> The device makes a GET request to the check url, with a cellular data connection. The mobile network operator is able to verify that the phone number used to create the check URL matches that of the phone number assigned to that SIM Card making the data connection request.

I was curious how this actually worked but according to Lxgr's reply the network operator adds HTTP headers that allow the phone number to be verified.