Security · 2026-03-28

Single-Provider Carrier Lookups Leave a Blind Spot

By J. W. Bouckaert

Carrier lookups from one provider

Most identity platforms that integrate carrier intelligence pick one provider, such as Twilio Lookup v2 or Vonage Number Insight Advanced, and make one API call per check.

Both are mature platforms. The difference is in what each one reports. Each provider returns a different set of fields, reaches operators through different relationships, and covers a different set of countries and carriers. A check that depends on one provider inherits that provider's gaps.

The sections below describe those differences. A PasskeyBridge carrier lookup asks one provider per request and returns that provider's answer.

Single-provider lookups

The tables list the fields each provider documents for the packages PasskeyBridge reads.

Twilio Lookup v2

Twilio's Lookup v2 API returns data in packages requested through the Fields parameter. PasskeyBridge requests line_type_intelligence and sim_swap:

Field	Package	What it reports
`line_type_intelligence.type`	Line Type Intelligence	Line type: mobile, landline, fixedVoip, nonFixedVoip, tollFree and others
`line_type_intelligence.carrier_name`	Line Type Intelligence	Current operator name
`line_type_intelligence.mobile_country_code`, `mobile_network_code`	Line Type Intelligence	Current MCC and MNC
`sim_swap.last_sim_swap.swapped_in_period`	SIM Swap	Whether the SIM changed during the trailing period
`sim_swap.last_sim_swap.swapped_period`	SIM Swap	The period checked, such as `PT48H`
`sim_swap.last_sim_swap.last_sim_swap_date`	SIM Swap	Date of the last SIM change, returned only for GB, DE, ES and NL

Twilio's SIM Swap package is in private beta. It covers named countries in Europe, Latin America and North America, needs carrier registration and approval, and during the beta may not include every major carrier in a country. Lookup v2 has no porting-history field. Twilio sells a separate Line Status package for reachability; PasskeyBridge does not request it.

Vonage Number Insight Advanced

Vonage's Number Insight Advanced API returns these network fields:

Field	What it reports
`current_carrier.name`, `network_code`	Current operator
`current_carrier.network_type`	mobile, landline, landline_premium, landline_tollfree, virtual, pager or unknown
`original_carrier`	The operator the number was first assigned to
`ported`	unknown, ported, not_ported, assumed_not_ported or assumed_ported
`reachable`	unknown, reachable, undeliverable, absent, bad_number or blacklisted
`roaming`	`roaming` or `not_roaming`, with the roaming country and network when roaming, or `unknown`

Number Insight does not report a SIM swap. PasskeyBridge's Number Insight adapter sets the SIM swap fields to false and the lookup does not list SIM swap among that provider's capabilities. Vonage retires Number Insight on February 4, 2027 and points customers to Identity Insights, which is the Vonage product with a network SIM swap check.

The differences

1. Coverage

No single carrier intelligence provider has a direct relationship with every mobile operator. Each provider covers some countries and carriers directly and others through partners, and each documents its own coverage per package. Twilio's SIM Swap list, for example, names nine countries, and Sinch Number Lookup returns a SIM swap only for US and Canada numbers on a project Sinch has approved.

2. Signal semantics differ

Twilio's swapped_in_period is a boolean over a period chosen during onboarding, with a swap date only in four countries. A boolean tells you that a swap occurred within the period. A date tells you when, and recency is what determines risk. A swap 30 days ago and a swap two hours ago carry different risk, and a 48-hour boolean reports only one of them.

3. Porting detection differs

Vonage reports porting as an explicit status. The assumed_ported and assumed_not_ported values mark answers Vonage could not confirm with the operator. Twilio Lookup v2 has no porting field. Sinch Number Lookup reports porting, corrected for ports in the US and Canada.

4. Reachability

Vonage's reachable field reports whether the handset is reachable, with absent for a device that is off or out of coverage. A number that is absent during a high-value authentication attempt is a risk signal. A verifier that only calls Twilio Lookup for line type and SIM swap does not see it.

The attacker's perspective

An attacker who learns which carrier API a target's identity provider uses can plan around that provider's gaps: a carrier the provider's SIM swap check does not cover, a field the provider does not return, or a window before the operator's records reflect a port.

The FBI's public service announcement on SIM-swap fraud reports 1,611 SIM-swap complaints in 2021 with adjusted losses of more than $68 million. The FBI's IC3 2025 report counts 971 SIM-swap complaints with reported losses of $17,366,758. Those figures cover only crimes reported to IC3.

The lookup in the next section asks one provider, so the gaps of that provider are the gaps of the call.

One provider per lookup

shield-carrier-lookup selects one provider for the call.

vonage calls Vonage Number Insight on PasskeyBridge's account. twilio calls Twilio Lookup v2 on that same hosted account. Both require the hosted carrier lookups add-on.
vonage_identity_insights calls the Vonage application the tenant registered under Settings. sinch_number_lookup calls the tenant's Sinch Number Lookup project. Those spend the tenant's own carrier account, so they need a registration and no add-on.
A lookup that names no provider uses the registered Vonage application when one exists, and the Sinch project otherwise.
The record action takes an answer the tenant got from its own provider, posted with a digest the tenant computed, so no phone number reaches PasskeyBridge.

One answer comes back. A provider call that does not answer within 15 seconds fails that lookup. The audit row names the provider that was asked. Inbound signals are a separate path: a tenant registers signal sources under Settings, each with its own signing secret, and posts JSON to the shared ingest URL with that source's id. Several sources can be active. Each post is one payload, matched to a playbook by the event type on the body.

Playbook actions that run after ingest update rows PasskeyBridge holds: agent delegates, BLAST tunnels, A2A negotiations, cached proofs. A webhook callback is how the tenant's backend acts on its own users. The freeze-credentials action invalidates cached proofs stored here. Passkeys registered with the tenant's application stay registered.

Lookup cost

Each lookup is one provider call. Hosted Number Insight and Lookup v2 spend the add-on. A tenant-registered Vonage application or Sinch project spends the tenant's carrier account. There is no second provider on the same request.

Identity signals documents the lookup and the ingest path. Get started free.

Start free · Test the API