# How can banks defend against SIM swap fraud?

> **Short answer:** Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.

- URL: https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

## Where SIM swaps cash out

A SIM swap is a means to an end. The losses happen in the flows that trust the phone number: password and account recovery, adding a new payee, raising a transfer limit, and changing the email or phone number on file. Those are the flows to harden first.

## Controls, strongest first

| Control | What it stops | Limits |
|---|---|---|
| Passkeys or device-bound credentials | The phone number stops being the key to the account | Recovery must not fall back to SMS |
| SIM-change signal from the carrier | Flags a number whose SIM changed recently, before you trust it | A risk signal, not an authenticator; coverage depends on the carrier |
| Cooling-off period after a new SIM or device | Buys time for the real customer to notice | Adds friction for legitimate changes |
| Alerts on a second channel | Tells the victim about changes the attacker made | Alerts can be missed or ignored |
Table: Cleartext’s summary of common controls.

Carrier network APIs standardized by the CAMARA project include a SIM Swap API that reports whether a number’s SIM changed recently.[^2]

## What the carrier side now covers

Since the FCC’s 2023 order, US carriers must authenticate customers before a SIM change or port-out and notify them of the request.[^1] That reduces the attack rate but doesn’t remove the exposure: NIST still classifies SMS codes as restricted because the channel itself can be redirected or phished.[^3]

## What this means for you

### Banks & credit unions

Start with account recovery and new-payee setup, where SIM-swap fraud tends to cash out. Those two flows justify the most friction and the strongest authenticators.

### Fintechs & payment firms

A SIM-change signal is cheap to add to a risk engine and catches the most common pattern: a new SIM, then a login from a new device, then a withdrawal.

### Developers & identity teams

Record when each user’s phone number was last verified and when the carrier last reported a SIM change. Both belong in the decision to accept an SMS code.

## Follow-up questions

**Don’t the FCC rules solve this?**

They make SIM swaps harder at US carriers, but a bank that treats an SMS code as proof of identity is still exposed to insiders, to carrier account takeover and to phishing of the code itself.


## Sources

[^1]: Protecting Consumers from SIM Swap and Port-Out Fraud. Federal Register, 2023-12-08. https://www.federalregister.gov/documents/2023/12/08/2023-26338/protecting-consumers-from-sim-swap-and-port-out-fraud
[^2]: CAMARA project. Linux Foundation. https://camaraproject.org/
[^3]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html

## Related questions

- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)
- [What is carrier-based authentication?](https://glide-cleartext.pages.dev/q/what-is-carrier-based-authentication/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [How do banks stop OTP bots?](https://glide-cleartext.pages.dev/q/how-do-banks-stop-otp-bots/)

## Cite

Cleartext. “How can banks defend against SIM swap fraud?” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/

## Changelog

- 2026-09-24: First published.