Protecting Consumers from SIM Swap and Port-Out Fraud, Report and Order and FNPRM (FCC 23-95, WC Docket 21-341) (Part 1 of 3)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
Federal Communications Commission FCC 23-95
Before the
Federal Communications Commission
Washington, D.C. 20554
In the Matter of )
)
Protecting Consumers from SIM Swap and Port- ) WC Docket No. 21-341
Out Fraud )
REPORT AND ORDER AND FURTHER NOTICE OF PROPOSED RULEMAKING
Adopted: November 15, 2023 Released: November 16, 2023
Comment Date: (30 days after Federal Register Publication)
Reply Comment Date: (60 days after Federal Register Publication)
By the Commission: Chairwoman Rosenworcel and Commissioners Starks and Gomez issuing separate
statements.
TABLE OF CONTENTS
I. INTRODUCTION ...................................................................................................................................1
II. BACKGROUND .....................................................................................................................................4
III. DISCUSSION........................................................................................................................................18
A. Strengthening the Commission’s CPNI Rules to Protect Consumers ............................................24
1. Customer Authentication Requirements...................................................................................26
2. Response to Failed Authentication Attempts ...........................................................................31
3. Customer Notification of SIM Change Requests .....................................................................35
4. Account Locks for SIM Changes .............................................................................................41
5. Tracking Effectiveness of SIM Change Protection Measures..................................................46
6. Safeguards on Employee Access to CPNI................................................................................50
7. Telecommunications Carriers’ Duty to Protect CPNI..............................................................52
B. Strengthening the Commission’s Number Porting Rules to Protect Consumers............................53
1. Customer Authentication Requirements...................................................................................54
2. Customer Notification of Port-Out Requests ...........................................................................58
3. Account Locks for Port-Outs ...................................................................................................61
4. Wireless Port Validation Fields................................................................................................65
C. Additional Consumer Protection Measures ....................................................................................66
D. Implementation Timeframe ............................................................................................................83
E. Legal Authority ...............................................................................................................................84
IV. FURTHER NOTICE OF PROPOSED RULEMAKING......................................................................98
V. PROCEDURAL MATTERS...............................................................................................................109
VI. ORDERING CLAUSES......................................................................................................................120
APPENDIX A – FINAL RULES
APPENDIX B – FINAL REGULATORY FLEXIBILITY ANALYSIS
APPENDIX C – INITIAL REGULATORY FLEXIBILITY ANALYSIS
I. INTRODUCTION
1. Today, we adopt measures designed to address two fraudulent practices bad actors use to
take control of consumers’ cell phone accounts and wreak havoc on people’s financial and digital lives
without ever gaining physical control of a consumer’s phone. In the first type of scam, a bad actor
Federal Communications Commission FCC 23-95
convinces a victim’s wireless provider1 to transfer the victim’s mobile service and number from the
victim’s cell phone to a cell phone in the bad actor’s possession. This scam is also known as “SIM
swapping” because it involves an account being fraudulently transferred (or “swapped”) from a device
associated with one subscriber identity module (SIM) to a device associated with a different SIM. In the
second type of scam, the bad actor, posing as the victim, opens an account with a wireless provider other
than the victim’s current provider. The bad actor then arranges for the victim’s phone number to be
transferred (or “ported out”) to the account with the new wireless provider controlled by the bad actor.
2. In this Report and Order, we take aim at these scams, with the goal of foreclosing the
opportunistic ways in which bad actors take over customers’ cell phone accounts. In doing so, we
balance the important objectives of protecting consumers from harmful fraudulent conduct while at the
same time not impinging on customers’ ability to upgrade and replace their devices or choose their
preferred wireless provider. Specifically, we revise our Customer Proprietary Network Information
(CPNI) and Local Number Portability (LNP) rules to require wireless providers to adopt secure methods
of authenticating a customer before redirecting a customer’s phone number to a new device or provider.
We also require wireless providers to immediately notify customers whenever a SIM change or port-out
request is made on customers’ accounts, and take additional steps to protect customers from SIM swap
and port-out fraud. Our approach sets baseline requirements that establish a uniform framework across
the mobile wireless industry while giving wireless providers the flexibility to deliver the most advanced
and appropriate fraud protection measures available.
3. In the accompanying Further Notice of Proposed Rulemaking (Further Notice), we seek
comment on whether to harmonize the existing requirements governing customer access to CPNI2 with
the SIM change authentication and protection measures we adopt today. We also seek comment on what
steps the Commission can take to harmonize government efforts to address SIM swap and port-out fraud.
II. BACKGROUND
4. SIM Swap and Port-Out Fraud. Cell phone numbers are frequently used as a means of
authenticating the identity of users for various types of accounts, including accounts with wireless
providers, e-mail and social media providers, financial institutions, healthcare providers, and retail
websites.3 Because so many consumers have their cell phones with them at all times, authentication using
text messages and phone calls can be incredibly convenient, but these authentication methods also have
incentivized bad actors to find ways to intercept authentication texts and calls. Two techniques they use
to accomplish this involve misuse of mechanisms that enhance competition in the telecommunications
marketplace and ensure that customers can access telecommunications services using the devices and
providers of their choosing: SIM changes and number porting.
5. SIM changes allow customers to keep their wireless services and phone numbers when
they upgrade their cell phone or replace a cell phone that is lost or broken. A SIM facilitates the proper
routing of texts and calls to a customer’s cell phone so long as the SIM associated with the customer’s
phone number is assigned to that customer’s phone.4 While SIM changes historically occurred by
1 In this item, when we use the term “wireless provider” we intend to encompass providers of commercial mobile
radio service (CMRS) as defined in section 20.3 of the Commission’s rules. 47 CFR § 20.3 (defining commercial
mobile radio service as a mobile service that is “(1) provided for profit, i.e., with the intent of receiving
compensation or monetary gain; (2) An interconnected service; and (3) Available to the public, or to such classes of
eligible users as to be effectively available to a substantial portion of the public,” or the “functional equivalent of
such a mobile service”).
2 See id. § 64.2010.
3 For example, a consumer logging in to a bank account might be asked not only to provide the correct username and
password, but also to input a one-time passcode sent via text message to the consumer’s cell phone. Similarly, a
consumer who has forgotten the password for a social media account may be prompted to enter a one-time passcode
sent via text message to the consumer’s cell phone before being allowed to reset the password.
2
Federal Communications Commission FCC 23-95
removing a physical SIM card from an old phone and placing it in a new phone, now wireless providers
virtually reassign embedded, electronic SIMs in modern phones from an old phone to a new one.5 Bad
actors have successfully taken advantage of this legitimate practice by impersonating a customer of a
wireless provider and convincing the provider to reassign the virtual SIM card from the real customer’s
device to a device controlled by the bad actor, a practice known as “SIM swap fraud.”6 This allows the
bad actor to gain access to information associated with the customer’s account, including CPNI, and gives
the bad actor control of the customer’s phone number so that the bad actor receives the text messages and
phone calls intended for the victim.7
6. Number porting allows customers to retain their phone numbers when they switch from
one service provider to another, which enables customers to choose a service provider that best suits their
needs.8 To initiate a port between two wireless providers, a customer must provide certain identifying
information (i.e., telephone number, current account number, five-digit ZIP code, and any customer-
assigned passcode) to the new wireless provider. The new wireless provider then sends a request to port
the customer’s number with this identifying information through the numbering administrator to the
current wireless provider.9 Once the current wireless provider verifies this information (thus “validating
the port”), the two wireless providers coordinate through the numbering administrator to port the
customer’s number to the new wireless provider.10 As with SIM swap fraud, bad actors have successfully
taken advantage of this legitimate practice by impersonating a customer of a wireless provider and
convincing the provider to port the real customer’s telephone number to a new wireless provider and a
device that the bad actor controls.11 This “port-out fraud” likewise gives the bad actor control over the
customer’s phone number, thereby allowing the bad actor to receive text messages and phone calls
intended for the victim.
7. Once a fraudulent SIM swap or port-out request has been completed, the bad actor has
acquired the means to take control of many more of the victim’s accounts, which can result in substantial
harm to the customer. For instance, because the bad actor can now intercept text messages and phone
(Continued from previous page)
4 Each mobile device has its own unique SIM. A SIM can be a physical card or a digital, virtual card embedded into
the phone itself (eSIM card). FCC, eSIM Cards FAQ, https://www.fcc.gov/consumers/guides/esim-cards-faq. In
either form, the SIM “contains unique information that identifies it to a specific mobile network” and “allows
subscribers to use their mobile devices to receive calls, send SMS messages, or connect to mobile internet services.”
Russell Ware, What is a SIM Card?, Lifewire, https://www.lifewire.com/what-are-sim-cards-577532 (updated May
21, 2021).
5 See FCC, eSIM Cards FAQ, https://www.fcc.gov/consumers/guides/esim-cards-faq (last updated July 10, 2023).
6 CTIA, Protecting Your Wireless Account Against SIM Swap Fraud, https://www.ctia.org/protecting-against-sim-
swap-fraud (last visited Oct. 18, 2023).
7 See Protecting Consumers from SIM Swap and Port-Out Fraud, WC Docket No. 21-341, Notice of Proposed
Rulemaking, 36 FCC Rcd 14120, 14122, para. 5 (2021) (SIM Swap and Port-Out Fraud Notice).
8 See generally 47 U.S.C. § 153(37) (defining “number portability”); Local Number Portability Porting Interval and
Validation Requirements; Telephone Number Portability, WC Docket No. 07-244, CC Docket No. 95-116, Report
and Order and Further Notice of Proposed Rulemaking, 24 FCC Rcd 6084, 6087, para. 6 (2009) (Porting Interval
Order and FNPRM).
9 See Telephone Number Requirements for IP-Enabled Services Providers; Local Number Portability Porting
Interval and Validation Requirements; IP-Enabled Services; Telephone Number Portability; Numbering Resource
Optimization, WC Docket No. 07-243 et al., Report and Order, Declaratory Ruling, Order on Remand, and Notice of
Proposed Rulemaking, 22 FCC Rcd 19531, 19555, para. 44 (2007) (2007 VoIP LNP Order or 2007 LNP Four
Fields Declaratory Ruling).
10 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14122, para. 6.
11 FCC, Port-Out Fraud Targets Your Private Accounts, https://www.fcc.gov/port-out-fraud-targets-your-private-
accounts (last updated July 10, 2023).
3
Federal Communications Commission FCC 23-95
calls used to authenticate a customer’s financial, social media, and other accounts, the bad actor may have
the means to gain access to these accounts and then change login credentials, obtain sensitive information,
drain bank accounts, and sell or try to ransom social media accounts.12 Victims can also be harmed by the
loss of service on their devices—the phone going dark or only allowing 911 calls—which is typically the
first sign that SIM swap or port-out fraud has occurred.
8. The Commission and the Federal Trade Commission (FTC) have received hundreds of
customer complaints about SIM swap and port-out fraud.13 Some of the complaints describe wireless
provider customer service representatives and store employees who do not know how to address instances
of fraudulent SIM swaps or port-outs, resulting in customers spending many hours on the phone and at
retail stores trying to get resolution. Other customers complain that their wireless providers have refused
to provide them with documentation related to a fraudulent SIM change, making it difficult for them to
pursue claims with their financial institutions or law enforcement. Several customer complaints filed with
the Commission allege that a wireless provider’s store employees are involved in the fraud or that
providers completed SIM changes despite the customer having previously set a PIN or password on the
account.
