Mobile Operators in France Unite to Protect Digital Identities

Several of the operators are also making Number Verification available to the developer community.

As part of the global GSMA Open Gateway initiative, France’s four mobile operators – Bouygues Telecom, Free, Orange and SFR – announced they will join forces to provide services designed to help app developers and enterprises tackle online fraud and protect the digital identities of mobile customers.

Mobile operators in France unite to protect digital identities

The operators are launching two network Application Programmable Interfaces (APIs) for the French market – KYC Match and SIM Swap – developed to the new CAMARA standard which aims to align specifications across mobile operators.

France is the first country in the world where all four major operators are launching the API called KYC Match, which strengthens how online businesses can verify new customer’s identities. Several of the operators are also making Number Verification available to the developer community.

France has seen a 37% increase in online transactions since the Covid pandemic, totalling €2.35 billion in 2023, with 77% of these taking place over mobile devices. But alongside this, 80% of French companies say they experienced online fraud attempts with 45% stating that online fraud has increased over the last 12 months.

The number of digital identity theft cases has risen by 40% over the past four years according to figures from the French Ministry of Interior. These new APIs will help protect consumers’ mobile identities by adding an additional layer of defence against fraudsters.

The APIs have been developed and rigorously tested in the French market with a number of financial institutions, such as BforBank (the online branch of Credit Agricole) or Fortuneo, (subsidiary of Credit Mutuel Arkéa) which use KYC Match to screen new customers in partnership with DQE Software. Over twenty companies in France are already using the telco APIs to help prevent account take over fraud and check customer identities during transaction and onboarding processes.

By bringing together operators from around the world, the GSMA Open Gateway initiative facilitates the design of digital products capable of operating seamlessly on all devices, regardless of the country or operator. Since launch last year, 67 mobile network groups, representing a total of 278 networks and three-quarters of mobile connections have joined the initiative alongside 26 channel partners.

Developers can also take advantage of the new network capabilities mobile networks offer by utilising unique access points, called APIs (Application Programming Interfaces), which allow developers to easily plug their services into these network capabilities. The service APIs are available through the CAMARA repository, an open-source project by the Linux Foundation and a fundamental part of the GSMA Open Gateway initiative.

The two services, or APIs, that the French operators are making available to enterprise developers, are:

KYC Match: Allowing businesses to cross-check customer-provided information with the verified records maintained by the user’s mobile network operator, as part of their KYC (Know Your Customer) process.

This cross-check comparison can include details such as mobile phone number, name, postal code, address, birthdate, and email address. Importantly, no Personal Identifiable Information (PII) is shared in the process, ensuring user privacy while enabling secure and accurate verification.

SIM Swap: Is to be used to check whether a given phone number has recently changed SIM cards. This helps mitigate account takeover attacks, in which fraudsters take control of the account owner’s SIM card using social engineering techniques and stolen personal data.

For example, at the time of a financial transaction, a financial institution can check whether the relationship between the customer’s phone number and SIM Card has been recently changed, helping them decide whether to approve the transaction or not.

The operators intend to include a third API, which some are already providing, called:

Number Verification: which can be used to verify a customer’s mobile number by providing the next generation of strong authentication and user experience. It is a simple evolution path for any business that uses mobile numbers and SMS One-Time-Passwords.

Instead of relying on SMS, Number Verification can be seamlessly and automatically activated to verify a user’s identity. This not only enhances the user experience but also mitigates potential issues, such as users not receiving an SMS or facing difficulties due to limited familiarity with technology.

The French operators are aiming for a commercial launch in the first half of 2025.