Silent network verification
Confirm a customer’s phone number with their mobile network, silently. No code to type, and no code to steal.
Why it matters.
Easier for your customers, with nothing for a fraudster to steal.
Confirmed by the network
The mobile network matches the number to the SIM in this phone, over mobile data. The customer types nothing, even on Wi-Fi.
Nothing to phish or intercept
No code is sent, so there is nothing to read out on a scam call, forward to another phone or catch with SMS-reading malware.
The device checked first
Emulators, hooked apps and remote-access tools are refused before any route runs, so the check can’t be driven from a fraudster’s kit.
A single-use token, server to server
DeepID issues a token that works once. Your server redeems it with DeepID before anyone is signed in; the app never decides alone.
How it works.
One call from your app. The bank chooses which routes run, or requires all of them.
In your app, this is one call at login.attempt. The events, one per moment
SMS code or network check.
Same number, verified two ways.
| SMS one-time code | Silent network verification |
|---|---|
Weakness: Slow to finish (wait for the text, then type the code) | Strength: Done in a tap (nothing to wait for, nothing to type) |
Weakness: Easy to phish (a code can be read out on a scam call) | Strength: Nothing to hand over (no code exists to share) |
Weakness: Exposed on the way (texts get intercepted, forwarded or read by malware) | Strength: Nothing sent by SMS (the network checks the SIM directly) |
Weakness: Proves only the code (anyone holding it gets in) | Strength: Proves the SIM in this phone (matched by the mobile network) |
Weakness: Stalls when texts are late (the customer is left waiting) | Strength: Never a dead end (the SIM check, Aadhaar, then a code take over) |
How businesses use it.
One check, at the moments each business is attacked most.
Banks
Sign customers in without a code.
Confirm the number at login and before a new payee, and keep the SMS code for the rare fallback.
Learn more about DeepID for banksDigital banks
The phone is the identity.
Confirm the number at sign-up, at every login, and again when the SIM or the phone changes.
Learn more about DeepID for digital banksPayments
Confirm the number behind the wallet.
Check that the number on the account is on the phone in hand before the money moves.
Learn more about DeepID for payments
Read next.
Beyond SMS OTP
Where codes fail, and what replaces them.
SIM and device binding
The check that runs behind the network check.
RBI Authentication Directions
What the rules ask for, and what they allow.
Questions banks ask.
Is it phishing-resistant?
On the network route, yes: no code is sent, so there is nothing to type into a fake page or read out on a call. When it falls back to a code, the decision checks the SIM, the phone and, on a new phone, the face before it trusts that code.
Does it stop a SIM swap?
Not on its own: a swapped SIM also passes a network check. So DeepID also checks that the SIM and phone are the ones bound at sign-up.
What does our server receive?
A single-use token. Your server redeems it with DeepID, server to server, before signing anyone in. The app never decides on its own.
Does it work on Wi-Fi?
Yes. The check runs over mobile data in the background, even while the phone is on Wi-Fi.
What if the carrier isn’t supported?
The next route takes over: the SIM check, Aadhaar consent, then a code. The customer sees one flow. Which routes are live with which operator is confirmed before a pilot.
Is it allowed in India instead of OTP?
RBI’s Authentication Directions, in force since 1 April 2026, keep two factors as the baseline and allow risk-based checks beyond SMS OTP. A code stays as the last fallback.
Try one-tap login on your own number.
See the network confirm your number with nothing to type, and the next check take over when it can’t. Then plan a shadow proof on one journey, measured on your own traffic.