SIM swap fraud prevention: when the phone number stops proving anything

SIM swap fraud prevention, for a bank, starts from an uncomfortable fact: a one-time code sent by text proves only that someone controls the phone number at that moment, not that the customer does. In a SIM swap, a criminal persuades or pays a mobile carrier to move the customer's number to a SIM card in the criminal's phone; from then on, password resets, login codes and payment alerts go to the criminal. A bank cannot stop the carrier's mistake, but it can treat a recent number change as a strong takeover signal, refuse to send codes to a number that has just moved, and confirm with the customer through another channel. Botminds' Account Takeover Fraud Prevention does this as part of every case: it dates each contact detail, marks a number changed during the session as never to call, and proposes outreach only to contacts that predate the first suspicious step.

The bank examples are sample data on fictional people at a fictional bank, Corvane National Bank, as it runs through the solution.

How does SIM swap fraud work? The carrier moves the number, the codes follow

SIM swap fraud works by moving the customer's phone number to a device the criminal holds, usually by deceiving or bribing the mobile carrier. The FBI's glossary defines it this way: "The use of unsophisticated social engineering techniques against mobile service providers to transfer a victim's phone service to a mobile device in the criminal's possession" (FBI IC3, 2025 Annual Report, Appendix B). Its 2022 warning described three methods: impersonating the victim to the carrier, paying "a mobile carrier employee to switch a victim's mobile number to a SIM card in the criminal's possession", and phishing carrier staff to plant malware in carrier systems (FBI IC3, I-020822-PSA).

What happens next is what makes it a banking problem. "Once the SIM is swapped, the victim's calls, texts, and other data are diverted to the criminal's device," the FBI wrote, and the criminal can send "Forgot Password" or "Account Recovery" requests. "Using SMS-based two-factor authentication, mobile application providers send a link or one-time passcode via text to the victim's number, now owned by the criminal, to access accounts." The second factor has become the criminal's first.

A port-out works the same way with a different mechanism: the number is moved to another carrier instead of another SIM. The FCC's 2023 order treats the two together, because the effect on everyone who relies on the number is identical.

Can a SIM swap empty a bank account? Yes, when the phone number is the key

Yes, if the bank relies on the phone number to reset passwords, approve new payees or confirm transfers. The FCC put the chain in one sentence: with control of the calls and texts "used to authenticate a customer's financial, social media, and other accounts, the bad actor may have the means to gain access to these accounts and then change login credentials, obtain sensitive information, drain bank accounts, and sell or try to ransom social media accounts" (FCC 23-95, 2023).

The window can be short. In the sample bank's queue, one case began with a number port 17 minutes before a login on a new phone, followed by a $2,400.00 person-to-person payment to a new recipient. Person-to-person payments at the sample bank are held 45 minutes, so the decision had to be made inside that hold. A bank that learns of a number port only when the customer calls to say their phone stopped working usually learns too late.

Is SMS one-time passcode secure? NIST calls it a restricted authenticator

Not on its own for high-risk actions. NIST's 2025 digital identity guidelines place one authenticator in a special category: "At the time of publication of these guidelines, there is one restricted authenticator: the use of the PSTN for out-of-band authentication" (NIST SP 800-63B-4). The PSTN is the public telephone network, meaning codes by text or voice call. An organisation that accepts a restricted authenticator must "assess, understand, and accept the risks associated with that authenticator and acknowledge that risks will likely increase over time", and must offer users an alternative that is not restricted.

The last column is the lesson. Moving customers off text codes protects them only if account recovery and device enrolment do not fall back to text codes. NIST makes the point directly: "Setting or changing the pre-registered telephone number is considered to be the binding of a new authenticator", which should be no easier than the original binding. NIST writes for federal systems, not banks, but the logic carries to anyone who sends a code to a phone.

How do banks detect SIM swaps? Signals at the carrier, at the profile and in the session

Banks detect SIM swaps by looking for signs that the phone number recently moved or that the device behind it changed, before relying on that number. NIST lists the signals a verifier should weigh: it "SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior) before using the PSTN to deliver an out-of-band authentication secret." The FFIEC's appendix asks banks for processes to handle "lost, stolen, or changed information and devices, including changes to established phone numbers or carriers" (FFIEC 2021).

In practice the signals come from three places. From the carrier side, where the bank has access to it, a recent SIM change or port on the customer's number. From the bank's own profile, a phone number or email changed in the last minutes or days. From the session, a first-seen device, a new location, or a password changed seconds after login. Any one of them is common among genuine customers; two or three together, minutes before a new payee or a transfer, are the takeover's signature.

A number change three minutes after login, and the passcode that followed it, in Account Takeover Fraud Prevention

The sample case shows the bank-side version. No carrier was involved: the criminal changed the mobile number on the bank profile three minutes after logging in. The change alert went to the new number, and the passcode for the new payee went there five minutes later. Both controls worked exactly as designed and protected nobody, because each trusted whatever number was on the profile at that moment.

The FCC's SIM swap rules: what carriers must now do, and what is still the bank's job

The FCC's November 2023 order requires wireless providers "to adopt secure methods of authenticating a customer before redirecting a customer's phone number to a new device or provider" and "to immediately notify customers whenever a SIM change or port-out request is made on customers' accounts" (FCC 23-95). Providers must also offer every customer, at no cost, the option to lock their account against SIM changes, and review their authentication methods at least annually.

