Skip to content
The InfiQ GlossaryFeature

CPaaS & channels

Silent Network Authentication(SNA)

Verifying a phone number by having the mobile operator confirm the SIM behind the device's data connection, with no code for the user to type.

Also called: Silent authentication · Number Verification API · Network-based number verification · SIM-based verification

InfiQ Glossaryreviewed Expert

What is silent network authentication?

Silent network authentication (SNA) verifies that a user really holds the phone number they entered by asking their mobile operator, instead of sending them a code. The app or website makes a request over the device's cellular data connection; because the operator already knows which SIM opened that data session, it can confirm whether the session belongs to the claimed number. The user sees a short wait — there is nothing to type, nothing to read aloud and no SMS that can be intercepted, delayed or pumped.

Operators expose SNA through aggregators and, increasingly, through the GSMA Open Gateway's CAMARA Number Verification API. After an OpenID Connect authorisation flow that must run over the mobile network, your backend calls POST /verify with the phoneNumber (or a SHA-256 hashedPhoneNumber) and gets back devicePhoneNumberVerified: true or false. If the device was not on mobile data, the operator cannot see the session and the call fails with a 403 such as NUMBER_VERIFICATION.USER_NOT_AUTHENTICATED_BY_MOBILE_NETWORK.

The catch is coverage. SNA works only where the user's operator supports it, only on the SIM that is carrying mobile data (dual-SIM phones complicate this), never on Wi-Fi-only tablets or desktops, and often not while roaming. That makes it a first attempt, not a replacement: production flows try SNA silently, then fall back to an SMS OTP, a WhatsApp authentication template or flash call verification. Compared with those, SNA proves possession of the SIM itself — but a fraudster who has just completed SIM swap fraud holds that SIM, so high-risk flows pair SNA with a SIM-change check.

Key takeaways

  • Silent network authentication (SNA) asks the user's mobile operator to confirm that the SIM on the current data session holds the claimed number.
  • There is no code to send, type or intercept, so SNA removes OTP delays, typos and SMS pumping for the users it covers.
  • The check only works over the SIM's mobile data connection, on operators that support it — not on Wi-Fi-only devices or desktops.
  • The CAMARA Number Verification API returns devicePhoneNumberVerified: true or false from POST /verify.
  • Treat SNA as a first attempt and fall back to an SMS OTP, a WhatsApp authentication template or a flash call when it cannot run.

Figure 1

Watch a number get verified without a code

9 / 9
  • Phone appon mobile data
  • Your backendsign-up service
  • OperatorNumber Verification

Step 9 of 9Response

Your backendPhone app

Signed in

The user never saw or typed a code.

  • Request — solid arrow — a call that expects an answer
  • Response — dashed arrow — the answer coming back
Step through an SNA check: the app opens the operator's URL over mobile data, the operator matches the SIM, and your backend gets a yes or no. No SMS is sent at any point.

Step 9 of 9: Your backend to Phone app — Signed in. The user never saw or typed a code.

Why it matters

Why does silent network authentication matter?

Every SMS OTP costs money, can take seconds or minutes to arrive, gets mistyped and can be stolen or abused by fraudsters who trigger codes to number ranges they profit from. SNA removes the code entirely for the share of users it covers: sign-up and login get faster, verification cost per user falls, and SMS pumping has nothing to exploit. For lending, payments, gaming or ride-hailing apps with heavy onboarding traffic, routing users through SNA first and falling back only when it fails can cut OTP spend and drop-off at the same time.

How does silent network authentication work?

  1. Collect the number

    The user enters their phone number. Tell them the operator will confirm it, and keep a visible 'Send me a code instead' option for people on Wi-Fi or abroad.

  2. Run the authorisation over mobile data

    The client opens the operator's (or aggregator's) authorisation URL with the number-verification:verify scope over the cellular connection — SDKs can route this request to mobile data even when Wi-Fi is on. The operator ties the data session to the SIM's number.

  3. Exchange the code and call verify

    The redirect returns an authorisation code to your backend, which exchanges it for an access token and calls POST /verify with the number the user typed.

  4. Read the answer

    devicePhoneNumberVerified: true means the SIM on that session holds the number. false is a real mismatch — a wrong number, a different SIM, or fraud — not a network glitch to retry.

  5. Fall back when SNA cannot run

    No mobile data, an unsupported operator, roaming or a 403: switch to a WhatsApp authentication template, an SMS OTP or a flash call, and log the reason so you can measure coverage.

Silent network authentication in code

POST {API_ROOT}/number-verification/v2/verify HTTP/1.1
Authorization: Bearer {ACCESS_TOKEN}
Content-Type: application/json
 
{ "phoneNumber": "+919812345210" }
 
HTTP/1.1 200 OK
Content-Type: application/json
 
{ "devicePhoneNumberVerified": true }

The access token must come from an authorisation flow that ran over the user's mobile data. Base URL and version depend on the operator or aggregator.

Example: Onboarding for a Hyderabad lending app

A Hyderabad lending app used to send an SMS OTP to every applicant. It now runs SNA in the background while the applicant is still on the phone-number screen. In an illustrative month, most applicants on supported operators pass silently and land on the next step without typing anything; those on Wi-Fi-only devices, unsupported networks or a second SIM fall back to a WhatsApp authentication template at ₹0.14, with an SMS OTP as the last resort. When a burst of sign-ups arrives from number ranges that never pass SNA and never complete OTPs, the team rate-limits those ranges — the same pattern SMS pumping attacks leave — and pays for far fewer codes.

— Onboarding for a Hyderabad lending app

Common mistakes with silent network authentication

  • Treating SNA as universal

    Coverage varies by operator, country and roaming status. Measure the SNA pass rate per operator and always keep a code-based fallback in the same screen.

  • Running the check over Wi-Fi

    If the request leaves over Wi-Fi, the operator cannot see the SIM and the check fails. Use an SDK that forces the request onto cellular, or detect the connection and skip straight to an OTP.

  • Retrying a false result

    false means the SIM on that session does not hold the number. Retrying will not change it; route the user to another factor or a review instead.

  • Assuming SNA stops SIM swaps

    SNA confirms the SIM that is in the phone now, so a freshly swapped SIM passes. For payouts, password resets and account changes, add a SIM-change check or a second factor.

  • Forgetting dual-SIM phones

    The check sees only the SIM carrying mobile data. If the user registers the number of their other SIM, SNA fails; say so in the error message and offer a code.

SNA FAQs

Does silent network authentication work on Wi-Fi?
Not on Wi-Fi alone. The request has to reach the operator over the SIM's mobile data connection; many SDKs can route it there while Wi-Fi stays on, but a phone with mobile data off, or a Wi-Fi-only device, cannot pass.
Is silent network authentication more secure than an SMS OTP?
It removes code interception, phishing of codes and SMS pumping, so for most sign-ups it is stronger. It confirms only the SIM currently in the phone, though, so pair it with SIM-swap checks for high-risk actions.
Is silent network authentication available in India?
It depends on the operator. SNA works only where the user's operator exposes number verification, directly or through an aggregator, so check coverage per operator before relying on it and keep an OTP fallback.
How is SNA different from flash call verification?
Flash call verification places a call that is dropped before answer and matches the caller-ID digits; SNA asks the operator about the data session and involves no call or message. Flash calls can be read automatically only on Android, while SNA needs mobile data on the SIM being checked.
Does the user have to do anything during SNA?
Usually not. The check runs in the background in a second or two; at most the user sees a consent or loading screen, and they type a code only if SNA cannot run and the flow falls back.

Best practices for silent network authentication

  • Start SNA while the user is still typing or confirming the number, so a pass feels instant.
  • Log outcome and reason per operator and country; that data shows where SNA pays off.
  • Send hashedPhoneNumber where your provider supports it, to share less personal data.
  • Keep OTP templates registered and ready — SNA reduces how often you send them, not the need to have them.

See InfiQ pricing

* Per-message rates for India, ex-GST: marketing, utility and authentication effective 1 July 2026; service messages ₹0.145 since 1 October 2026 (they were ₹0 until 30 September 2026). Volume commitments earn discounts — final rate is confirmed on your account; applicable GST extra. Rates for other countries differ (see the international rate table on /pricing).

Try it on the official WhatsApp Business API

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms