A major global digital platform has made more than 500 million CAMARA Number Verification API calls. A leading communications aggregator is processing 30.8 million network API transactions per day. A major European bank has achieved a 97.6% acceptance rate through silent authentication. These are not projections — they are live deployment figures from 2026, cited in STL Partners' August 2026 analysis of the API-driven silent authentication market. For mobile network operators, the figures answer the question that has held back investment decisions for three years: do enterprise customers actually integrate and pay for silent authentication at scale? The answer is yes — and the network-based authentication window that operators need to step into is open now, not in 2027.

Definition — API-Driven Silent Authentication: A method of verifying user identity using the relationship between a phone number, SIM card, and mobile network — without a password or one-time passcode. The operator's network confirms whether the phone number matches the SIM in the requesting device and returns a boolean result in under 300 milliseconds. Exposed as a CAMARA Number Verification API — a billable per-call product against existing subscriber infrastructure.

The STL Partners analysis — published in August 2026 and drawing on the June 2026 API-driven silent authentication webinar — identifies the biggest risk for operators not as technical readiness but as pace. The technology works, the enterprise demand is proven, the proof points are compelling, and the commercial infrastructure (GSMA Open Gateway, CAMARA standards, aggregator distribution networks) is in place. What remains is a decision on pricing, partnerships, and speed. Operators that move slowly on silent authentication are not waiting for a better window — they are handing the identity layer to vendors and aggregators who are building it around the operator's own network infrastructure.

‍

The Proof Points Are No Longer Theoretical

STL Partners' August 2026 report draws on live deployment data that has fundamentally shifted the market conversation from 'will this work?' to 'how fast can we scale?'. The figures are worth stating directly, because they represent the clearest evidence yet that CAMARA network-based authentication APIs generate real enterprise volume at commercial scale.

500M+ Number Verification API calls reported by a single major global digital platform — a figure described as already out of date at time of reporting (STL Partners, August 2026)

Beyond the volume figures, early deployments are demonstrating specific, measurable enterprise outcomes:

‍

‍

The 97.6% acceptance rate from a major European bank is particularly significant for operators assessing deployment risk. Silent authentication in production conditions — across varied device types, connection qualities, and 2G/3G subscriber populations — consistently delivering above 97% coverage is the reliability threshold that enterprise banking customers require before replacing SMS OTP as a primary authentication method. The remaining challenge, as STL Partners notes, is ensuring latency improvements continue and that the USSD fallback path works seamlessly for sessions outside 4G/5G coverage. U2opia's SilentAuth+ addresses this directly: it is the only commercial implementation that handles both TS.43 EAP-AKA for 4G/5G sessions and USSD fallback for 2G/3G sessions transparently, maintaining coverage across the full subscriber base on the same API call. For the failure modes that arise when fallback is absent, see Why Silent Authentication Fails in TS.43 Production Networks.

‍

The Four-Question Business Case

STL Partners structures the enterprise decision to adopt — and scale — silent authentication around four questions. Operators pitching network-based authentication to enterprise customers benefit from understanding how each question lands and where the strongest value arguments sit.

1. Trust: Does This Improve Security and Compliance Evidence?

Number Verification is cryptographically harder to spoof than SMS OTP. It does not traverse the SS7 signalling plane — which is the known vulnerability that makes SMS OTP interceptable through SIM swap fraud and SS7 routing attacks. For regulated-sector enterprises in banking, financial services, and government, demonstrating 'reasonable steps' to verify user identity is a compliance requirement, not a preference. Network-based authentication using EAP-AKA SIM cryptography satisfies the NIST SP 800-63B-4 phishing-resistance requirement that SMS OTP explicitly fails. For the full compliance mapping, see NIST 800-63B-4 & Carrier APIs: The US Operator's Authentication Mandate Playbook.

STL Partners notes that SIM Swap detection strengthens the trust signal further — flagging cases where the SIM linked to a number has changed recently, adding a fraud-risk layer to the basic number verification check. U2opia's SIM Swap Detection is integrated as a natural second product alongside SilentAuth+, allowing enterprises to trigger an elevated verification response for high-risk transactions without a separate API integration.

‍

2. User Experience: Does This Improve Customer Interactions?

OTP authentication takes upwards of ten seconds in normal conditions — and in markets where vendors route messages through intermediate countries to manage cost, the SMS sometimes does not arrive on the first attempt at all. STL Partners reports that early silent authentication deployments are running approximately ten times faster than OTP. More importantly, the user never leaves the platform interface: there is no switching to a messaging app, no code to type, and no risk of the session timing out while the user waits.

