Is Identity Verification Using a Phone Number Lawful?

⏱️ Reading time: 11 min · 📁 Category: KVKK & Digital Compliance

Is identity verification using a phone number lawful? (KVKK 2026 analysis)

Identity verification using phone numbers is common in retail chains, e-commerce sites,
loyalty-card programmes and customer service.

However, recent decisions by the Turkish Personal Data Protection Board show that verification using a phone number
alone may not be sufficient.

This guide explains
when identity verification using a phone number is lawful and when it may breach KVKK
.

1️⃣ What is identity verification using a phone number?

Definition:

Identity verification using a phone number is a method of verifying a person’s identity
through their phone number.

This method is usually practiced in the following ways:

• Giving a phone number to the cashier
• Providing telephone number to customer service
• Logging into a membership account with a phone number
• Loyalty-card transactions

The phone number verification method has become common due to ease of use.

2️⃣ Basic assessment under KVKK

Under KVKK, identity verification forms part of the data-security obligation.

To prevent unlawful processing of personal data, controllers must ensure
an appropriate level of security.

📌 KVKK rule:

The verification method must provide reasonable assurance
that the person concerned is actually authorised to carry out the transaction.

3️⃣ When is using a phone number lawful?

In some situations, a phone number can be used
as part of identity verification.

✅ Examples of lawful use

• Sending SMS verification code
• Two-stage verification systems
• Mobile-app verification
• One-time verification codes

📌 The correct method:

Phone number + SMS verification code
is considered a strong verification method.

In these methods, the phone number is not used alone,
but as part of a verification mechanism.

4️⃣ When is using a phone number unlawful?

Using a phone number as the sole verification method
poses risks under KVKK in most cases.

❌ Examples of risky use

• Getting a discount by giving a phone number at the checkout
• Loyalty card use with phone number
• Carrying out transactions through customer service by simply giving a phone number
• Accessing account information with a phone number

📌 Critical fact:

A phone number is not secret information.
It therefore does not qualify as a secure verification method.

Third parties can easily find out phone numbers.

5️⃣ The Turkish Personal Data Protection Board’s approach

In recent decisions, the Turkish Personal Data Protection Board has closely examined
verification methods based on phone numbers.

• Loyalty card transactions
• Customer databases
• Campaign systems
• Customer service operations

The Board’s approach:

A phone number alone is not an identity-verification method.

Therefore, additional verification mechanisms are required.

6️⃣ The Most Secure Verification Methods

When verifying identity using a phone number,
strong verification methods should be used.

• SMS verification code
• Mobile-app approval
• Password verification
• Biometric verification

📌 2026 recommendation:

• Phone number + SMS verification
• SMS + password verification
• Mobile-app verification

7️⃣ Risks for Companies

Verification systems with phone number can pose the following risks.

• Wrong customer records
• Unauthorised transactions
• Personal-data breaches
• Customer complaints

📌 The biggest risk:

Someone may carry out a transaction using another person’s number.

8️⃣ KVKK Compliance Checklist

• ✔ Authentication analysis
• ✔ SMS verification system
• ✔️ Transaction-specific verification
• ✔ Data security controls
• ✔ KVKK documentation

🧠 Expert conclusion

The telephone number alone is not lawful as a method of authentication.

A phone number can be used as part of a verification mechanism,
but using it alone poses risks under KVKK.

Strong verification mechanisms are becoming mandatory for KVKK compliance.

Request a KVKK identity-verification assessment