SIM swapping — when someone convinces a carrier to transfer a victim’s phone number to a new SIM card without authorization — has been used to intercept SMS-based verification codes and take over accounts. In response, US regulators introduced specific rules requiring carriers to verify identity before processing these requests.
What SIM Swapping Actually Is
A SIM swap occurs when someone contacts a mobile carrier, impersonates the account holder, and convinces the carrier to activate that person’s phone number on a new SIM card (often one the attacker controls). Once successful, calls and texts intended for the real owner — including SMS verification codes — are redirected to the attacker’s device instead.
We cover the security implications of this specifically in our guide on SMS OTP vs. authenticator apps, since SIM swapping is one of the main risks that makes app-based authentication meaningfully more secure in some scenarios.
The FCC’s Rules on SIM Swap Protection
The FCC adopted rules requiring wireless carriers to:
- Verify customer identity using secure methods before processing a SIM swap request, rather than relying solely on easily-guessed personal information
- Notify customers immediately when a SIM swap or number port request is made on their account, giving the real owner a chance to catch unauthorized attempts
- Allow customers to place additional security holds or locks on their accounts, requiring extra verification before any SIM swap can proceed
- Maintain records of failed authentication attempts, supporting fraud investigation
These rules apply specifically to US wireless carriers and represent regulatory requirements, not just voluntary industry best practices.
What Consumers Can Do to Add Protection
Beyond the baseline protections carriers are required to provide, individual account holders can often take additional steps:
Set up a carrier PIN or passcode specifically required for any account changes, including SIM swaps — most major carriers offer this as an account security feature.
Enable account alerts for any changes to your account, so you’re notified immediately if a swap or port request is initiated.
Consider reducing reliance on SMS-only authentication for your most sensitive accounts (banking, primary email), using an authenticator app or hardware security key where the platform supports it, since these methods aren’t vulnerable to SIM swapping specifically.
Why This Regulation Matters for SMS Verification
Since SMS verification relies on the assumption that only the legitimate account holder can receive messages sent to their number, SIM swapping directly undermines that assumption when successful. These FCC rules don’t eliminate the risk entirely, but they raise the difficulty of executing a successful swap by requiring stronger identity verification and giving account holders visibility into swap attempts.
Frequently Asked Questions
Do these SIM swap protection rules apply outside the United States?
The specific FCC rules discussed here apply to US wireless carriers. Other countries have developed their own separate regulatory approaches to SIM swap and number port fraud, with varying levels of protection.
Can I completely prevent SIM swapping on my account?
No method offers complete prevention, but setting a carrier PIN, enabling account alerts, and reducing reliance on SMS-only authentication for sensitive accounts all meaningfully reduce risk.
How would I know if someone attempted a SIM swap on my account?
Under current FCC rules, carriers are required to notify customers when a SIM swap or port-out request is made, which should alert you to unauthorized attempts.
Does a SIM swap protection PIN stop all unauthorized account changes?
It significantly raises the difficulty for an attacker, since they’d need to know or bypass this additional PIN, but no security measure offers an absolute guarantee.
Are virtual or temporary numbers vulnerable to SIM swapping in the same way?
This depends on the specific provider’s account security practices, since virtual number accounts are managed by the number provider directly, rather than through traditional carrier SIM-swap processes — protections vary by service.
