Question Regulation
What does the FCC SIM swap rule require?
The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes.
What does the FCC SIM swap rule require? The FCC’s 2023 order, FCC 23-95, requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or carrier, to notify customers of SIM-change and port-out requests, to offer account locks, and to train staff and keep records. It regulates carriers, not how banks or apps use SMS codes. Source: https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/ (Cleartext, verified 2026-09-15)
What the order requires #
The Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules.[1][2] Wireless carriers must:
- Authenticate securely before redirecting a customer’s number to a new device or another carrier.
- Handle failed attempts with procedures for responding to failed authentication.
- Notify customers promptly when a SIM change or port-out is requested.
- Offer account locks that customers can switch on to block number changes.
- Train staff and keep records of SIM-change and port-out requests.
When it took effect #
The rules were published in the Federal Register on December 8, 2023.[1] The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review.[3] Check the FCC’s current notice before citing a compliance date.
What it doesn’t cover #
The order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.
Evidence #
Numbers match the citations in the text. Primary sources are the standard, regulation, regulator statement or dataset itself.
What this means for you #
Banks & credit unions
The rule helps you indirectly: fewer successful SIM swaps at carriers. It creates no obligation for banks and no safe harbor for relying on SMS codes.
Fintechs & payment firms
Customer-facing carrier features the rule requires, such as account locks, are worth pointing users to in your security settings and help content.
Developers & identity teams
Carrier notifications don’t reach your app. If you depend on phone numbers, you still need your own SIM-change signal and alerts.
Follow-up questions #
- When did the FCC SIM-swap rules take effect?
- They were published in the Federal Register on December 8, 2023. The FCC later waived the original July 2024 compliance date while the information-collection requirements went through federal review, so check the FCC’s current notice before citing a date.
- Does the rule cover banks?
- No. It amends rules for wireless carriers only.
People also ask #
What is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerHow do I know if I’ve been SIM swapped?
The clearest sign is that your phone suddenly loses service where coverage is normally fine, and calls and texts stop arriving. Other signs are a carrier notice about a SIM change or number transfer you didn’t request, and password-reset or new-login alerts from accounts you didn’t touch. Contact your carrier from another phone immediately.
Full answerHas any US regulator banned SMS OTP?
No. As of this answer’s verification date, no US regulator has ordered banks or apps to stop using SMS one-time passcodes. NIST classifies them as restricted, the FCC’s 2023 rules make SIM swaps harder at carriers, and FFIEC guidance is risk-based. The bans so far are elsewhere, in markets such as the UAE and the Philippines.
Full answerHow can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerDecide and act #
Cite this answer #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “What does the FCC SIM swap rule require?” Last verified 2026-09-15 (rev. 2). https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/
Markdown link
[What does the FCC SIM swap rule require?](https://glide-cleartext.pages.dev/q/what-does-the-fcc-sim-swap-rule-require/) (Cleartext, verified 2026-09-15)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 2 | Clarified the compliance-date history. | |
| Rev. 1 | First published. |