Skip to main content

Header Enrichment

The shortest possible journey: on mobile data, the operator identifies the number, so the subscriber confirms with one tap and never types anything. It only works on the operator's data connection: a subscriber on Wi-Fi cannot be identified this way, so keep a PIN flow as the fallback.

What this diagram has to make unmissable, because it is the difference between working and not:

  • The subscriber's browser reaches us directly: this is the only flow where that is true.
  • The referrer is matched on ORIGIN only. Browsers strip the path on cross-origin navigation, so a registered URL carrying a path can never match.
  • The page must not suppress the referrer. A no-referrer or same-origin policy sends nothing and every tap is refused, with the cause in the SP's own markup.
  • One tap is the entire consent. There is no PIN, which is why the fraud check is not optional.