification compliance functions that used to sit solely with banks.

The big mobile switch: the phone becomes the root of trust

This was around the same time that the iPhone was launched, ringing in the era of the modern smartphone. On-device biometrics arrived with Touch ID and Face ID, and the mobile phone began to take on aspects of a digital twin - a persistent, biometrically-bound proxy identity for its owner.

This tight binding between device and device-owner was a significant development. It established a shared, device-anchored trust infrastructure between the SIM-bound identity of the telecom world, the account-bound identity of the banking and finance worlds, and the biometric-bound identity of a device owner.

It meant that banks, apps, and payment networks could rely on the phone as a hardware root of trust.

An explosion of mobile commerce … as well as fraud and scams

The modern smartphone also supercharged growth in two related industries - the mobile commerce and the scams/fraud industries. Mobile shopping quickly became the new default (according to some studies, by 2014 mobile shopping penetration had already reached almost 40% in China). Meanwhile, cybercrime (including impersonation and digital identity theft), which was already a firmly entrenched, institutional-grade problem affecting more than 680 million people at a cost of USD 126 billion in 2015, was poised to explode even more.

The username/password login approach that had enabled access to online accounts and services for so long was no longer considered a secure, i.e., trustworthy, method for verifying a user’s identity.

A stronger method of authentication was needed.

In the simplest of terms, authentication is the process of proving, or verifying, one’s identity, and there have typically been three standard methods, or factors, for doing this in the digital realm:

1. Knowledge - something you know (a secret code, password, or PIN);
2. Possession - something you possess (a mobile phone, a hardware token);
3. Inherence - something you are (i.e. biometric fingerprint, face, iris, voice).

With the single-factor authentication of something you know, a login password, for example, proving to be insufficiently trustworthy, banks (mainly in Europe) had already begun introducing one-time passwords (OTPs) as an added layer of security in the authentication process.

Here again, telco and banking converged: SMS turned out to be the main delivery channel for these OTPs, enabling banks and other services to incorporate a second factor - something you possess, i.e., a mobile phone - into their authentication processes, at mass-market scale.

And just like that, telcos’ role expanded beyond initial onboarding identity verification to also include supporting user authentication flows for logins and transaction approval.

The end of SMS-OTP?

SMS-OTPs would go on to dominate phone number-based authentication for two decades, but that dominance is showing signs of decline.

It turns out that SMS-based authentication has fundamental security vulnerabilities: an SMS can be intercepted or phished, completely defeating the ‘possession’ factor. Or if a device owner has become a victim of a SIM swap (where a fraudster convinces a mobile carrier to transfer the victim's phone number onto a new SIM card which the attacker controls), all calls and texts - including OTPs - now go to the attacker's device, letting them pass SMS-based authentication and take over banking, email, and other accounts.

Because of these flaws, SMS-based authentication is being systematically abandoned by major organisations and governments, with several countries (e.g., UAE, India, and Singapore) imposing SMS-OTP phase-out deadlines for high-value sectors like banking and government services. Likewise, in the context of Strong Customer Authentication (SCA) and Europe’s Payment

Services Directives (PSD2 and PSD3), SMS-OTP is being displaced by stronger, phishing-resistant methods.

So with the authentication space moving on from SMS-OTPs, where is it heading, and do telcos have a role to play?

What telcos bring to stronger authentication

The authentication space seems to be consolidating around a clear set of four pillars: multi-factor, passwordless, biometric-bound, and continuous. Telcos will play a significant role in each, supplying important trust signals - number possession, SIM integrity, device location - to support the transition to more secure online transactions.

Multi-factor: Single-factor authentication is a relic of the past. Multi-factor authentication and the binding of multiple signals together is becoming the de facto baseline. This shift puts more emphasis on the possession factor, where telcos supply a signal that banks and applications cannot replicate independently: network-verified possession of a specific SIM or subscription.

Here, it should be noted that location (’where you are’) is increasingly being considered as a viable authentication factor. Telcos can provide a real-time, highly credible, network-verified location signal, which confirms a SIM-based device's location directly from network data, and allows a verifier to flag or block an authentication attempt that is geographically implausible - without requiring any additional step from the user.

Passwordless: Passwords have long been recognised as the weakest link in authentication, and there’s a desire to move past this ‘something you know’ factor to eliminate the risk of password theft, phishing, and password reuse. Telcos are contributing to this shift by exposing device- and SIM-bound credentials via network APIs (see below), allowing applications to replace a secret password with a network-verified possession factor.

Biometrics: Biometrics are inherently difficult-to-steal characteristics (fingerprint, face, voice), so authentication approaches today are leveraging the biometric capabilities built directly into many devices for login, access, and approval flows. Here, telcos have a narrower role to play: binding the device on which the biometrics are stored to a verified SIM/number.

Continuous: Rather than verifying identity once at login and trusting that state indefinitely, there is a desire for continuous authentication, where identity is re-checked throughout a session. This closes the gap between one-time verification and ongoing assurance. Telcos are well-positioned for this model because the network's relationship with a subscriber is inherently persistent and re-checkable in real time, unlike a credential validated only at a single login event.

GSMA’s Open Gateway and CAMARA APIs

The main vehicle by which telcos are supporting the shifting authentication landscape is via GSMA’s Open Gateway initiative and CAMARA - a standardised suite of APIs that expose network-verified trust signals as a service to banks and platforms. APIs include Number Verify, SIM Swap, and KYC-Match, leveraging the secure binding that a mobile operator has with their subscriber base.

The telco APIs are in some ways enabling a whole new category of SIM-based authentication, operating in the background, password-free - similar to passkeys, but with the telco network as the trust anchor, rather than the device.

Note that despite the ‘silent’ nature of SIM-based authentication, explicit user consent is still required before an application can access their carrier-verified identity. This preserves user control even while the verification itself becomes seamless, providing both better security and less friction, i.e., better UX for customers.

It’s true that CAMARA and SIM-based authentication is still in its early days, but today already more than 300 networks and 80% of global mobile connections are aligned with the API framework. And operators are hoping the API services can one day offset the revenue losses that will eventually come when SMS-OTPs are phased out almost entirely.  According to GSMA, ‘the financial services sector is keen to use network APIs for authentication. Banks really see the value of basing trust on two entirely separate roots of trust – biometrics and the device/SIM – as a fraudster can’t easily attack and defeat both of them’.

When identity becomes trust infrastructure

The evolution of authentication over the past few decades has resulted in a blueprint for telecom, banking, and payment providers to work more closely together to leverage their shared trust infrastructure based on verifiable, high-integrity digital identity signals.

The result is an authentication approach transitioning from something a user proves to something the network already knows. Telecom operators make a valuable contribution to this, rooted in the valuable customer identity data they hold - SIM state, live location, subscription continuity- which can be shared safely and responsibly to improve the integrity and security of online interactions.

About author

Eric Drury is founder & principal consultant at ForthCo.io, where he works at the strategic, research, and implementation levels as an advisor to enterprises, governments, and industry bodies seeking to understand and benefit from emerging Web 3 and decentralised technologies, with a particular focus on digital identity and digital trust ecosystems.