9. A study published in 2020 by a group of Princeton University researchers found that
some wireless providers are using insecure mechanisms to authenticate the identities of individuals
making SIM change requests.14 The researchers opened ten pre-paid accounts each with five major
12 See, e.g., Department of Justice, U.S. Attorney’s Office, Western District of Texas, San Antonio Pair Plead Guilty
to SIM Swap Scheme (Oct. 12, 2022), https://www.justice.gov/usao-wdtx/pr/san-antonio-pair-plead-guilty-sim-
swap-scheme; Department of Justice, U.S. Attorney’s Office, Eastern District of Louisiana, California Resident
Pleads Guilty for His Role in Sim Swap Scam Targeting at Least 40 People, Including New Orleans Resident (May
18, 2022), https://www.justice.gov/usao-edla/pr/california-resident-pleads-guilty-his-role-sim-swap-scam-targeting-
least-40-people; Alina Machado, Woman Loses Life Savings in SIM Swap Scam (Aug. 26, 2022),
https://www.nbcmiami.com/responds/woman-loses-life-savings-in-sim-swap-scam/2845044/; U.S. Department of
Justice, Office of the U.S. Attorneys, District of Maryland, Two Men Facing Federal Indictment in Maryland for
Scheme to Steal Digital Currency and Social Media Accounts Through Phishing and “Sim-Swapping” (Oct. 28,
2020), https://www.justice.gov/usao-md/pr/two-men-facing-federal-indictment-maryland-scheme-steal-digital-
currency-and-social-media; U.S. Department of Justice, Office of the U.S. Attorneys, Eastern District of Michigan,
Nine Individuals Connected to a Hacking Group Charged With Online Identity Theft and Other Related Charges
(May 9, 2019), https://www.justice.gov/usao-edmi/pr/nine-individuals-connected-hacking-group-charged-online-
identity-theft-and-other (reporting the indictment of nine individuals alleged to have participated in thefts of victims’
identities to steal cryptocurrency via “SIM Hijacking”); Lorenzo Franceschi-Bicchierai, Hacker Who Stole $5
Million By SIM Swapping Gets 10 Years in Prison (Feb. 1, 2019), https://www.vice.com/en/article/gyaqnb/hacker-
joel-ortiz-sim-swapping-10-years-in-prison (reporting that a 20-year old student who stole more than $5 million in
cryptocurrency by hijacking the phone numbers of around 40 victims pleaded guilty and accepted a plea deal of 10
years in prison, believed to be the first person convicted of a crime for SIM swapping); Gertrude Chavez-Dreyfuss,
U.S. Investor Sues AT&T for $224 million over loss of cryptocurrency (Aug. 15, 2018),
https://www.reuters.com/article/us-cryptocurrency-at-t-lawsuit/u-s-investor-sues-att-for-224-million-over-loss-of-
cryptocurrency-idUSKBN1L01AA.
13 According to staff review of informal complaints submitted through the Commission’s Consumer Complaint
Center, https://consumercomplaints.fcc.gov/hc/en-us, the Commission received approximately 300 complaints in
2020 concerning SIM swap or port-out-fraud, 400 in 2021, and 500 in 2022. The FTC identified 966 consumer
reports of “Phone Carrier Switching” in 2020, 157 in 2021, and 188 in 2022. See Federal Trade Commission,
Consumer Sentinel Network Data Book 2022 (Feb. 2023), at Appx. B, p. 88,
https://www.ftc.gov/system/files/ftc_gov/pdf/CSN-Data-Book-2022.pdf. The FTC published a consumer alert
regarding SIM swap scams in 2019. Alvaro Puig, FTC, SIM Swap Scams: How to Protect Yourself (Oct. 23, 2019),
https://consumer.ftc.gov/consumer-alerts/2019/10/sim-swap-scams-how-protect-yourself.
14 See Kevin Lee, Ben Kaiser, Jonathan Mayer, Arvind Narayanan, Center for Information Technology Policy,
Princeton University, An Empirical Study of Wireless Carrier Authentication for SIM Swaps, August 2020, at Appx.,
available at https://www.usenix.org/system/files/soups2020-lee.pdf.
4
Federal Communications Commission FCC 23-95
wireless providers— AT&T Mobility, LLC (AT&T), T-Mobile US, Inc. (T-Mobile), Tracfone, US
Mobile, and Verizon Wireless (Verizon)—and called to request a SIM change on each account. The
researchers found that all five wireless providers “used insecure authentication challenges that could
easily be subverted by attackers.”15 Specifically, the research team identified six types of information
used by the wireless providers to authenticate their customers that were or could be vulnerable to abuse.16
For example, authentication based on recent payment information was exploitable because some wireless
providers do not have systems that prevent a bad actor from purchasing a refill card and submitting it on a
victim’s account, then requesting a SIM change using the known refill as authentication.17 Call history
information was exploitable because a bad actor could bait a victim into placing calls to specific phone
numbers and provide those phone numbers as authentication, and in some cases it appeared that customer
service representatives had the discretion to allow authentication with incoming call information.18 The
researchers also found that certain authentication information, such as device information, was vulnerable
because it is readily available to bad actors.19 Additionally, they noted that recent research has shown that
preset answers to “security” questions are an insecure means of authentication, because answers that are
memorable are also frequently guessable by an attacker.20 The research team also found that “in general,
callers only needed to successfully respond to one challenge in order to authenticate, even if they had
failed numerous prior challenges in the call.”21 And in some instances, wireless providers disclosed
personal customer information without any authentication at all, including information that could be used
to authenticate a customer.22
10. The researchers also examined the potential downstream consequences of fraudulent SIM
swaps. They “evaluated the authentication policies of over 140 online services that offer phone-based
authentication to determine how they stand up to an attacker who has compromised a user’s phone
number via a SIM swap.”23 The researchers found that 17 websites across different industries have
implemented authentication policies with logic flaws that would allow an attacker to fully compromise an
account with just a SIM swap.24
11. Privacy of Telecommunications Customer Information. Section 222 of the
Communications Act of 1934, as amended (the Act) obligates telecommunications carriers to protect the
privacy and security of information about their customers to which they have access as a result of their
unique position as network operators.25 Section 222(a) requires carriers to protect the confidentiality of
15 Lee et al. at 1.
16 These types of information were: (1) Personal Information: including street address, e-mail address, date of birth;
(2) Account Information: last 4 digits of payment card number, activation date, last payment date and amount; (3)
Device Information: IMEI (device serial number), ICCID (SIM serial number); (4) Usage Information: recent phone
numbers called; (5) Knowledge: PIN or password, answers to security questions; and (6) Possession: one-time
passcode sent via text message or e-mail. Id. at 2.
17 Id. at 2-3.
18 Id.
19 Id. at 3.
20 Id.
21 Id.
22 Id.
23 Id. at 1.
24 Id.
25 47 U.S.C. § 222. See also Implementation of the Telecommunications Act of 1996: Telecommunications
Carriers’ Use of Customer Proprietary Network Information and Other Customer Information, et al., CC Docket
Nos. 96-115, et al., Order on Reconsideration and Petitions for Forbearance, 14 FCC Rcd 14409, 14419-20, paras.
12-14 (1999) (CPNI Reconsideration Order) (denying petitions for reconsideration and forbearance seeking
(continued….)
5
Federal Communications Commission FCC 23-95
proprietary information of and relating to their customers, among others.26 Section 222(c)(1) provides
that a carrier may only use, disclose, or permit access to individually identifiable CPNI that it has
received or obtained by virtue of its provision of a telecommunications service: (1) as required by law;
(2) with the customer’s approval; or (3) in its provision of the telecommunications service from which
such information is derived or its provision of services necessary to, or used in, the provision of such
telecommunications service.27 CPNI is defined as “(A) information that relates to the quantity, technical
configuration, type, destination, location, and amount of use of a telecommunications service subscribed
to by any customer of a telecommunications carrier, and that is made available to the carrier by the
customer solely by virtue of the carrier-customer relationship; and (B) information contained in the bills
pertaining to telephone exchange service or telephone toll service received by a customer of a carrier;
except that such term does not include subscriber list information.”28 The Commission has not provided
an exhaustive list of what constitutes CPNI, but it has explained that CPNI includes (but is not limited to):
the phone numbers called by a consumer; the frequency, duration, and timing of such calls; and any
services purchased by the consumer, such as call waiting.29
12. The Commission first promulgated rules implementing the express statutory obligations
of section 222 in 1998.30 In addition to imposing restrictions on the use and disclosure of CPNI, the
Commission adopted a set of rules designed to ensure that telecommunications carriers establish effective
safeguards to protect against unauthorized use or disclosure of CPNI.31 Among other things, the
Commission required telecommunications carriers to train their personnel as to when they are and are not
authorized to use CPNI and required carriers to have an express disciplinary process in place for when
personnel improperly use CPNI.32 In addition, the Commission required each carrier to annually certify
its compliance with the CPNI requirements and to make this certification publicly available.33
(Continued from previous page)
different treatment for wireless providers under the Commission’s CPNI rules, concluding that “there is nothing in
the statute or its legislative history to indicate that Congress intended the CPNI requirements in section 222 should
not apply to wireless carriers”).
26 47 U.S.C. § 222(a).
27 47 U.S.C. § 222(c)(1). Subsequent to the adoption of section 222(c)(1), Congress added section 222(f). Section
222(f) provides that for purposes of section 222(c)(1), without the “express prior authorization” of the customer, a
customer shall not be considered to have approved the use or disclosure of or access to (1) call location
information concerning the user of a commercial mobile service or (2) automatic crash notification information of
any person other than for use in the operation of an automatic crash notification system. Id. § 222(f). Section
222(d) delineates certain exceptions to the general principle of confidentiality, including permitting a carrier to
use, disclose, or permit access to CPNI obtained from its customers to protect telecommunications services users
“from fraudulent, abusive, or unlawful use of, or subscription to” telecommunications services.
28 47 U.S.C. § 222(h)(1).
29 Implementation of the Telecommunications Act of 1996: Telecommunications Carriers’ Use of Customer
Proprietary Network Information and Other Customer Information; IP-Enabled Services, CC Docket No. 96-115,
WC Docket No. 04-36, 22 FCC Rcd 6927, 6931, para. 5 (2007) (2007 CPNI Order).
30 See Implementation of the Telecommunications Act of 1996:Telecommunications Carriers’ Use of Customer
Proprietary Network Information and Other Customer Information, et al., CC Docket Nos. 96-115, et al., Second
Report and Order and Further Notice of Proposed Rulemaking, 13 FCC Rcd 8061 (1998) (CPNI Order).
31 See id. at 8195, paras. 193-202; 47 CFR §§ 64.2001-2009 (1998).
32 See 47 CFR § 64.2009(b) (1998); see also CPNI Order, 13 FCC Rcd at 8198, para. 198.
33 47 CFR § 64.2009(e) (1998); see also CPNI Order, 13 FCC Rcd at 8199, para. 201; CPNI Reconsideration Order,
14 FCC Rcd at 14468-69, n.331 (clarifying that carriers must “make these certifications available for public
inspection, copying and/or printing at any time during regular business hours at a centrally located business office of
the carrier”).
6
Federal Communications Commission FCC 23-95
13. In 2007, the Commission amended its CPNI rules to address “pretexting,” a scheme in
which a bad actor pretends to be a particular customer or other authorized person to obtain access to that
customer’s call detail or other private communications records.34 The Commission concluded that
“pretexters have been successful at gaining unauthorized access to CPNI”35 and that “carriers’ record on
protecting CPNI demonstrate[d] that the Commission must take additional steps to protect customers
from carriers that have failed to adequately protect CPNI.”36 The new amendments to the rules restricted
the release of call detail information37 based on customer-initiated telephone contact, imposed password
requirements for customer account access, and required carriers to appropriately authenticate both new
and existing customers seeking access to CPNI online.38 The Commission also required carriers to take
reasonable measures to both discover and protect against attempts to gain unauthorized access to CPNI39
and to notify customers immediately of certain account changes, including whenever a password,
customer response to a carrier-designed back-up means of authentication, online account, or address of
record is created or changed.40 To protect customers from malicious account changes, these carrier
notifications cannot reveal the changed account information, nor can they be sent to any updated account
information associated with the change.41 In addition, the Commission modified its CPNI rules to require
carriers to notify law enforcement and customers of security breaches involving CPNI.42 The
Commission has made clear that carriers are free to implement more rigorous security measures to meet
their section 222 obligations to protect the privacy of CPNI and that carriers have a fundamental duty to
remain vigilant in their protection of CPNI.43 Finally, the Commission also extended the application of its
CPNI rules to providers of interconnected Voice over Internet Protocol (VoIP) service, finding that it is
“reasonable for American consumers to expect that their telephone calls are private irrespective of
whether the call is made using the services of a wireline carrier, a wireless carrier, or an interconnected
VoIP provider, given that these services, from the perspective of a customer making an ordinary
telephone call, are virtually indistinguishable.”44 Additionally, in 2007 Congress adopted criminal
34 2007 CPNI Order, 22 FCC Rcd at 6928, para. 1 & n.1.
35 Id. at 6934, para. 12.
36 Id. at 6933.
37 The Commission defined “call detail” information to include “any information that pertains to the transmission of
specific telephone calls including, for outbound calls, the number called, and the time, location, or duration of any
call and, for inbound calls, the number from which the call was placed, and the time, location, or duration of any
call.” 2007 CPNI Order, 22 FCC Rcd at 6936, n.45.
38 See id. at 6936-41, 6945-46, paras. 13-22, 33-36; 47 CFR § 64.2010(b)-(e).
39 See 2007 CPNI Order, 22 FCC Rcd at 6945-46, paras. 33-36; 47 CFR § 64.2010(a).
40 See 2007 CPNI Order, 22 FCC Rcd at 6942, para. 24; 47 CFR § 64.2010(f).
41 47 CFR § 64.2010(f).
42 2007 CPNI Order, 22 FCC Rcd at 6943-45, paras. 26-32; 47 CFR § 64.2011.
43 See 2007 CPNI Order, 22 FCC Rcd at 6945-46, paras. 33-35. In addition, the Commission required affirmative
customer consent (“opt-in consent”) before a carrier could disclose a customer’s CPNI to a carrier’s joint venture
partners or independent contractors for the purposes of marketing communications-related services to that customer.
See id. at 6947-53, paras. 37-50.
44 Id. at 6956, para. 56; see also id. at 6954-57, paras. 54-59.
We note that, in 2008, Congress ratified the
Commission’s decision to apply section 222’s requirements to interconnected VoIP by adding language to section
222 that expressly covers “IP-enabled voice service,” defined by reference to the Commission’s definition of
“interconnected VoIP service.” See New and Emerging Technologies 911 Improvement Act of 2008, Pub. L. No.
110-283 (2008); 47 U.S.C. § 222(d)(4), (f)(1), (g) (applying provisions of section 222 to “IP-enabled voice
service”); id. § 615b(8) (defining “IP-enabled voice service” as having “the meaning given the term ‘interconnected
VoIP service’ by section 9.3 of the Federal Communications Commission’s regulations (47 CFR 9.3)”).
7
Federal Communications Commission FCC 23-95
prohibitions both on obtaining CPNI from a telecommunications carrier and on the sale, transfer,
purchase, or receipt of fraudulently obtained CPNI.45
14. Local Number Portability. Section 251(b)(2) of the Act requires local exchange carriers
(LECs) to “provide, to the extent technically feasible, number portability in accordance with requirements
prescribed by the Commission.”46 The Act and the Commission’s rules define number portability as “the
ability of users of telecommunications services to retain, at the same location, existing
telecommunications numbers without impairment of quality, reliability, or convenience when switching
from one telecommunications carrier to another.”47 Section 251(e)(1) of the Act gives the Commission
exclusive jurisdiction over the North American Numbering Plan and related telephone numbering matters
in the United States.48 Although the Act excludes Commercial Mobile Radio Service (CMRS) providers
from the statutory definition of “local exchange carrier,”49 the Commission extended the LNP obligations
to CMRS providers pursuant to its independent authority in sections 1, 2, 4(i) and 332 of the Act.50
Wireless providers have been required to provide wireless number portability since 2003.51
15. In 2003, the Commission clarified that for wireless ports, absent an agreement setting
additional terms, wireless providers need only share basic contact and technical information with each
other sufficient to validate and execute the port.52 In 2007, the Commission clarified that a porting-out
provider may not require more than a “minimal but reasonable” amount of information from the porting-
in provider to validate a port request and accomplish the port.53 The Commission concluded that for
45 Telephone Records and Privacy Protection Act of 2006, Pub. L. 109-476, 120 Stat. 3568 (2007) (codified at 18
U.S.C. § 1039).
46 47 U.S.C. § 251(b)(2).
47 47 U.S.C. § 153(37); 47 CFR § 52.21(m). The Commission has interpreted this language to mean that consumers
must be able to change providers while keeping their telephone number as easily as they may change providers
without taking their telephone number with them. See Telephone Number Portability; Carrier Requests for
Clarification of Wireless-Wireless Porting Issues, CC Docket No. 95-116, Memorandum Opinion and Order, 18
FCC Rcd 20971, 20975, para. 11 (2003) (Wireless Number Portability Order), aff’d, Central Tex. Tel. Coop., Inc. v.
FCC, 402 F.3d 205 (D.C. Cir. 2005).
48 47 U.S.C. § 251(e)(1).
49 47 U.S.C. § 153(32).
50 See Telephone Number Portability, CC Docket No. 95-116, First Report and Order and Further Notice of
Proposed Rulemaking, 11 FCC Rcd 8352, 8431, para. 153 (1996) (First Number Portability Order); Telephone
Number Portability, CC Docket No. 95-116, First Memorandum Opinion and Order on Reconsideration, 12 FCC
Rcd 7236, 7315-17, paras. 140-42 (1997) (First Number Portability Order on Reconsideration) (affirming the
Commission’s decision to impose number portability obligations on CMRS providers).
51 See 47 CFR § 52.31(a); see also First Number Portability Order, 11 FCC Rcd at 8439-41, paras. 164-68
(discussing implementation schedule for CMRS providers); see also Cellular Telecommunications Industry
Association’s Petition for Forbearance from Commercial Mobile Radio Services Number Portability Obligations;
Telephone Number Portability, WT Docket No. 98-229, CC Docket No. 95-116, Memorandum Opinion and Order,
14 FCC Rcd 3092, 3111-12, paras. 37-39 (1999) (extending the implementation deadline for CMRS providers in the
top 100 Metropolitan Statistical Areas where another carrier has made a specific request for the provision of LNP
until November 24, 2002); Verizon Wireless’s Petition for Partial Forbearance from Commercial Mobile Radio
Services Number Portability Obligations; Telephone Number Portability, WT Docket No. 01-184, CC Docket No.
95-116, Memorandum Opinion and Order, 17 FCC Rcd 14972, 14981-86, paras. 23-31 (2002) (extending the
implementation deadline for CMRS providers in the top 100 MSAs until November 24, 2003).
52 See Wireless Number Portability Order, 18 FCC Rcd at 20978, para. 24.
53 See 2007 LNP Four Fields Declaratory Ruling, 22 FCC Rcd at 19553, para. 42.
8
Federal Communications Commission FCC 23-95
simple54 wireline-to-wireline, wireless-to-wireless, and intermodal ports, LNP validation should be based
on no more than four fields: (1) 10-digit telephone number; (2) customer account number; (3) five-digit
ZIP code; and (4) passcode (if applicable).55 This information is provided by the customer to the new
carrier, who then provides it to the old carrier in order to validate the request.56 In 2010, the Commission
expanded and standardized the information exchanged between carriers when they execute a simple
wireline or intermodal port, which it concluded was necessary to ensure carriers could accomplish ports
within a one-business day porting interval the Commission established in 2009.57 The Commission
mandated that telecommunications carriers use 14 “Required Standard Data Fields”—and may require
only those fields to accomplish such ports.58 The Commission maintained the three customer-provided
information fields from the 2007 LNP Four Fields Declaratory Ruling—ported telephone number,
customer account number, and customer ZIP code.59 The rules also permit customers to request that a
user-created passcode be put on their account, which the customer must then provide before a port can be
accomplished.60 The Commission at the time found that the exchange of these fields struck the
appropriate balance between streamlining the porting process and ensuring accurate ports, and also
54 A simple port is a port that (1) does not involve unbundled network elements; (2) involves an account only for a
single line; (3) does not include complex switch translations (e.g., Centrex, ISDN, AIN services, remote call
forwarding, or multiple services on the loop); and (4) does not include a reseller. See, e.g., id. at 19556, n.153.
55 See id. at 19557, para. 48; see also id. at 19558, para. 49 (“We are persuaded that the approach we adopt here
reasonably balances consumer concerns about slamming with competitors’ interest in ensuring that LNP may not be
used in an anticompetitive manner to inhibit consumer choice.”).
56 See, e.g., FCC, Porting: Keeping Your Phone Number When You Change Providers,
https://www.fcc.gov/consumers/guides/porting-keeping-your-phone-number-when-you-change-providers.
57 See Local Number Portability Porting Interval and Validation Requirements; Telephone Number Portability,
Report and Order, 25 FCC Rcd 6953, 6959-62, paras. 9-17 (2010) (LNP Standard Fields Order); id. at 6954, para. 1
(“This Order completes the task of facilitating prompt transfers by standardizing the data to be exchanged when
transferring a customer’s telephone number between two wireline providers; a wireline and wireless provider; or an
interconnected Voice over Internet Protocol (VoIP) provider and any other service provider.”); 47 CFR § 52.36(a)
(“A telecommunications carrier may require only the data described in paragraphs (b) and (c) of this section to
accomplish a simple port order request from an end user customer’s new telecommunications carrier.”); id. §
52.36(d) (“For purposes of this section, the term ‘telecommunications carrier’ includes an interconnected VolP
provider as that term is defined in § 52.21(h).”).
58 The Commission required that service providers use the following 14 fields to accomplish a wireline or
intermodal simple port: (1) “Ported Telephone Number” – the customer’s telephone number; (2) “Account
Number” – the customer’s account number with the current service provider; (3) “Zip Code” – the zip code for the
customer’s address associated with the account; (4) “Company Code” – the operating company number, or OCN, of
the new service provider; (5) “New Network Service Provider” – the name of the new service provider; (6) “Desired
Due Date” – the date by which the customer wants the port completed; (7) “Purchase Order Number” – the
customer’s unique purchase order or requisition number that authorizes issuance of the port request; (8) “Version” –
the version number of the order submitted by the new service provider; (9) “Number Portability Direction Indicator”
– information to let the new service provider direct the correct administration of E-911 records; (10) “Customer
Carrier Name Abbreviation” – the three-letter code for the name of the new service provider; (11) “Requisition Type
and Status” – the type of order to be processed, such as number portability, loop with number portability,
retail/bundled, resale, directory listings, etc.; (12) “Activity” – the activity involved in the service request, such as
porting, new account installation, disconnection, suspension, restoration, etc.; (13) “Telephone Number of Initiator”
– the telephone number for the new service provider initiating the port request; and (14) “Agency Authority Status”
– which indicates that the new service provider initiating the port request has an authorization to initiate a port on
file. 47 CFR § 52.36(b); see also LNP Standard Fields Order, 25 FCC Rcd at 6959-62, paras. 9-17. We note that
when requesting a port, some of the information described above is supplied by the customer to the new or gaining
carrier and some of the information is provided by the new carrier to the current carrier.
59 See 47 CFR § 52.36(b)(1)-(3).
60 See id. § 52.36(c).
9
Federal Communications Commission FCC 23-95
reasonably balanced customer concerns about unauthorized ports with competitors’ interest in ensuring
that porting obligations may not be used in an anticompetitive manner to inhibit customer choice.61
16. The members of the non-governmental, multi-stakeholder Number Portability Industry
Forum (NPIF) have created “Best Practices” for porting between and within telephony carriers.62 These
Best Practices are voluntary and not mandated by the Commission, but reflect the consensus of the NPIF
or its predecessor organization regarding the preferred processes for porting.63 Best Practice 73
(Unauthorized Port Flow) specifically addresses unauthorized ports, including fraudulent ports.64 Among
other things, it encourages carriers to review “incident and/or police report details if provided” and places
priority on resolving unauthorized ports that have a heightened severity of impact.65
17. Notice of Proposed Rulemaking. In September 2021, the Commission adopted the SIM
Swap and Port-Out Fraud Notice, in which it proposed to amend the Commission’s CPNI and LNP rules
to require wireless providers to adopt secure methods of authenticating a customer before redirecting a
customer’s phone number to a new device or provider.66 The SIM Swap and Port-Out Fraud Notice also
proposed to require wireless providers to immediately notify customers whenever a SIM change or port
request is made on customers’ accounts and sought comment on other ways to protect customers from
SIM swap and port-out fraud.67
III. DISCUSSION
18. Today we revise our CPNI and LNP rules to provide greater protection to customers from
SIM swap and port-out fraud. The cornerstone of our action is a requirement that wireless providers use
secure methods of authenticating customers prior to performing SIM changes and number ports. Other
rules we adopt reinforce that requirement, including that wireless providers adopt processes for
responding to failed authentication attempts, institute employee training for handling SIM swap and port-
out fraud, and establish safeguards to prevent employees who interact with customers from accessing
CPNI until after customers have been authenticated. We also adopt rules that will enable customers to act
to prevent and address fraudulent SIM changes and number ports, including requiring that wireless
providers notify customers regarding SIM change and port-out requests, offer customers the option to
lock their accounts to block processing of SIM changes and number ports, and give advanced notice of
available account protection mechanisms. We further establish requirements to minimize the harms of
SIM swap and port-out fraud when it occurs, including requiring wireless providers to maintain a clear
61 See generally LNP Standard Fields Order, 25 FCC Rcd at 6956-62, paras. 6-10.
62 NPAC, Number Portability Best Practices, https://workinggroup.numberportability.com/number-portability-best-
practices (last visited Oct. 18, 2023).
