Question Identity
How can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
How can banks defend against SIM swap fraud? Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control. Source: https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/ (Cleartext, verified 2026-09-24)
Where SIM swaps cash out #
A SIM swap is a means to an end. The losses happen in the flows that trust the phone number: password and account recovery, adding a new payee, raising a transfer limit, and changing the email or phone number on file. Those are the flows to harden first.
Controls, strongest first #
| Control | What it stops | Limits |
|---|---|---|
| Passkeys or device-bound credentials | The phone number stops being the key to the account | Recovery must not fall back to SMS |
| SIM-change signal from the carrier | Flags a number whose SIM changed recently, before you trust it | A risk signal, not an authenticator; coverage depends on the carrier |
| Cooling-off period after a new SIM or device | Buys time for the real customer to notice | Adds friction for legitimate changes |
| Alerts on a second channel | Tells the victim about changes the attacker made | Alerts can be missed or ignored |
Carrier network APIs standardized by the CAMARA project include a SIM Swap API that reports whether a number’s SIM changed recently.[2]
What the carrier side now covers #
Since the FCC’s 2023 order, US carriers must authenticate customers before a SIM change or port-out and notify them of the request.[1] That reduces the attack rate but doesn’t remove the exposure: NIST still classifies SMS codes as restricted because the channel itself can be redirected or phished.[3]
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
Start with account recovery and new-payee setup, where SIM-swap fraud tends to cash out. Those two flows justify the most friction and the strongest authenticators.
Fintechs & payment firms
A SIM-change signal is cheap to add to a risk engine and catches the most common pattern: a new SIM, then a login from a new device, then a withdrawal.
Developers & identity teams
Record when each user’s phone number was last verified and when the carrier last reported a SIM change. Both belong in the decision to accept an SMS code.
Follow-up questions #
- Don’t the FCC rules solve this?
- They make SIM swaps harder at US carriers, but a bank that treats an SMS code as proof of identity is still exposed to insiders, to carrier account takeover and to phishing of the code itself.
People also ask #
What is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerWhat is carrier-based authentication?
Carrier-based authentication verifies a user through their mobile operator instead of sending them a code. The simplest form checks that a request comes from the SIM tied to a phone number; stronger forms use cryptographic keys held in the SIM to sign the request. It proves something about the SIM, not about the person holding the phone.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerHow do banks stop OTP bots?
Remove the code the bot asks for: passkeys, in-app approval on a registered device and network-based checks leave the customer nothing to read out. Where a code remains, say in the message exactly what it approves and that the bank will never ask for it, and treat a new-device login during an inbound call as a fraud signal.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “How can banks defend against SIM swap fraud?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/
Markdown link
[How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |