The federated network is planned to provide access to a service known as Number Verification API (Application Programmable Interface), which will allow developers with local banks and online retailers to verify a customer's mobile number to strengthen authentication and user experience. — Unsplash
PETALING JAYA: Malaysian telcos have announced plans to launch a new federated network service that will assist businesses in combating fraud and digital identity theft today (Sept 23) at the Digital Nation Summit (DNS).
The federated network is planned to provide access to a service known as Number Verification API (Application Programmable Interface), which will allow developers with local banks and online retailers to verify a customer's mobile number to strengthen authentication and user experience.
Through this initiative, the participating telcos, which includes CelcomDigi, Maxis, U Mobile, Telekom Malaysia, and YTL Communications, will allow the creation of a cross-operator system that will allow each company to maintain control over their respective data, policy, and revenue.
This would effectively allow it to act as a more secure replacement for SMS One-Time Passwords (OTPs), giving the added benefit of allowing businesses to match phone numbers against real-time network data to protect Malaysians from digital scams.
Two mechanisms would be used to verify the ownership of a phone number to a user's device.
The first is network-based, where a telco will be able to identify the specific subscriber a number is registered under, while the second is SIM-based, where the number's ownership is identified based on the SIM card installed in the device.
During the registration and onboarding process of apps, such as banking, social media, ride sharing, and ewallets, the Number Verification API can be used to request authentication of the phone number's ownership instead of a traditional SMS OTP.
Such verification can further be expanded to use cases such as app logins in place of credentials like usernames and passwords, password reset requests, and two-factor authentication, among others.