63 See id.
64 Best Practice 73 addresses three types of unauthorized ports: disputed ports (usually a result of two or more
parties each claiming to be the authorized end user, including business partner disputes, personal relationship
disputes, dissolution of franchises); inadvertent ports (which occur as a result of an error, including incorrect number
provided by End User and typographical errors in local service requests); and fraudulent ports (which occur as a
result of an intentional act of fraud, theft, and/or misrepresentation). See Best Practice 73, NPAC, Number
Portability Best Practices, at 1-2, https://workinggroup.numberportability.com/number-portability-best-practices
(last visited Oct. 18, 2023).
65 These include ports involving an “FCC/PUC/Attorney General complaint; court order; military institution;
medical facility; business lines (i.e. national organization, main published line); emergency services; medical
support services; or otherwise documented as properly reported to law enforcement.” See Best Practice 73, NPAC,
Number Portability Best Practices, at 4, https://workinggroup.numberportability.com/number-portability-best-
practices (last visited Oct. 18, 2023).
66 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14121, para. 3.
67 Id.
10
Federal Communications Commission FCC 23-95
process for customers to report fraud, promptly investigate and remediate fraud, and promptly provide
customers with documentation of fraud involving their accounts. Finally, to ensure wireless providers
track the effectiveness of authentication measures used for SIM change requests, we require that they
keep records of SIM change requests and the authentication measures they use.
19. In adopting these rules, we balance the need to protect customers from the harms of SIM
swap and port-out fraud with the goal of preserving the relative ease with which customers can obtain
legitimate SIM changes and number ports. The record reflects that the vast majority of SIM change and
port-out requests are legitimate.68 It also shows that the efficient and effective processing of SIM changes
and port-out requests promotes customer choice and competition69 and prevents interruptions in access to
wireless services that are vital to customers’ everyday lives.70 Service interruptions can be particularly
problematic when they hamper the ability of customers to access emergency services.71 We agree with
the Competitive Carriers Association (CCA) that “enhanced requirements for SIM swap and port-out
requests can implicate the customer experience and can intentionally or unintentionally serve as
impediments to legitimate requests to change devices or change providers.”72 We are wary of setting
rigid requirements that would impose significant burdens on customers without substantially protecting
against SIM swap and port-out fraud.73 We also recognize that prescribing particular security methods
can place greater burdens on some customers because of their technical and financial means, digital
literacy, accessibility needs, and other particularized circumstances.74 We anticipate that the approach we
68 See, e.g., T-Mobile Comments at 2 (asserting that “the vast majority of subscriber SIM swap and port-out requests
are legitimate”); CTIA Reply at 1 (“[T]he overwhelming majority—well over 99%—of SIM swap and port-out
requests are legitimate.”); AT&T Comments at 7-8 (“By AT&T’s calculation, more than 99 percent of the total SIM
changes and port-outs it processes are legitimate.”).
69 See, e.g., CTIA Reply at 3 (“Given the importance of [SIM changes and number porting] for enabling provision of
service, competition, and consumer choice, it is critical for customers seeking to replace or upgrade their device or
to change their provider to be able to do so both securely and without undue friction in the customer experience.”)
(emphasis in original); CTIA Comments at 10 (“It is critical that the LNP rules continue to protect against anti-
competitive behaviors, and that any updates to address port-out fraud should be clearly tied to consumer fraud
protection.”); T-Mobile Comments at 2-3 (“[T]he Commission should ensure that any rule changes do not limit
consumer choice between wireless providers or stifle competition by introducing undue delay or complexity to
fulfilling port-out and SIM swap requests.”); AT&T Comments at 1-2 (“SIM swaps and port-outs are, in short,
integral features of the competitive wireless marketplace.”); Verizon Comments at 1 (explaining that SIM changes
and number porting “benefits competition and customer choice by enabling consumers to efficiently switch
providers and take advantage of new devices and service plans”).
70 See, e.g., T-Mobile Comments at 7 (“Wireless services are vital to most Americans and, therefore they must have
the ability to make account changes.”); id. at 6-7 (“T-Mobile’s wireless services are a lifeline for its over 100 million
postpaid and prepaid subscribers across America, who rely on wireless services for connections to family, work,
public safety, and school as well as key apps and services.”); AT&T Comments at 17-18 (noting that cell phones
“have become an essential part of everyday life”).
71 See, e.g., CTIA Comments at 9 (asserting that “[s]ervice disruptions due to strict authentication requirements
could be particularly impactful for customers who are in emergency situations”).
72 CCA Comments at 7; see also NCTA Comments at 7 (arguing that certain prescriptive requirements “would
create unnecessary obstacles for consumers that desire to switch providers”).
73 See, e.g., AT&T Comments at 2-3 (“Across-the-board prescriptive rules would increase consumer frustration in
nearly all SIM- or port-related transactions without a concomitant reduction in the risk.”); id. at 12-13 (explaining
that specific mandates could “restrict[] consumer choice and impos[e] delays and other burdens upon the
overwhelming majority (more than 99 percent) of transactions that are perfectly legitimate”); CTIA Reply at 5 (“An
approach that is unnecessarily rigid will adversely affect legitimate customers’ ability to swap SIM cards and port
numbers, which are both critical to ensuring provision of service, customer choice, and competition.”).
74 See, e.g., CCA Comments at 7 (noting that when security measures cause frustration, “customers, especially those
who are older or less familiar with technology, may be deterred from selecting a provider who may offer a better
(continued….)
11
Federal Communications Commission FCC 23-95
take today will provide meaningful protection to customers while preserving the competition and
customer choice that SIM changes and number porting are meant to facilitate and avoiding undue burdens
that hinder access to wireless services.
20. To that end, we set baseline rules, rather than prescriptive requirements, that establish a
uniform framework across the mobile wireless industry for the types of policies and procedures providers
must employ to combat SIM swap and port-out fraud. The record indicates that several wireless
providers already rely, at least partly, on some of these policies and procedures.75 We are concerned,
however, that a lack of consistency in how wireless providers apply these measures and a lack of
uniformity in the use of these measures industry-wide leaves some customers vulnerable to SIM swap and
port-out fraud. The rules we adopt ensure that all wireless providers are taking consistent and
comprehensive steps to address this fraud. For wireless providers that already employ the measures we
require, in many cases our rules simply raise the bar by requiring them to adapt, refine, or consistently
apply those existing practices. For wireless providers that do not, our new rules require them to
implement new practices to meet the baseline standards. We anticipate that our approach will ensure that
customers receive effective protection from SIM swap and port-out fraud regardless of the wireless
telecommunications services they purchase or the wireless provider from whom they purchase them.
