Prepopulating Android phone numbers to tackle Dual-SIM confusion

Introduction

When building a mobile application, especially if it involves app security, you want to provide the most seamless, straightforward, and secure feature possible for your users.

‍

Requesting users to input their phone number is an ideal and simple way to assign a digital identity on mobile, but it can present various possibilities for issues. For example, the user could input the incorrect country code, mistype their phone number, or input a completely falsified phone number.

‍

Another related issue can occur if you’re implementing silent authentication into your application and your user has more than one SIM in their phone. For silent authentication to work, it’s important that the user enters the phone number associated with the active data connection — which comes from a single SIM.

‍

In this blog post, you’ll see how you can add automatic retrieval of the phone number in an Android mobile application. You’ll also be able to determine which phone number belongs to the SIM card associated with the cellular data connection.

How can I add this to my Android app?

Please note, this sample code is only functional for Android 10 (29) and above. Although the functionality exists within Android APIs, you may get an empty response depending on the Mobile Network Operator or the Android device when attempting to retrieve its phone number. We’ve created this code sample to aid you in retrieving the phone number for the SIM card associated with the active cellular data connection.

‍

To begin with, you’ll need to implement the IDlayr Reachability API, by making a `GET` request to the URL `https://{data_residency}.api.tru.id/coverage/v0.1/device_ip` with a IDlayr access token containing the scope as `coverage` only.

‍

A successful request will give a response similar to what’s below:

‍

‍

This request will verify that the Mobile Network Provider (MNO) providing the active cellular data connection is supported with Silent Authentication at IDlayr. It will also provide you with the `network_id` and any `network_aliases` associated with that MNO, which can be used to verify which phone number matches the data connection.

‍

Following this, you would need to compile a list of network aliases, including the network_id provided in the example above.

‍

Next, check that the Android application has permissions for the following two:

‍

• `READ_PHONE_NUMBERS` – Allows read access to the device’s phone number(s).
• `READ_PHONE_STATE` – Giving the app read only access to phone state, including the current cellular network information.

‍

Now, retrieve the Telephony Subscription Service to access the `activeSubscriptionInfoList` and `getDefaultDataSubscriptionId` functionality.

‍

Following this, what’s left is to loop through the `activeSubscriptionInfoList` for the subscription info.

‍

If the subscription info ID matches the `getDefaultDataSubscriptionId`, then check to make sure the network alias ID (from the reachability API) matches the compiled subscription string of the Mobile Country Code and the Mobile Network Code (`mccString$mncString`).

‍

A full Android example of this functionality is as follows:

‍

‍

So, how will this help my issue relating to Dual SIM users?

By retrieving the ID of the default data slot, you can compare this ID with the network alias IDs returned from the MNO through the IDlayr Reachability API, which was made over a cellular data connection from that device. Once a match is made, you can retrieve the phone number of the SIM card related to the default data slot ID and repopulate this.

‍

This eliminates the need for the user to input the phone number — as they will likely want to input the number unrelated to the active data connection.

‍

You’ll help reduce any incorrectly or maliciously entered phone numbers — avoiding a bad user experience, phishing attempts, or even SMS pumping attacks.

‍

For a full working example of running a Reachability API check, prepopulating the phone number with the active cellular data connection, and then running a IDlayr PhoneCheck, we’ve created a GitHub repository.