MobileConnect

MobileConnect is a universal log-in solution with privacy protection, allowing users to provide authentication at a number of security levels on any devices and is intended to reduce the need for users to remember usernames and passwords. MobileConnect was developed by GSMA and its operator partners. The service is built to securely authenticate users, allowing those users to confirm their identity and their credentials to access mobile and digital services. The service works by using an individual's unique mobile number combined with a unique PIN to verify the user's identity, authorize transactions, and grant online access.

MobileConnect is used in various countries, offered by mobile operators. In Brazil and Taiwan, the service is offered by all mobile operators; in Russia four operators—Beeline, MegaFon, MTS, and Tele2—offer MobileConnect; and Orange, with Ariadnext, is piloting a new service called "Mobile Connect et moi" to make government services available to Orange users through their mobile device.

Mobile Connect offers various services that are developed to be easy for mobile operators to connect, using MobileConnect's API, which has a federated architecture intended to work with mobile operators. Further, by matching an end-user and their mobile number, MobileConnect is built to allow users to confirm their online identity and authorize transactions, while only sharing the bare necessary personal data. MobileConnect's services are delivered through the MobileConnect API, which uses the OpenID Connect standard, for security.

MobileConnect's Authentication service offers a single factor level of assurance (LoA2), which confirms the end-user is in possession of their mobile phone when a digital service provider (DSP) receives a MobileConnect API request from an application. Further, Authenticate Plus offers a two-factor level of assurance, which requires the end-user to confirm they are in possession of their phone and, when prompted, enter a PIN. The service gives end-users explicit consent before sharing identity data, offers a single API for DSPs, and offers identity data either as single values or a set of values.

MobileConnect's Authorization service allows end-users to authorize any request from a DSP from their mobile phone. Through this service, the DSP provides the details for their request through the MobileConnect API, and the user approves or rejects the request. This service is also offered with a Plus service, in which the end-user has to authenticate by entering a PIN before authorizing the request.

MobileConnect's Identity service allows users to consent to share just one personal identity factor, the MSISDN associated with their MobileConnect account. End-users can sign up and consent for their mobile operator to share the core information about them to MobileConnect and, in turn, allows MobileConnect to share parts of that information with a requesting DSP. The Identity service allows users to share core information to reveal their identity in accordance with local legislation and regulations. This service also offers KYC services to ensure the user's identity and information.

MobileConnect's Attributes uses device and network information for ID verification and fraud prevention, including matching the phone number entered by a user to verify identification and to help prevent fraud for users and DSPs.