The 30% onboarding uplift reported by one early adopter platform quantifies what removing OTP friction means in commercial terms. In a digital onboarding flow where the user abandons if they have to wait for a code, a 30% improvement in completion is a 30% increase in the addressable customer cohort — from the same marketing spend. For operators, this is the enterprise value proposition that closes procurement decisions: the argument is not 'switch to a new authentication method' but 'increase your onboarding revenue by 30% with the same traffic.'

3. Revenue: Does This Improve Conversion and Grow Revenue?

The revenue argument follows directly from the user experience improvement. STL Partners identifies this as the strongest dimension of the business case for most enterprise buyers: a smoother authentication journey drives materially higher completion rates, and completion at onboarding translates directly into new customer revenue. The opportunity, as STL frames it, is not about reaching new markets — it is about converting more effectively within existing ones.

‍

For operators, the enterprise revenue argument is the commercial hook that accelerates the sales cycle. Enterprise customers in regulated sectors are already mandated to replace SMS OTP. Enterprise customers in e-commerce and fintech are under competitive pressure to reduce friction. Both groups have a compelling revenue case for network-based authentication — which means the operator API sales cycle benefits from a pre-warmed enterprise buyer rather than a cold education motion. The full enterprise demand analysis by vertical is in Network-Based Authentication vs SMS OTP: The Operator Comparison.

4. Cost: Does This Reduce the Enterprise Cost Base?

This is where STL Partners' analysis is most pointed — and most relevant to how operators should be thinking about pricing. The cost dimension is the only one that is not straightforwardly positive for silent authentication, and the reason is operator pricing strategy.

STL's position is clear: operators who price network-based authentication APIs at too great a premium over SMS OTP risk limiting their use to a small number of high-value or high-risk transactions, while enterprises default to passkeys, authenticator apps, or lighter-weight checks for the bulk of their authentication volume. The operator then becomes a step-up authentication provider for edge cases rather than part of the default authentication journey — weakening the position to become the identity infrastructure layer.

‍

For operators, the enterprise revenue argument is the commercial hook that accelerates the sales cycle. Enterprise customers in regulated sectors are already mandated to replace SMS OTP. Enterprise customers in e-commerce and fintech are under competitive pressure to reduce friction. Both groups have a compelling revenue case for network-based authentication — which means the operator API sales cycle benefits from a pre-warmed enterprise buyer rather than a cold education motion. The full enterprise demand analysis by vertical is in Network-Based Authentication vs SMS OTP: The Operator Comparison.

4. Cost: Does This Reduce the Enterprise Cost Base?

This is where STL Partners' analysis is most pointed — and most relevant to how operators should be thinking about pricing. The cost dimension is the only one that is not straightforwardly positive for silent authentication, and the reason is operator pricing strategy.

STL's position is clear: operators who price network-based authentication APIs at too great a premium over SMS OTP risk limiting their use to a small number of high-value or high-risk transactions, while enterprises default to passkeys, authenticator apps, or lighter-weight checks for the bulk of their authentication volume. The operator then becomes a step-up authentication provider for edge cases rather than part of the default authentication journey — weakening the position to become the identity infrastructure layer.

‍

STL Partners identifies the cannibalisation concern — will silent authentication simply replace SMS OTP revenue from one pocket to another? — as the single biggest internal barrier slowing operator progress on network API deployment. And the analysis is direct: this is the wrong question, and asking it is causing operators to optimise around a market that is already in decline.

Four counterpoints from the STL analysis are worth examining in detail:

Counterpoint 1: SMS OTP Is Already Declining

In most markets, SMS and SMS OTP volumes have already reached maturity or are in active decline, with pricing pressure pushing enterprise customers toward alternatives. STL Partners expects meaningful price and volume erosion across most markets over a five-year horizon. Protecting today's SMS OTP revenue therefore means optimising around a shrinking market — and missing the window to establish the operator's network-based authentication API as the replacement infrastructure. The structural SMS decline case — including the AIT fraud economics that accelerate enterprise migration — is detailed in The True Cost of SMS OTP: What Operators Are Losing Globally.

