# Number Verify and SIM Swap APIs in the Middle East: where they are live and how to pair them with SMS OTP

> Number Verification and SIM Swap are the two operator network APIs that matter most for fraud teams. Here is how each works under the CAMARA specification, where they are confirmed live in the Middle East, and how to combine them with SMS OTP.

- Canonical URL: https://www.broadnet.me/blog/number-verify-sim-swap-api-middle-east
- Language: en
- Last updated: 2026-09-26
- Publisher: BroadNet (https://www.broadnet.me)

- Published: 2026-09-26
- Author: BroadNet Industry Research

Number Verification and SIM Swap are network APIs, standardised by the CAMARA project under the GSMA Open Gateway initiative, that let a bank or app ask the mobile operator two things: is this phone number really the one in the user's device, and has its SIM changed recently? As of 26 September 2026, the only Middle East launch we could confirm at an official source is Qatar, where Ooredoo Qatar and Vodafone Qatar launched both APIs on 26 November 2025. BroadNet, which delivers OTP traffic and protects operator networks across the region, explains how the APIs work and how to pair them with SMS OTP.

## Key takeaways

- Number Verification confirms, without an SMS code, that the number a user typed matches the number of the device they are using. It returns true or false.
- SIM Swap tells you whether the SIM behind a number changed within a period you choose (1 to 2,400 hours, default 240) or returns the date of the last change.
- Qatar is the confirmed Middle East launch: Ooredoo Qatar and Vodafone Qatar, both APIs, announced 26 November 2025 at MWC Doha.
- We could not confirm commercial launches in the UAE, Saudi Arabia, Kuwait, Bahrain, Oman, Jordan or Egypt at an official source. Check with the operator before you design around them.
- Number Verification does not replace SMS OTP everywhere: it needs operator support and, in its standard flow, a mobile data connection. Use it first where it works and fall back to OTP.
- The strongest pattern for high-risk actions is to call SIM Swap before sending an OTP, and to refuse the OTP if the SIM changed recently.

## What are GSMA Open Gateway and CAMARA?

The GSMA describes Open Gateway as "a global framework of common network APIs that simplifies access to mobile operator networks" ([GSMA Open Gateway](https://www.gsma.com/solutions-and-impact/gsma-open-gateway/)). The API definitions themselves come from CAMARA, which the Ooredoo Qatar announcement describes as "an open-source project by the Linux Foundation and a fundamental part of the GSMA Open Gateway initiative". Because every participating operator implements the same definition, a developer can write one integration and reuse it across networks that support it.

According to the same announcement (November 2025), the initiative covers more than 80 mobile operator groups, 292 networks and over 80% of mobile connections worldwide. Membership is not the same as a live API in a given country, which is why the availability table below lists only confirmed launches. For background, see our answer on [GSMA Open Gateway](https://www.broadnet.me/answers/gsma-open-gateway).

## What does the Number Verification API do?

In the CAMARA definition (version 2.1.0, release r3.2), Number Verification verifies or retrieves "the mobile phone number that is currently allocated by the network operator to the SIM in the end user's device". It has two endpoints:

- /verify compares the phone number the user gave you, plain or hashed, with the number associated with the device, and answers true or false.
- /device-phone-number returns the phone number the operator associates with the SIM in the device.

It works through silent authentication, network-based or SIM-based, "without requiring user interaction": no code to receive, read or type. Both endpoints need a three-legged access token obtained for that user. In the standard flow (OpenID Connect authorization code with prompt=none), the device must be connected to the mobile network. If your app has a GSMA TS.43 temporary token from the device, the definition says the API works over any connection, including Wi-Fi. For a deeper explanation, read our answer on [silent network authentication](https://www.broadnet.me/answers/silent-network-authentication).

