Security · 2026-05-12

Carrier Signal Freshness: TTL Over Signal Strength

By J. W. Bouckaert

A twelve-hour-old signal is not a signal

Every identity stack on the market today proudly enumerates the carrier attestations it consumes: SIM-swap checks, device-binding lookups, Number Verify, Know Your Customer Match, location confidence, roaming flags. The marketing math is simple: more signal types equal more security. The marketing math is wrong.

What actually determines the security value of a carrier attestation is when the signal was observed. A SIM-swap check that returned "no swap in last 24 hours" sounds reassuring until you notice that the check itself ran twelve hours ago. In the eleven hours and fifty-nine minutes since that response was cached, the SIM could have been swapped, a fraudulent OTP intercepted, the password reset, the funds moved, and the session you are now authenticating could be the attacker's, not the user's.

The signal is not stale. The signal is historical. Those are different things, and conflating them is how identity stacks ship CVEs disguised as features.

Freshness is the first-class property

Carrier signals decay. So do device-attestation chains, behavioral-drift scores, and every other "real-time" check that any production identity layer claims to make. The decay is not linear, it is not optional, and it does not respect the cache TTL your platform team set last quarter for cost reasons.

The hierarchy of attributes for any identity signal—in order of how much they actually matter to a security decision—is:

1. Freshness. When was this observed? This is the only attribute that can collapse the security value of every other attribute to zero.
2. Provenance. Who observed it? A carrier-direct lookup carries different weight than an aggregator's cached copy of an aggregator's cached copy.
3. Binding. What does it bind to? A SIM-swap check tied to an MSISDN that is not the MSISDN being authenticated is a curiosity with no control value.
4. Strength. How confident is the underlying observation? This matters, but it matters fourth.

The industry has spent a decade optimizing for #4 and treating #1 as an implementation detail. That ordering is exactly backwards.

The freshness decay curve

The threat model is unforgiving. From the moment a carrier signal is observed, the probability that the underlying state has changed—and that the cached signal is now actively misleading—rises monotonically. The curve is not a smooth exponential, because the underlying events (SIM swap, device handoff, eSIM profile switch, number recycling) are themselves discrete. But across a population, the aggregate decay is well-approximated by a step-rising hazard function.

The rows below illustrate that shape. They are not a PasskeyBridge measurement, and they are not calibrated against a benchmark this platform has published:

These are not absolute numbers. They drift by carrier, country, and population segment. The shape is what matters: the security value of a carrier attestation collapses inside the first sixty seconds, and is effectively gone by the end of the first hour.

ASCII rendering of the decay, normalized so that "fresh observation" = 1.0:

1.0  ▌
     ▌▌
0.9  ▌▌▌
     ▌▌▌▌
0.8  ▌▌▌▌▌▌
                ▌▌▌▌▌▌▌▌
0.7                     ▌▌▌▌▌▌▌▌
                                ▌▌▌▌▌▌▌▌▌▌
0.6                                       ▌▌▌▌▌▌▌▌▌▌▌▌
0.5  └──┬──────┬──────┬──────┬──────┬──────┬──────┬──→
       0.5s    5s     60s    5m     1h     12h    24h
                              signal age

This is why "we check SIM-swap status" is a meaningless claim until you append "...and the response is no older than N seconds where N is single digits." Anything else is a compliance artifact.

The economics of caching

Caching is not stupidity. Caching is economics.

A typical Tier-1 carrier API charges per query and rate-limits aggressively. Operator-side aggregators (Twilio Verify, Vonage Number Insight, Sinch, Telesign) absorb that cost and resell at a markup. At enterprise scale—millions of authentications per day—the per-call price difference between a fresh lookup and a cached response is the difference between a viable identity layer and a CFO-mandated migration to OTP-only.

So vendors cache. The ranges below are a picture of published vendor defaults. They are not a PasskeyBridge benchmark:

The aggregator that markets a "real-time SIM-swap API" while caching for thirty days is, technically, telling the truth. The query is real-time. The response is from last month. The contract does not require those to be the same thing, and most contracts are written carefully to ensure they are not.

This is the structural reason why the silent number recycling attack class works in 2026, why invisible SIM-swaps routinely defeat carrier-attestation checks, and why "we use SIM-swap detection" appears in every breach post-mortem from the past eighteen months.

Sub-second TTL in practice

Drive the TTL toward zero and the threat model collapses in your favor. The same MSISDN, queried fresh at the moment of authentication, can defeat attacks that an hour-old cached lookup is structurally incapable of seeing.

The differential is starkest on attacks that the industry has already conceded:

A lookup made during the authentication sees a change that an hour-old cached answer has already missed. The lookup is current. That is the whole difference.

Carrier lookup on this platform

shield-carrier-lookup asks one provider when you call it. It does not keep a carrier-signal cache, it does not apply a 1500 ms ceiling, and it does not weight two providers by age. The answer is as fresh as that provider's answer on that call.

Hosted lookups (Vonage Number Insight, Twilio Lookup) spend the hosted-lookups add-on. A lookup that names no provider uses the Vonage application registered under Settings, or the tenant's Sinch Number Lookup project when that is the registration on file.

An ingested signal records decision_ms for PasskeyBridge's own work on the request. That figure is separate from the carrier round trip, and it is not a published latency target.

Questions for your identity vendor

These questions are for a vendor that sells multi-provider freshness. They are not a description of shield-carrier-lookup, which asks one provider and stores no signal age.

Five questions that will distinguish a freshness-first identity layer from a strength-first one:

1. What is the maximum age of a carrier signal that can contribute positively to an allow decision? If the answer is in minutes or hours, the vendor is selling historical artifacts.
2. What is the median observed age of the signals you used in my last 1,000 authentications? If the vendor cannot answer, the data is not in the audit log, which means the audit log cannot answer "was this defensible at the time."
3. When two providers return conflicting signals at different ages, how do you reconcile? "Highest confidence wins" is the wrong answer. "Freshest signal wins, weighted by decay constant" is the right one.
4. Is your cache TTL configurable per tenant? If not, the vendor has chosen the cache TTL that maximizes their margin.
5. What is your carrier-direct integration ratio versus aggregator passthrough? Aggregators introduce a second layer of caching the vendor cannot see, let alone control.

The answers will tell you, in about four minutes, whether you are buying real-time identity verification or expensive nostalgia.

Direction of the standards

Freshness as a first-class property is the direction the standards bodies are already moving and no invention of ours: OpenID SSE/CAEP, SCIM 2.0 event signaling, GSMA Open Gateway's CAMARA APIs, and the eIDAS 2.0 EUDI Wallet all assume push-based, freshness-stamped signaling rather than pull-based polling against stale caches.

The vendors that built their pipelines around aggressive caching are about to discover that the standards trajectory is incompatible with their business model. The vendors that built around sub-second freshness will discover that their architecture is the standard, and the migration cost is zero.

Bearer tokens were a 2012 design for a 2012 threat model. So were minute-and-hour cache TTLs on carrier signals. The threat model moved on. The signals have to move with it.

---

Carrier lookup setup is in the identity signals guide. Single-provider lookups describes the one provider a PasskeyBridge call asks.

Start free · Test the API