‍

Counterpoint 2: Enterprise Customers Are Actively Moving Away from OTP

Digital experience is a board-level priority across sectors, and OTP is a well-documented source of friction that enterprise product teams are actively engineering around. Major global digital platforms have publicly signalled strategic intent to eliminate OTP from their authentication stacks. Regulatory mandates are reinforcing this: the UAE and Philippines have mandated OTP phase-outs, and NIST SP 800-63B-4 in the US restricts SMS OTP for regulated workloads. If operators do not establish SilentAuth+ as the mobile-native OTP replacement, the enterprise will implement passkeys, authenticator apps, or device-based biometrics — authentication methods that generate zero operator revenue.

Counterpoint 3: The Addressable Opportunity Is Larger Than SMS OTP

The industry comparison between Number Verification and SMS OTP is natural because it is the most immediate substitution opportunity — but it understates the addressable market. Email OTP, authenticator apps, passkeys, and other authentication methods represent transaction volume from which operators currently capture no revenue at all. If network-based authentication APIs are priced and positioned to compete for a share of this broader market — not just the SMS OTP segment — the total revenue opportunity is materially larger than a like-for-like SMS replacement. This reframes the cannibalistion question entirely: the operator is not moving revenue between pockets, it is expanding into a market it currently has no position in.

Counterpoint 4: Silent Authentication Is the Entry Point, Not the End Point

‍

STL Partners frames Number Verification and SilentAuth+ as a land-and-expand motion. The entry point is number verification — replacing SMS OTP for onboarding and login. The expansion is the operator's anti-fraud API portfolio: SIM Swap Detection, KYC Tenure, Number Recycling, and other fraud signals that provide additional confidence for higher-risk transactions. Each layer is accessible through the same operator relationship, making the operator proposition increasingly embedded in the enterprise's authentication and fraud workflow.

This is the same logic that underpins the entitlement server architecture: operators that deploy SilentAuth+ as the initial product are establishing the network infrastructure — the TS.43 Entitlement Server, the HSS integration, the CAMARA API gateway — that makes every subsequent product (Number Verification, SIM Swap, future fraud signals) an additive revenue line with near-zero incremental build cost. See Business Benefits of TS.43 Entitlement Servers for Telecom Operators for the infrastructure business case and How Entitlement Server Enables Silent Network Authentication for the product linkage at the network layer.

‍

What the Market Structure Looks Like When Operators Move Slowly

STL Partners is explicit about the downside scenario: if operators do not activate network-based authentication APIs at competitive pricing and scale, vendors, aggregators, and digital platforms will build the identity layer around them. This is not a theoretical risk — it is the current direction of travel in markets where operator API products are not yet live.

Aggregators — platforms that aggregate operator API coverage across multiple networks — are already building enterprise distribution networks and demand ecosystems. When an enterprise identity platform integrates against an aggregator for Number Verification coverage, it routes verification calls through the aggregator's endpoint. The aggregator captures the per-call margin and passes a reduced revenue share to the operator. The operator's subscriber database is doing the verification work; the operator is receiving a fraction of the commercial value. The alternative — direct operator API integration — gives the operator the full per-call revenue and the direct enterprise relationship.

The window in which operators can establish direct enterprise relationships ahead of aggregator routing is not indefinitely open. As STL Partners notes, aggregation players are further ahead in building demand ecosystems and are increasingly positioned to bring operators volumes from day one — but on aggregator terms, not operator terms. Operators that activate SilentAuth+ and NumberVerify2 now, through U2opia's network of 104+ operators and 60+ countries, can capture the enterprise relationship that defines the commercial terms for the next decade of identity revenue. The US carrier launch context — and what it demonstrates about direct vs aggregated API deployment — is in US Carriers Launch Network-Based Authentication: What It Means for Global Operators.

‍

Four Things Operators Should Do Now (From STL Partners' Analysis)

STL Partners identifies four practical starting points for operators in their August 2026 report. Each maps directly to a specific deployment decision operators face when activating network-based authentication APIs.

‍

‍

The third recommendation — building channels into specialist identity players rather than horizontal marketplaces — deserves elaboration in the operator context. STL Partners notes that authentication is a complex, mature space, and identity specialists already have enterprise customer relationships and are actively packaging network-based authentication into their solution stacks. Operators that establish API access through these channels reach enterprise buyers who are already in the procurement motion for OTP replacement — a significantly shorter sales cycle than a horizontal marketplace that serves many verticals.