## How does the SIM Swap API work?

The CAMARA SIM Swap definition (version 2.1.0, release r3.3) gives you two main operations:

| Operation | You send | You get back | Use it when |
|---|---|---|---|
| POST /check | Phone number and maxAge in hours (1 to 2,400; default 240) | swapped: true or false for that period | You need a yes/no decision before a risky action |
| POST /retrieve-date | Phone number | latestSimChange: timestamp of the last SIM swap, or the activation date if there was none | You score risk on how recent the change was |

Two details matter in production. If local regulation or operator policy prevents storing SIM history long enough, the operator can return null for the date, optionally with a monitoredPeriod saying how many days it does cover; treat that as "no swap within the monitored period", not as "never swapped". And if you ask for a maxAge beyond what the operator's policy allows, expect a 400 OUT_OF_RANGE error. SIM swap is a common route to account takeover: the fraudster moves the victim's number to a new SIM and receives their codes. Our answer on [SIM swap fraud](https://www.broadnet.me/answers/what-is-sim-swap-fraud) explains the attack.

## Where are Number Verification and SIM Swap live in the Middle East?

This table lists only launches we could confirm at an operator or GSMA source, as of 26 September 2026.

| Country | Operators | APIs | Announced | Source |
|---|---|---|---|---|
| Qatar | Ooredoo Qatar, Vodafone Qatar | SIM Swap, Number Verification (CAMARA) | 26 November 2025, MWC Doha | [Ooredoo Qatar press release](https://www.ooredoo.qa/web/en/press-release/qatar-mobile-operators-launch-anti-fraud-apis-through-gsma-open-gateway-initiative/) |

The Qatari operators said they plan to add further identity and fraud-prevention APIs in 2026. For the UAE, Saudi Arabia, Kuwait, Bahrain, Oman, Jordan and Egypt, we found no commercial launch of these two APIs on an official operator or GSMA page we could open. Some operators in the region have joined Open Gateway, but joining is not the same as offering an API commercially. Ask the operator, or your messaging provider, for the current status before you build on it. For Qatar's messaging rules, see our [Qatar regulations page](https://www.broadnet.me/regulations/qatar) and [Qatar coverage page](https://www.broadnet.me/coverage/qatar).

## Can Number Verify replace SMS OTP?

Not on its own, and not yet in most of the region. Each method proves something different and fails in a different way.

|  | SMS OTP | Number Verification | SIM Swap check |
|---|---|---|---|
| What it proves | The user can receive a message on that number | The device in use holds the SIM for that number | Whether the SIM behind the number changed recently |
| User effort | Read and type a code (or autofill) | None | None |
| Needs operator API support | No; works on any network | Yes | Yes |
| Connection | Any phone with signal | Mobile data in the standard flow; any connection with a TS.43 token | None on the device; it is a server-to-server check |
| Weak point | Codes can be intercepted after a SIM swap or phished | Unavailable where the operator has not launched it | Does not authenticate the user by itself |
| Best role | Universal fallback and second factor | First choice where available | Risk signal before any OTP on a high-risk action |

The practical design is a cascade: try Number Verification where the user's operator supports it, fall back to SMS or WhatsApp OTP everywhere else, and put a SIM Swap check in front of the OTP for high-risk actions. Our posts on [silent network authentication](https://www.broadnet.me/blog/silent-network-authentication-2026) and [silent network authentication vs SMS OTP](https://www.broadnet.me/blog/silent-network-authentication-vs-sms-otp-2026) go deeper on the first step.

## When should you call SIM Swap before sending an OTP?

Before any action where a stolen number would give a fraudster money or control. A simple decision flow:

1. Classify the action. Low risk: routine login on a known device. High risk: password reset, new payee, change of phone number or email, large transfer, first login on a new device.
2. For high-risk actions where the operator supports it, call POST /check with a short maxAge that fits your risk policy (for example 24 or 72 hours).
3. If swapped is true, do not send the OTP to that number. Step up: in-app confirmation on the registered device, a call-back, or a branch or video check.
4. If swapped is false, send the OTP as usual over SMS or WhatsApp, with automatic fallback between channels.
5. If the API is not available in that market, or returns null, fall back to your existing rules plus number intelligence such as an [HLR lookup](https://www.broadnet.me/products/hlr-lookup) or a [phone reputation](https://www.broadnet.me/products/phone-reputation) score.
6. Log the check result with the transaction, so fraud analysts can see why an OTP was or was not sent.

> An OTP proves that someone can receive messages on a number. A SIM Swap check tells you whether that someone is likely to still be the customer. For high-risk actions you want both answers.

