For years, SMS OTP has been the standard method for user verification across banking apps, digital services, and mobile platforms. It became popular because it was simple, widely supported, and easy to deploy.
However, the digital ecosystem has changed significantly.
At the core of this shifting ecosystem is Digital Identity — the fundamental process of authenticating exactly who a person or entity is online. As digital services expand, establishing a secure and reliable digital identity has become critical for both service providers and users.
Today, operators and application providers face increasing challenges around authentication security, fraud prevention, and user experience. Users expect faster and more seamless onboarding without waiting for SMS messages or manually entering verification codes.
As a result, the industry is gradually shifting toward network-based authentication built on SIM-based trust models.
The limitations of SMS OTP
While SMS OTP is still widely used, its limitations have become more visible over time.
SMS delivery depends on messaging infrastructure, which can introduce delays or failures, especially during roaming scenarios or high traffic periods.
From a security perspective, SMS OTP is vulnerable to phishing attacks, SIM swap fraud, SMS interception, and malware-based OTP capture.
In addition, the user experience is often fragmented. Users must wait for a message, switch applications, and manually enter a code.
For modern digital services, this creates unnecessary friction.
The rise of SIM-based authentication
To address these challenges, the industry is increasingly adopting authentication methods that leverage the mobile network itself as a trusted identity provider.
Instead of sending a verification code over SMS, SIM-based authentication uses the credentials already stored securely on the SIM card. Since the operator already knows the relationship between the subscriber identity (IMSI) and the phone number (MSISDN), verification can happen directly against core network systems in real time.
This allows authentication to happen silently in the background without requiring any user interaction.
The result is:
- Faster authentication
- Lower fraud exposure
- Improved user experience
- Reduced dependency on SMS infrastructure
Why GSMA TS.43 matters
One of the key industry specifications enabling this evolution is GSMA TS.43.
Originally introduced to support services such as VoWiFi and VoLTE entitlement, TS.43 defines how mobile devices securely communicate with operator entitlement infrastructure to determine whether a subscriber is allowed to access specific services.
At the center of this process is the Entitlement Server, which acts as a policy and authentication layer between devices, applications, and the mobile core network.
Using SIM-based authentication methods such as EAP-AKA, operators can securely verify subscriber identity directly against HSS or HLR systems over Diameter or SS7 signalling.
Because the process happens directly within the network, there is no need for SMS delivery or manual OTP entry.
Industry use cases
This shift toward network-based authentication is already enabling several important use cases:
- Silent authentication
- eSIM and device onboarding
- VoWiFi and VoLTE entitlement
- API-based identity verification
- Fraud prevention and anti-phishing
Operators are also increasingly looking at trusted network identity as a monetizable capability, especially in the context of Open Gateway and API exposure initiatives.
Supporting the transition
As the industry moves toward network-based authentication, operators require infrastructure that can integrate securely with existing signalling environments while supporting modern entitlement and identity workflows.
Cellusys Entitlement Server is aligned with GSMA TS.43 specifications and supports SIM-based authentication across Diameter and SS7 environments. The solution enables secure entitlement, authentication, and verification workflows while integrating with existing operator infrastructure.