SilentAuth+: The Operator's Fastest Path to Deployment

U2opia's SilentAuth+ is the production implementation of network-based authentication that addresses every deployment concern STL Partners identifies in their analysis. It is the commercial vehicle through which operators in 60+ countries are already earning per-verification API revenue — and the platform through which new operators can activate in 4–6 weeks without upfront infrastructure investment.

‍

‍

For the technical architecture underlying SilentAuth+ — including the EAP-AKA challenge-response flow, the Entitlement Server's role in the authentication stack, and how the TS.43 token flows from HSS to enterprise API — see How Network-Based Authentication Works: EAP-AKA and TS.43 Explained and From EAP-AKA to Access Token: How Device Authentication Works in a TS.43. For the trust model that governs who trusts whom in the Entitlement Server architecture, see TS.43 Authentication Trust Model.

Frequently Asked Questions: API-Driven Silent Authentication

‍

What is API-driven silent authentication?

API-driven silent authentication is a method of verifying a user's identity using the relationship between their phone number, SIM card, and mobile network — without requiring a password entry or one-time passcode. The operator's network checks whether the phone number matches the SIM in the requesting device and returns a verified result in under 300 milliseconds, with zero user steps. It is exposed as a CAMARA Number Verification API — a billable per-call product against the operator's existing subscriber infrastructure. The underlying network mechanism is the GSMA TS.43 EAP-AKA standard, the same SIM cryptography used to authenticate devices at network registration.

How do operators make money from silent authentication APIs?

Operators earn per-API-call revenue each time an enterprise queries their subscriber database through the CAMARA Number Verification or Silent Authentication API. The per-call fee is comparable to or higher than A2P SMS OTP termination revenue, with near-zero delivery cost and no AIT fraud exposure. STL Partners' August 2026 analysis reports 500M+ Number Verification API calls from a single enterprise customer — demonstrating the volume potential once the API is integrated at scale. The full revenue model — including ARPU uplift and the four operator monetisation frameworks — is in How Operators Monetize Authentication APIs: The Global MNO Revenue Playbook.

Is silent authentication cannibalising SMS OTP operator revenue?

STL Partners' analysis argues this is the wrong question. SMS OTP volumes are already declining in most markets due to pricing pressure, enterprise migration to passkeys and authenticator apps, and regulatory mandates restricting OTP in regulated sectors. The relevant question is whether operators remain relevant in digital identity at all. Operators that do not activate silent authentication APIs risk having vendors and aggregators build the identity layer using the operator's own network infrastructure — capturing the per-verification API revenue while the operator receives a reduced revenue share on their own subscriber data.

What coverage does silent authentication provide across 2G and 3G subscribers?

Standard CAMARA Number Verification implementations require 4G or 5G connectivity for the TS.43 EAP-AKA primary flow. For operators with 2G or 3G subscriber populations — common across Africa, South Asia, and parts of Southeast Asia — a USSD fallback path is required to maintain coverage continuity. U2opia's SilentAuth+ is the only production implementation that handles both paths transparently, delivering verification coverage across 2G through 5G on the same API contract. Without fallback, 2G/3G sessions produce silent failures. See Why Silent Authentication Fails in TS.43 Production Networks for the failure mode analysis.

How quickly can an operator deploy SilentAuth+?

Using U2opia's hosted deployment model — where U2opia operates the TS.43 Entitlement Server, CAMARA API compliance, enterprise billing, and settlement infrastructure — operators can reach production readiness in 4–6 weeks from integration start. The operator contributes HSS/HLR access and subscriber coverage; U2opia contributes the entire gateway layer. Revenue sharing begins from the first verification call, with no upfront capex. The TS.43 Entitlement Server Deployment Checklist covers the carrier-side readiness steps.

Which enterprise verticals are driving demand for silent authentication?

STL Partners identifies banking and fintech as the primary demand centres, driven by regulatory mandates (NIST, RBI, CBUAE, MAS, BNM) that restrict SMS OTP for regulated workloads. E-commerce, gaming, media, and gig-economy platforms are the secondary demand layer, driven by the conversion economics of removing OTP friction from onboarding and login flows. Cloud platforms and enterprise SaaS are a growing third category, driven by NIST 800-63B-4 phishing-resistance requirements for privileged access. See the full vertical breakdown in How Operators Monetize Authentication APIs: The Global MNO Revenue Playbook.

‍