The FCC was frank about the limits of its own choice on text codes: "We decline to restrict the use of SMS-based customer authentication for SIM change requests, but we strongly encourage wireless providers to use this mechanism only when paired with other secure methods of authentication." It also recorded customers' complaints that carriers "refused to provide them with documentation related to a fraudulent SIM change, making it difficult for them to pursue claims with their financial institutions or law enforcement". A bank investigating a disputed transfer after a SIM swap should expect to need that documentation and ask for it early.

Does SIM swapping still work? Complaints to the FBI have fallen, the risk has not gone

It still works, but complaints to the FBI about it have fallen sharply since 2021. The FBI received 1,611 SIM swapping complaints with "adjusted losses of more than $68 million" in 2021; in 2025 it received 971 complaints with $17.4 million in losses.

Falling complaint numbers are not falling risk to a bank. IC3 assigns one crime type per complaint, so a victim whose SIM swap led to an emptied bank account may well file it as account takeover or identity theft. Carrier protections have improved, and the FCC's order adds to them, but the number on a bank profile can still be changed by anyone who gets into the account. In the sample bank, one in seven confirmed takeovers over 90 days began with a number port. Where the wider numbers come from is set out in the guide to account takeover fraud statistics.

What should a bank do after a SIM swap? Hold, reach the customer another way, restore

After a SIM swap or a suspicious number change, the bank should stop relying on that number at once, protect anything in flight, reach the customer through a contact that predates the change, and restore the profile with a second person's check. The order matters: a call to "the number on file" is the most natural first step and, after a swap, the worst one.

In the sample case, the restore plan put back the mobile number on file since March 2019, revoked the criminal's device, ended every session, reset the credentials, stepped up the customer's contact-center authentication for 90 days and mailed a letter to the address on file since 2004. The letter said what happened and that no money left, and that the bank will never ask for a password or passcode.

In Account Takeover Fraud Prevention, the restore puts back the number that predates the takeover

What authentication replaces SMS codes? Factors bound to a device, and recovery that matches

The replacements are factors that live on an enrolled device rather than travel over the phone network: approvals in the bank's own app, codes generated by an authenticator app and, strongest, phishing-resistant authenticators built on device-bound cryptographic keys. The FBI's 2022 advice to the public pointed the same way: "Use strong multi-factor authentication methods such as biometrics, physical security tokens, or standalone authentication applications to access online accounts."

Two cautions keep the change honest. First, NIST requires an alternative when a restricted authenticator is used, but it does not make every customer able to use the strongest option; some will keep text codes, and the bank's monitoring has to cover them. Second, the strength of any factor is capped by the weakest way to replace it. A bank that moves logins to app approvals but lets a customer re-enrol a new device with a text code has moved the SIM swap risk, not removed it.

How do you prevent SIM swap fraud? The customer's part and the bank's

Customers can lower the odds: the FBI advises not to advertise financial assets online, to verify any call claiming to be the carrier by calling back, and to "Be aware of any changes in SMS-based connectivity", since a phone that suddenly loses service may mean the number has moved. Under the FCC's rules, customers can also ask their carrier to lock their account against SIM changes.

The bank's part is to stop treating the phone number as proof. That means watching for number changes and ports, refusing to send codes or call-backs to a number that has just moved, moving customers toward factors that do not depend on the phone network, and making the contact center as careful about number changes as online banking is, the subject of the guide to contact center fraud prevention. What the FFIEC expects of those controls is in the guide to the FFIEC authentication guidance. To see how the solution handles a number change on your own past cases, start from Account Takeover Fraud Prevention.

Questions people ask

How do banks detect SIM swaps?

They look for a recent SIM change or number port where the carrier makes it available, a phone number changed on the bank profile, and a new device or location in the session, before relying on a text code or call-back. NIST's 2025 guidelines list a device swap, a SIM change and a number port among the risk indicators to weigh before sending a code by text.

What are the FCC SIM swap rules?

The FCC's November 2023 order requires wireless providers to use secure authentication before moving a number to a new device or provider, to notify customers immediately of SIM change and port-out requests, to offer a free account lock against SIM changes, and to keep records of SIM change requests and the authentication used. It did not ban text-message authentication for SIM changes but strongly discouraged using it alone.

Can SIM swapping happen without the customer noticing?

Usually the customer's phone loses service, which the FBI lists as a warning sign, but many people assume a network fault. Under the FCC's rules carriers must notify customers immediately of a SIM change request; in practice that notice may reach the phone that has just lost the number, so another channel such as email matters.

Is a bank liable if a SIM swap empties a consumer's account?

Usually yes, for electronic transfers from a consumer account: under Regulation E a transfer made by someone else using the customer's credentials is unauthorized, and the customer's share is capped by how fast they report. Business accounts fall under UCC Article 4A, where the security procedure decides.

Does an authenticator app protect against SIM swaps?

It removes the main path, because the code is generated on the customer's device rather than sent to their number. It does not help if the customer reads the code to a caller posing as the bank, or if the bank lets a new device be enrolled with a text code after a reset.