## How do banks combine SIM Swap with OTP?

| Event | Network check | If the check raises a flag | Otherwise |
|---|---|---|---|
| Password reset | SIM Swap /check before sending the reset OTP | Block the OTP; require in-app or in-branch confirmation | Send the OTP |
| New beneficiary or large transfer | SIM Swap /check, short maxAge | Hold the transaction for review | Send the transaction OTP |
| Onboarding a new customer | Number Verification /verify | Fall back to SMS OTP | Skip the OTP step |
| Change of registered phone number | SIM Swap /retrieve-date on the old number | Manual review | Confirm on both old and new numbers |

The [BroadNet OTP platform](https://www.broadnet.me/products/otp) delivers the codes in this flow over SMS, WhatsApp and voice with fallback between them, and [MyOTP](https://www.broadnet.me/products/myotp) packages it as a ready verification product.

## What does it cost?

Pricing is set by each operator or its channel partners and is agreed commercially. None of the official sources we checked publishes a Middle East price list for either API, so we do not quote one. When you compare costs, count what the check saves as well as what it costs: a SIM Swap check before a password-reset OTP is one extra API call, and a prevented account takeover is worth far more.

## What do network APIs mean for operators?

For operators, Number Verification and SIM Swap turn data the network already holds into a paid, consent-based service for banks and apps, and the same fraud teams that buy them also buy A2P messaging. BroadNet has worked with operators since 2003, with 60+ operator firewall deployments; our [operator solutions](https://www.broadnet.me/operators) and [SMS firewall](https://www.broadnet.me/operators/sms-firewall) protect the messaging revenue that these APIs sit next to.

## Frequently asked questions

### What is the CAMARA Number Verification API?

A standard operator API that confirms whether the phone number a user gave matches the number of the device they are using, returning true or false, or returns the device's number. It uses silent network or SIM-based authentication, so there is no code to type.

### How does the SIM Swap API work?

You send a phone number. The /check operation answers true or false for a period you set with maxAge (1 to 2,400 hours, default 240); /retrieve-date returns the timestamp of the last SIM change, or the activation date if there was none.

### Which Middle East operators offer these APIs?

As of 26 September 2026, the launch we could confirm at an official source is Qatar: Ooredoo Qatar and Vodafone Qatar launched SIM Swap and Number Verification on 26 November 2025. Check with operators in other countries before relying on them.

### Can Number Verify replace SMS OTP?

Only where the user's operator supports it and the connection allows it. Use it first where available and keep SMS or WhatsApp OTP as the fallback everywhere else.

### Does Number Verification work on Wi-Fi?

In the standard flow the device must be connected to the mobile network. The CAMARA definition says it works over any connection, including Wi-Fi, when the app uses a GSMA TS.43 temporary token from the device.

### Should I check SIM Swap before every OTP?

No. Use it before high-risk actions such as password resets, new payees, number changes and large transfers. For routine logins on a known device, the extra check rarely changes the decision.

### What happens if the operator cannot share the SIM swap date?

It can return null, optionally with a monitoredPeriod in days. Treat that as no swap within the monitored period, and fall back to your own risk rules.

### What does the SIM Swap API cost?

Prices are set by each operator or its channel partners. The official sources we checked do not publish Middle East prices for either API.

## Sources

- Ooredoo Qatar, [Qatar mobile operators launch anti-fraud APIs through GSMA Open Gateway initiative](https://www.ooredoo.qa/web/en/press-release/qatar-mobile-operators-launch-anti-fraud-apis-through-gsma-open-gateway-initiative/), 26 November 2025, accessed 26 September 2026.
- CAMARA, [Number Verification API definition, release r3.2](https://github.com/camaraproject/NumberVerification/blob/r3.2/code/API_definitions/number-verification.yaml), accessed 26 September 2026.
- CAMARA, [SIM Swap API definition, release r3.3](https://github.com/camaraproject/SimSwap/blob/r3.3/code/API_definitions/sim-swap.yaml), accessed 26 September 2026.
- CAMARA project pages, [Number Verification](https://camaraproject.org/number-verification/) and [SIM Swap](https://camaraproject.org/sim-swap/), accessed 26 September 2026.
- GSMA, [GSMA Open Gateway](https://www.gsma.com/solutions-and-impact/gsma-open-gateway/), accessed 26 September 2026.