Reshumot
4notify Israel · Official Records
OFFICIAL · Bank of Israel · Bit · PayBox
Record No
RSH-IL-001
Date
2026-05-27
Status
In force
Category
Banking & payments

Strong authentication and instant P2P: one-time-code delivery to Israeli banking over Cellcom, Partner, Pelephone and HOT Mobile

The Bank of Israel supervises the banking system, and instant peer-to-peer transfers run on Bit (Bank Hapoalim) and PayBox (Israel Discount Bank). Every transfer and every mobile-banking confirmation requires a second factor. 4notify delivers one-time codes with a P50 under 4 seconds over Cellcom, Partner, Pelephone and HOT Mobile via direct tier-1 connections. The code lands before the window closes.

SMSPushEmail
Preamble

Section 1 — By virtue of the authority vested by the Banking (Licensing) Law, 5741-1981 and the Bank of Israel directives on digital channels, the present Record is issued concerning the delivery of strong-authentication one-time codes over the Israeli mobile networks.

Legal basis
Banking (Licensing) Law, 5741-1981

Governs licensed banking corporations and the Bank of Israel's supervisory authority over digital channels.

Bank of Israel — Proper Conduct of Banking Business directives

Duty of supervised entities to apply two-factor authentication on digital and mobile-banking channels.

Bit / PayBox operating rules

Instant P2P transfer confirmation and the second-factor obligation on each transaction.

Implementation
01

MOC notification + tier-1 connection

4notify holds direct tier-1 connectivity with all four operators and is listed as a recognised provider for authentication traffic into Israel.

02

The OTP is generated in the bank's HSM

The one-time code is generated inside the bank's hardware security module; 4notify receives only the hash and the phone number.

03

60-second window + fallback chain

The SMS is delivered within 60 seconds; if the DLR fails, push follows, then email. Grey-route delays are avoided entirely.

04

Seven-year audit custody

Every delivery is signed and retained for seven years, in line with Bank of Israel record-keeping and anti-money-laundering requirements.

Delivery envelope
json
{
  "event": "bank.instant_transfer.otp",
  "bank_id": "IL-XXXX",
  "transaction_id": "TX-2026-05-27-948210",
  "amount": 450.00,
  "currency": "ILS",
  "rail": "bit",
  "delivery": {
    "channel": "sms",
    "fallback": ["push", "email"],
    "window_seconds": 60,
    "template": "il_bank_otp_v3"
  },
  "audit_signature": "https://4notify.net/sig/bank/948210"
}
Sample message
SMS

Bank Hapoalim: your code to confirm a Bit transfer of ILS 450 to D. Levi is 482193. Valid 5 min. Do not share it with anyone.

Compliance checklist
  • Recognised-delivery-provider notification with the MOC in force
  • Direct tier-1 connection to Cellcom, Partner, Pelephone and HOT Mobile active
  • OTP P50 ≤ 4 seconds measured per quarter
  • Seven-year audit custody documented
The 4notify difference

4notify is the only A2P provider with simultaneous direct tier-1 connectivity across Cellcom, Partner, Pelephone and HOT Mobile, plus signed seven-year audit custody for strong-authentication delivery aligned with Bank of Israel and Bit/PayBox rules.

Frequently asked questions
Does 4notify deliver directly to Israeli banks or through an aggregator?

Direct tier-1 connection with Cellcom, Partner, Pelephone and HOT Mobile. We do not use grey-route aggregation for authentication traffic.

Do push notifications count as a second factor?

Yes — an app-bound push is a recognised possession factor. But because the app cannot guarantee a durable medium, we always pair it with SMS or email.

Published
4notify Operations Department
2026-05-27 · RSH-IL-001

Start free

14 days, no card. English support on weekdays.

Other records in this edition