What launched
On 6 October 2026, Authsignal launched Number Verify in the US and Australia in partnership with Aduna, according to IT Brief Australia. A business can confirm that a customer controls a mobile number through the carrier, with no SMS one-time passcode (OTP) sent. The report says verification can run through "network-based silent authentication or SIM card-based verification," depending on the network and implementation. In the US the report says only that the service is available across major carriers. In Australia it runs through Telstra.
The product follows Aduna's July 2026 launch. A release dated 8 July 2026 says Aduna, working with AT&T, T-Mobile and Verizon, introduced network-based authentication as an alternative to SMS codes. It checks a number with the carrier and its association with the SIM and device in use. Authsignal's launch is a downstream integration of that carrier plumbing, so a single vendor integration replaces three carrier negotiations.
This is a voluntary commercial product. Nothing in the coverage suggests a mandate, and the launch reports give no date beyond their publication dates. The claims about fraud reduction come from the vendors and carriers themselves. We have no independent measurement of them.
The case for treating SMS as a problem
The strongest argument for intervention is that SMS codes are weak in a way users cannot fix. A code sent over the telephone network can be intercepted, redirected by a SIM swap, or phished in real time. The attacker needs no flaw in the user's own behaviour. A regulator who sees a widely used, structurally weak authenticator has reason to act.
NIST has acted, in the form of guidance. SP 800-63B-4, finalised on 31 July 2025, names one restricted authenticator: using the public switched telephone network (PSTN) for out-of-band authentication, which includes SMS codes. IT Brief's report of the Authsignal launch describes the standard the same way.
What "restricted" does and does not mean
This is where proportionate regulation shows its value. "Restricted" is not "banned." Under the NIST text, an organisation using a restricted authenticator must assess and accept the risks. It must offer subscribers at least one unrestricted alternative and give meaningful notice of the risks. It also needs a migration plan in case the authenticator becomes unacceptable. If the risk cannot be accepted, the restricted authenticator may not be used.
The guidance also tells verifiers to weigh risk signals such as device swap, SIM change and number porting. Those signals are what carrier-side checks can see and an app cannot.
That design leaves a gap that a market can fill. NIST sets the risk bar, and it does not pick a technology. A federal agency or a regulated firm that wants to stay on the right side of the guidance needs an alternative to offer, and a carrier-verified number is one. A mandate to drop SMS on a fixed date would have required regulators to name the successor in advance. The restricted-authenticator approach lets vendors compete to be that successor.
Why the voluntary route is the right one
Two reasons favour leaving this to the market.
First, the replacement has not been tested at scale. A carrier-backed check shifts trust from the one-time code to the carrier's records, and the carriers become a concentrated point of reliance. If a carrier's records of SIM and device association are wrong, or if a fraudster manipulates them through the same social engineering that enables SIM swaps, the check inherits the flaw. Independent evidence of the real-world fraud rate is needed before anyone writes a hard requirement around it.
Second, coverage matters. Number verification only works where a carrier supports it. Authsignal's launch covers the US and Australia, and the US coverage is described only as major carriers. Customers on smaller operators, prepaid plans or roaming connections may fall outside it. A mandate would strand them. A voluntary product can fall back to other methods, which is the very alternative NIST asks organisations to provide.
What to watch
Number verification confirms that a person holds a number and device. It does not prove who the person is. Privacy advocates should also ask what the carrier learns about each login attempt, since the carrier sees every verification request. Neither the Authsignal nor the Aduna coverage settles this, and the answer matters for any wider use.
The sensible path is the one now underway. NIST states the risk. Vendors and carriers build alternatives. Organisations adopt them when their own risk assessments favour it. Policymakers should hold off on requirements until independent evidence shows how these checks perform against SIM-swap attacks, and until carrier data practices are clearer.
The launch shows that guidance which names a weakness, without prescribing a fix, can produce a response from industry within about fifteen months of final publication. That is a better record than most technology mandates can claim, and it is a reason to keep the approach.