Prevent fraud and simplify verification processes with Number Verify

Fraud in SMS

Criminal organisations use SMS, the same channels businesses use to engage with customers, to steal sensitive business and customer data and money. To prevent them from hacking into accounts and victimising customers, most businesses employ MFA (multi-factor authentication) or 2FA (two-factor authentication) to secure online services, onboarding and login processes. It can even be used to verify a customer when authorising money transfers. The most popular authentication strategy is digital verification, often done by sending out OTPs (One Time Passwords) to verify the access rights of the person logging into the account or service. However, unfortunately, criminals can still abuse this system.

Criminals automate SMS, such as OTPs, and blast companies with requests to send SMS messages to toll or premium rate numbers. Each text adds to an exorbitantly high bill for the targeted business, while the fraudsters pocket the profits. This type of fraud is often known as Toll Fraud, IRSF (International Revenue Sharing Fraud) and AIT (Artificially Inflated Traffic).

So, how do businesses prevent becoming the next victim of Toll Fraud? CM.com offers destination management in our safeguard system to help protect businesses, but there's also a new digital verification method available which prevents this type of scam. It is more secure and user-friendly, and prevents businesses from having to send out a high number of OTP messages: Number Verify.

What is Number Verify?

Number Verify, Number Verification, Number Verifier, Mobile Identity, Mobile Identity Authentication, Silent Verification, Silent Network Authentication, Passwordless Authentication, SAFr Authentication - all these different names are for the same verification method. But what is it?

Number Verify leverages the unique characteristics of the SIM card in mobile devices to authorise and verify the users of mobile apps. Unlike traditional authentication methods which rely on passwords, knowledge-based authentication, physical tokens or OTPs, Number Verify checks the inherent security features of the SIM card to ensure that only authorised users can access sensitive information and services in the mobile app. This way, businesses can trust the person they are engaging with is the legitimate owner of the mobile number, preventing identity theft.

The user will be asked to enter their telephone number and nothing else, and then the mobile operators which supply the SIM verification will authenticate the user. It is often referred to as a 'silent' authentication method because most of the verification happens in the background, without any external actions needed. This way, criminals are not given the chance to commit toll fraud.

There is no username, password or OTP needed for verification. This makes it a quick, seamless and user-friendly method which simplifies the verification process for both businesses and users.

Key benefits of Number Verify

1. Enhanced Security: By using the SIM card, which is inherently secure and difficult to tamper with, Number Verify offers a higher level of security compared to traditional methods.

2. User Convenience: Users do not need to remember complex passwords or carry additional authentication devices; mobile phones, which users already have, become the access key.

3. Fraud Prevention: Number Verify solutions can detect and prevent fraudulent activities such as toll fraud and identity theft.

4. Regulatory Compliance: Many industries are subject to strict regulations regarding data protection and user authentication. Number Verify helps businesses comply with these requirements.

5. Cost-Effective: Reducing the need for physical tokens and complex password management systems can significantly lower operational costs.

How safe is Number Verify?

Verifying the user's identity via SIM card benefits from the inherent security SIM cards already have. But what if criminals commit fraud with SIM cards? SIM swap fraud occurs when a fraudster tricks a mobile carrier into transferring a user’s phone number to a new SIM card. They will pretend to have lost the SIM card or the phone when they contact the mobile carrier, asking to have the phone number registered to a new SIM card. This can then give the fraudster access to sensitive accounts and information.

Detecting and preventing SIM swap fraud

Does that make Number Verify unsafe? No, because SIM swap detection, or Takeover Protection service, helps prevent SIM swap fraud by monitoring and detecting changes in the SIM card. Before executing a transaction, businesses can perform a SIM Swap check which returns the last date the SIM was swapped or activated.

Is there a recent SIM swap registered? Businesses can decide the best course of action for that specific user. This allows businesses to respond to fraud attempts swiftly and enhances the overall security of user accounts and the sensitive information they contain.

Will Number Verify replace OTPs?

Is there a future for SMS OTPs, especially considering the rise in AIT and toll fraud? SMS is considered old, its messages are not end-to-end encrypted and the prices per text message are creeping up. Some even claim SMS as an OTP channel will not survive the next few years. Whether that forecast is correct or not, only time can tell. But right now, it's too early to write off SMS OTPs.

Number Verify needs cooperation from mobile operators, and when it comes to security measures, accessibility is a key factor. What SMS lacks in security, it makes up for in reach and effectiveness. Offering high-tech cybercrime solutions means nothing when these solutions don't reach your customers. SMS is accessible, available and everywhere. Perfect for a fallback security channel when the first-line solutions are unavailable to a customer.

Besides, SMS is not the only channel that offers OTPs. Newer, end-to-end encrypted channels like WhatsApp Business and RCS are effective for sending out OTPs.

WhatsApp OTP

Traditionally, OTPs are sent over SMS or email. The problem, however, is that these messages are not end-to-end encrypted; unencrypted messages can be abused by criminals. WhatsApp Business messages are end-to-end encrypted, which adds an additional layer of security to the OTPs sent over WhatsApp.

RCS OTP

RCS is often considered the successor of SMS, and rightfully so. RCS introduces rich media and interactive tools to the native text messaging app on Android phones - and soon also to iPhones.

Besides the added rich features, RCS offers a higher level of security than SMS with its verified business profiles. These verified business profiles help eliminate fraud and spam by requiring businesses to go through a thorough verification process to prove their identity before they can send out RCS messages. It will also help your customers to recognise imposter OTP messages with malicious links.

Verification services via CM.com

The importance of finding accessible and secure tools to safely grant customers access to digital services is clear, but where do you start? Tools currently used for authentication and verification were not necessarily built with that specific use case in mind - and aren't priced as such either. OTPs are generally charged per message sent, regardless of whether or not the verification was successful.

At CM.com, we've now bundled our verification and authentication services into one easy and accessible API, so you'll have your verification solutions in place in no time. And the best part? You only pay for successful verifications.

Our Number Verify tool is part of our Verification as a Service solution. Seamlessly integrate with one of our solutions to offer a seamless experience for both your colleagues and your customers.