Number Verification and KYC Match that verify the person, not the SIM

The short answer

What

Two CAMARA-compatible REST APIs: number-verification (is this phone number the person’s?) and kyc-match (do name, birth date, address match?).

Answered from

The PID in the person’s wallet and the phone number the site operator verified for the account – not from the mobile network.

Proves

That the right person confirmed just now with a wallet built to the EUDI ARF – not only that a SIM card is present.

Your service gets

true, false or not_available per field. The personal data stays on the server.

Where

Every EU country, any wallet built to the EUDI ARF, no contracts with mobile operators.

SIM check or person check?

Both approaches use the same API shapes. What they prove is different.

How it works

Three-legged, like CAMARA: the person consents, your backend calls the API with the resulting access token.

The APIs

Example

# 1. Send the person to the wallet sign-in (your OIDC client on the tenant)
GET <authorization_endpoint from https://<tenant>/.well-known/openid-configuration>?response_type=code&client_id=<your-client>
    &redirect_uri=<your-callback>&scope=openid%20number-verification:verify%20kyc-match:match
    &acr_values=urn:codeb:acr:eudi-wallet&state=<state>&code_challenge=<S256>&code_challenge_method=S256

# 2. After the code exchange: is +35699123456 this person's number?
curl -X POST https://<tenant>/camara.ashx/number-verification/v0/verify \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "Content-Type: application/json" \
  -d '{"phoneNumber":"+35699123456"}'
{"devicePhoneNumberVerified":true}

# 3. Do name and birth date match the identity card in the wallet?
curl -X POST https://<tenant>/camara.ashx/kyc-match/v0.3/match \
  -H "Authorization: Bearer $ACCESS_TOKEN" -H "Content-Type: application/json" \
  -d '{"givenName":"Maria","familyName":"Keller","birthdate":"1985-04-12"}'
{"givenNameMatch":"true","familyNameMatch":"true","birthdateMatch":"true"}

OpenAPI (identity APIs) · OpenAPI (platform)

Where the phone number comes from

• The site operator verifies a person’s number and marks it in the account. The server records who verified it, when, and for which number.
• If the person changes the number, the verification is removed automatically.
• The person can add the number to the wallet as the card “Verified phone number” (SD-JWT and ISO mdoc, valid one year). The card is revoked automatically when the number changes or the verification is removed.

Also for people on a call: Verify caller

The same check works without any integration. The person who receives a call opens Verify caller, reads out a 6-digit code, and the caller confirms with the wallet. The person called then sees the verified name – and the verified number if the caller agrees. Any network, any phone, video calls included. A cloned voice or a faked caller ID cannot pass, because the check needs the real person’s wallet.

Privacy by design

• KYC Match answers only true, false or not available; the values from the PID are never sent. Addresses are compared as a whole, so a request cannot test many variants at once.
• One wallet confirmation allows at most 5 calls per API within 15 minutes; then the person has to confirm again. Only sign-in clients registered on the site can call them; the site admin can limit each API to chosen clients or switch it off.
• No contracts with mobile operators and no network data: the check does not depend on SIM, roaming or location.
• Each answer is written to the tenant’s audit log with the client and the result count, not with the values.
• Runs on your own CodeB tenant in the EU.

Honest limits

• The phone number is as good as the operator’s verification of it. Today it is verified by the site operator, not confirmed by a mobile network.
• KYC Match needs a wallet that presents a PID. Fields the PID does not contain are answered not_available.
• The API shapes follow CAMARA; it is not a mobile-network API and not a CAMARA-certified service. If you also need to know that a specific SIM is in a device, combine it with a network check.

Frequently asked questions