Mobile identity verification uses the signals attached to a person’s phone number and device to work out whether they are who they claim to be: how long the number has been active, whether it was recently ported or swapped, whether the account behind it matches the person presenting it. It works because the phone stopped being a channel some time ago. It is where the transaction happens. Roughly 80% of payments now take place on a mobile, and effectively all remittance does.
I am the CEO and co-founder of TMT ID, where we use mobile intelligence and mobile data to reduce fraud. We hold data on close to 7 billion mobile numbers across 240 countries and run around 200 million checks a day. When Filip Verley put five rapid-fire questions to me on Liminal’s Friday Five, my answers kept returning to the same awkward point: this industry makes its trust decisions on top of infrastructure it does not own, using data it often cannot get. Here is the longer version, with the room the format does not allow.
The assumption that turned out to be wrong
Filip asked what assumption about my market turned out to be wrong. Ours was simple and, in hindsight, optimistic. We assumed mobile networks would be able to provide their data into the fraud industry and the identity verification industry. They don’t.
To be fair to the industry, it is trying. The GSMA’s Open Gateway initiative now has 86 operator groups behind it, covering more than 300 networks and around 80% of global mobile connections, with SIM Swap and Number Verification among the first standardised APIs. Those are real steps, and I would rather they happened than not.
The gap is between commitment and production. Alignment on a standard is not the same as a working, documented, contractually available service in every market you operate in, and GSMA’s own network leadership has been candid that awareness of network APIs is running ahead of adoption. Operator systems were built to bill subscribers and route traffic, not to answer a bank’s question about whether a number changed hands last Tuesday. Every market layers its own regulatory and commercial constraints on top.
So the picture on the ground stays stubbornly consistent: the organisation closest to the truth about a mobile number is frequently the one least able to hand that truth over, in the format and the timeframe a live decision demands. The data does not arrive ready-made. Someone has to assemble it, market by market and operator by operator, and then keep it current. That work is the product.
What buyers of mobile identity verification only learn once they buy
Filip asked what trade-off buyers in our category still underestimate. They underestimate the distance between the value of the mobile and the quality of the data about it.
The mobile itself is critical, and nobody argues with that anymore. The attributes are just as critical: tenure, porting history, current status, the identity attached to the number. The sophistication sits in the fact that the data held inside a mobile network’s own CRM is sometimes inadequate. A subscriber record that was accurate on the day the account opened may not have been touched since. Buyers therefore arrive completely convinced of the value of the mobile infrastructure, and then find themselves questioning the value of the data. Both of those positions are correct at the same time, which is what makes it a genuinely difficult problem.
It is also a problem most buyers only learn as they buy the service. You can shorten that considerably by asking harder questions before you sign. Ask for match rates broken out by country and by operator, not a blended global figure, because a strong average usually conceals a market where coverage collapses. Ask how recently the underlying record was refreshed and how that refresh actually happens. Then run it against your own traffic and your own known-fraud population rather than a vendor’s sample.
We wrote up the operational side of this in 8 ways bad data is costing your business, because the cost rarely shows up as a fraud number. It shows up as failed deliveries, abandoned onboarding, and support volume nobody has traced back to a stale field.
The next 12 to 18 months: keeping your data out of the public models
Filip asked what will matter more over the next 12 to 18 months than most people are preparing for. The big challenge for all of us is how to protect your data from leakage into the public models.
Every company in this market is sitting on something it spent years building: not a snapshot of the world, but a history. The value is not knowing that a number is active today. It is knowing what that number has done for the last 6 years, which is not something you can buy or reconstruct in a hurry. That history is the defensible part of the business.
It is also the part most easily given away without anyone deciding to give it away. Data flows into tools, tools flow into models, and the accumulated advantage ends up somewhere in a general-purpose system owned by a company with no stake in your market. Protecting it is now a commercial question rather than an IT question, and I do not think enough boards are treating it as one yet.
The hill I will die on: celery
Filip closed by asking for a small hill I am willing to die on that most people would think is trivial. Celery.
In a recent funding round I was asked to name something I hate in life, and I said celery. They heard salary. I had to explain that I am entirely comfortable with salaries. They have been serving me celery ever since.
One vowel, and the meaning inverted completely. Which is, more or less, the whole problem with a stale field in a subscriber record. The data looks fine. It reads cleanly. It just no longer means what everyone downstream assumes it means, and nobody finds out until a decision has already been made on it. Mobile identity verification is bought on the strength of the mobile and lost on the quality of the data. Know which one you are actually buying.
Key takeaways
- The phone is the transaction, not the channel. With roughly 80% of payments happening on mobile and effectively all remittance, mobile identity verification is now a primary trust decision rather than a supporting signal.
- The networks are opening up, slowly, and it is not yet enough. Open Gateway covers around 80% of global mobile connections on paper, but standard alignment is not production availability, so usable mobile data still has to be assembled and maintained market by market.
- Infrastructure value and data quality are separate questions. Buyers who accept the first often discover the second too late. Ask for match rates by country and operator, ask how records are refreshed, and test against your own traffic before signing.
- Proprietary data history is the asset worth defending. The advantage is years of accumulated behaviour, not today’s snapshot, and it can leak into public models without anyone consciously deciding to give it away.
