Network APIs let a company's software ask a mobile operator questions about a phone number, such as "Was the SIM card for this number replaced recently?" or "Is this app really running on the phone that has this number?" An API is a fixed format in which one program asks another program for something. Network APIs open up information from the mobile network itself.
Why would a bank want to ask? Many frauds in India depend on a SIM swap. A fraudster collects a victim's details. Then, with fake documents, he persuades the operator to issue a new SIM card for the victim's number. The victim's phone loses its signal. In India, the new SIM cannot receive text messages for its first 24 hours. After that, every OTP reaches the fraudster's phone. He resets the victim's banking password and moves the money out.
Say a fraudster does this to a retired railway employee in Ranchi. At 11 p.m. the next day, someone tries to register the employee's bank account on a new phone, and asks for an OTP. Before sending it, the bank's app asks the operator's SIM swap API: "Was the SIM for this number changed in the last 72 hours?" The operator checks its own records and replies: "Yes, 30 hours ago." The bank does not send the OTP. It holds the request and asks the customer to visit the branch or to confirm by another method. The fraudster has the SIM card, but not the money.
There are other network APIs. Number verification lets an app check that the phone's mobile data connection belongs to the number that the user typed, with no OTP to type. The operator can check this because it knows which SIM card is using its data network at that moment. This is called silent authentication. A location check confirms whether a phone is roughly where a payment claims to be made.
Operators are agreeing on common formats for these APIs, so that an app can ask the same question of any operator. The GSMA, the industry body of mobile operators, runs this effort under the name Open Gateway. Some messaging and voice API companies resell these APIs, so that a developer can reach many operators through one account.
The answers come from the operator's own systems, such as the packet core, which knows which SIM card is connected to the network. Banks use the answers in OTP verification, and in AML transaction monitoring, which checks payments for signs of fraud and money laundering. Caller ID apps can use them too.
Network APIs are still at an early stage. They work only where an operator has agreed to open its network, and the operator must protect its customers' privacy, asking for consent where the law requires it.