Kunal Shukla, SVP and GM, Head of Network APIs at Vonage, explains how real-time mobile network data can help payment providers detect emerging fraud risks, strengthen authentication and protect customers without adding unnecessary friction to transactions.
It’s easy to think that because someone has successfully completed identity verification and established a pattern of genuine activity, their account is secure. However, a great deal can change after onboarding – which static risk models may miss. A customer’s mobile number may have moved to a new owner, their SIM may have recently been replaced, or a criminal may have obtained access through social engineering.
Fraud controls that rely heavily on information collected during registration are not always able to detect these developments. This limitation is becoming increasingly expensive as consumers make more payments through mobile devices and criminals adopt quicker methods of compromising genuine accounts. UK Finance found that criminals stole £1.28 billion through payment fraud in the UK during 2025, up 4% year on year.
The point at which risk is assessed has therefore become just as important as the information being assessed. Payment providers must be able to identify warning signs that appear after onboarding and respond before a transaction is completed.
An established customer can become a new risk
Know Your Customer (KYC) processes provide the initial foundation for confirming a customer’s identity. Businesses can then combine device intelligence, IP data, behavioural signals and transaction records to develop a broader understanding of the account. The difficulty is that some of this information can lose its relevance relatively quickly.
For example, a long-standing customer may attempt to make a significant payment. They enter the correct credentials, use the mobile number registered to the account and behave much the same way as they have before. On the surface, there may be little reason to question the transaction, even though the SIM associated with that number was replaced earlier that day.
A SIM replacement is not automatically suspicious. Customers regularly upgrade their phones or replace damaged cards. However, it can also indicate a SIM-swap attack in which a criminal takes control of a victim’s number to enter their financial accounts. Without up-to-date insight into the number, the provider may approve a payment that carries more risk than the available account history suggests.
The same problem can occur if a mobile number has been reassigned or the current subscriber’s details differ from those originally provided. This is why risk should be reconsidered during key activities such as recovering an account, changing a password or authorising a payment. Data gathered at the start of the relationship cannot always provide sufficient assurance at the precise point funds are transferred.
Applying more checks to everyone comes at a cost
So, what can businesses do? Often, the approach taken is to compensate for a lack of current information by applying stricter controls to more customers. Routine transactions can then become subject to lower risk thresholds, repeated one-time passcodes or further identity challenges.
The problem with this is that legitimate customers find themselves facing unnecessary steps to authenticate transactions, being forced to switch apps to complete a payment or wait for a slow SMS code. And every extra bit of friction is another opportunity for them to abandon the transaction. At scale, this can reduce completed purchases, create more demand for customer support and leave users with a poorer impression of the service.
Effective fraud prevention depends on knowing which transactions require further verification. If the account history, device and mobile identity continue to align, there may be little reason to interrupt the customer. Conversely, evidence of a recent SIM replacement or conflicting subscriber data could provide valid grounds to introduce an additional check.
Existing authentication technology still has an important role to play within this process. Biometrics, passkeys and authentication based on FIDO standards can provide greater confidence that the person attempting to pay is genuine. Network APIs can support these methods by supplying timely intelligence about the subscriber and mobile number involved, enabling providers to adjust authentication according to the circumstances rather than treating every payment in the same way.
Network data can reveal recent changes
Traditional anti-fraud systems do not always have visibility into developments taking place within the mobile network. Accessing relevant network information through APIs can give businesses an additional set of signals to incorporate into their existing decision-making.
For example, a provider may be able to verify that a number is currently active, establish whether it is associated with a mobile or fixed line and identify the relevant carrier. It may also be able to compare subscriber information, determine how recently a SIM was replaced or find out whether ownership of the number has changed since registration.
This information adds a timely layer to the customer’s identity profile. Rather than competing with the authentication and identity systems already used by payment companies, it provides network-level context that those technologies may be unable to access independently.
For instance, familiar device data and an ordinary transaction pattern might initially suggest that a payment is genuine. Learning that the customer’s SIM has just been changed could substantially alter that assessment. By evaluating these signals collectively, the provider is better placed to choose between completing the payment, introducing another authentication step or referring the activity for investigation.
Verification should reflect the circumstances
The earlier high-value payment offers a useful example of how this can work in practice. Before allowing the funds to move, the provider can assess recent network signals alongside the account information and transaction data it already holds.
Where the subscriber data remains consistent, no recent SIM replacement is recorded and nothing else appears unusual, the transaction may proceed without requiring further action from the customer. In circumstances where it is supported, authentication through the mobile network can also verify possession of the device behind the scenes, removing the need for an SMS code.
Different signals might prompt a more cautious approach. For example, a newly replaced SIM or subscriber details that conflict with the account could lead the provider to use a separate channel, request a stronger form of verification or pause the payment for manual assessment.
This need for current information extends beyond SIM-swap attacks. Criminals can use stolen login credentials and manipulation tactics to take over genuine accounts, while synthetic identities bring together authentic and fabricated details to form apparently credible profiles. The tactics are much easier for criminals to scale with the advent of AI, meaning it is increasingly important to check multiple sources of identity information.
On the other hand, AI can also be part of the solution. It can be used to enable fraud platforms to examine these signals and detect connections that would otherwise be difficult to spot. Even so, the output will only be reliable if the model is given accurate and current inputs. A system analysing an outdated picture of the account can miss the signals that point to fraud.
Fraud decisions must keep pace with transactions
Considerable effort has gone into strengthening the controls customers encounter when they first register for a financial service. The next priority is to apply the same rigour later in the journey.
Regulators and governments are also directing greater attention towards robust identity protection and security. This reflects a wider recognition that modern fraud cannot always be addressed through authentication processes built around a single point in time. To meet changing expectations, payment businesses need identity signals that allow them to reassess trust whenever an important action takes place.
Long-term risk profiles continue to offer valuable insight into a customer’s usual behaviour. Their value increases, however, when they are considered alongside recent information about the identity connected to the payment.
A transaction may be completed almost instantly, but the security of an account can change considerably between a customer’s previous purchase and the present. Bringing the risk decision closer to the point of payment can help providers identify questionable activity without placing unnecessary obstacles in front of genuine customers.