21. In setting baseline requirements, rather than prescriptive rules, our approach also gives
wireless providers the flexibility to establish the specific fraud protection measures they use so that they
can deliver the most advanced protections available. The record provides substantial evidence that to best
combat SIM swap and port-out fraud, wireless providers need flexibility.76 In particular, we are
persuaded that wireless providers need such flexibility so that they can adapt their security methods to
keep pace with the evolving threat landscape. Verizon notes that “fraudsters are sophisticated and
constantly look to circumvent any protections, no matter how robust.”77 We also recognize that “[r]apid
technological changes introduce new vulnerabilities that existing rules may be unequipped to address.”78
(Continued from previous page)
service” and therefore that the Commission “should be attentive to ensuring that heightened authentication
procedures are customer friendly”); T-Mobile Comments at 6-7 (asserting that the Commission should strive for
SIM swap and port-out fraud rules that “promote diversity, inclusion, and accessibility of wireless services”);
Verizon Comments at 6 (“As the NPRM notes, in-store customers in need of a SIM change may not be tech savvy,
so flexibility to allow some form of physical documentation will be needed.”).
75 See, e.g., CTIA Comments at 3-4 (highlighting “the variety of tactics used to combat SIM swapping and port-out
fraud”); CTIA Reply at 5-9 (further detailing the tactics providers use); NCTA Comments at 4-5 (explaining that
wireless providers already use many of the practices proposed in the SIM Swap and Port-Out Fraud Notice to
prevent SIM swap and port-out fraud today); CCA Comments at 6 (noting that many CCA members already have
implemented the measures proposed in the SIM Swap and Port-Out Fraud Notice to combat SIM swap and port-out
fraud); AT&T Comments at 13 (“Carriers are already authenticating customers using one or more of the methods
identified in the Commission’s existing and/or proposed rules.”); T-Mobile Comments at 1 (“T-Mobile has robust
protections in place to help prevent fraudulent SIM swapping and port-outs from occurring.”).
76 See, e.g., AT&T Comments at 11 (“Effective mitigation requires an agile approach to managing these risks that
can only be achieved within a flexible framework.”); NCTA Comments at 2 (“[I]f the Commission moves forward
with new rules to address fraud, the best approach would be to establish a flexible standard requiring heightened
authentication measures for SIM swap requests. The Commission should adopt a similarly flexible requirement to
take reasonable measures to prevent port-out fraud.”); CTIA Comments at 16 (“[T]echnical, rigid, and narrow
requirements will not move the needle for consumer protection in the same way that a smart, flexible, future-proof,
and risk-based framework will.”); CCA Comments at 6 (“The Commission should resist, however, from requiring a
defined set of measures that all carriers should uniformly adopt.”); Verizon Comments at 5 (“[P]roviders must have
flexibility both to develop and implement new methods beyond those enumerated in the draft rule.”).
77 Verizon Comments at 1; see also AT&T Comments at 11 (“Bad actors perpetually look for creative ways to gain
access to consumers’ financial or social media accounts.”); CCA Comments at 4-5 (“[S]ophisticated hackers and
other bad actors are resourceful and often find ways to skirt safeguards to sensitive information.”).
78 CCA Comments at 4-5.
12
Federal Communications Commission FCC 23-95
We are therefore concerned by record evidence that a static set of prescriptive requirements may
incentivize some wireless providers to rely exclusively on those security methods and discourage them
from innovating and adopting new and improved practices to address evolving fraud techniques used by
bad actors.79 We also share concerns that setting specific requirements could either provide a roadmap for
bad actors seeking to commit fraud80 or lock in measures that quickly prove to be ineffective or obsolete.81
The aim of our action today is to better protect telecommunications customers from fraudulent schemes;
in doing so, it is important that our rules, while functioning as baseline safeguards, do not serve as
obstacles to adoption of better security practices. Indeed, the record asserts that establishing rules that
provide flexibility will incentivize wireless providers to develop and adopt new and improved methods to
protect against SIM swap and port-out fraud82 and enable them to quickly adapt their security measures to
respond to evolving techniques and technologies used by bad actors.83 Accordingly, we agree with
79 See, e.g., AT&T Comments at 14 (“[L]ocking in a particular list of authentication methods would play into bad
actors’ hands by discouraging carriers from adopting new methods not expressly blessed by the Commission’s rule,
while inhibiting the ability of carriers and other stakeholders to innovate, as necessary and appropriate, to address
evolving threats.”); Better Identity Coalition at 6 (asserting that if the Commission enshrined guidelines or standards
into regulation, “it might inadvertently preclude carriers from deploying new innovations that emerge after [those
guidelines and standards were developed] that might address new threats or more efficiently identify or authenticate
consumers.”); FIDO Alliance Comments at 3 (arguing that reliance on the four specified authentication methods
may disincentive providers from adopting stronger authentication measures); CCA Comments at 4-5 (cautioning
against adopting rules that “might inhibit a provider’s ability to respond to new threats as they emerge” and noting
that if “a future technology, proves to be more effective or secure than today’s technologies, the Commission should
ensure that its rules do not end up serving as an obstacle to adoption of better practices”); CTIA Reply at 14 (“The
Commission should thus ensure that its regulatory approach does not impede providers’ ability to protect their
customers.”).
80 See, e.g., AT&T Comments at 12-13 (“[S]pecific mandates in this context could provide a roadmap for bad actors
who would quickly tailor their tactics to circumvent them.”); Verizon Comments at 5 (arguing that enumerating
particular methods to prevent unauthorized SIM changes “will give bad actors a roadmap and that may prove less
effective over time”); CTIA Comments at 10-11 (“[R]igid and prescriptive requirements hurt security more than
they may help. . . . [I]f every provider authenticates requests in the same way, fraudsters and scammers will find a
way around such uniform ‘safeguards.’”); Better Identity Coalition at 2-3 (suggesting that if the Commission
prescribes specific authentication requirements, “attackers would simply adapt their attack methods to target these
new authenticators, with the net effect being no significant slowdown in the pace of SIM Swap attacks”).
81 See, e.g., CCA Comments at 5 (asserting that specific methods “could become obsolete quickly”); CTIA
Comments at 11 (“[A]voiding rigid rules that are tied to specific technologies or tools will also help to future-proof
FCC guidance when it comes to authentication.”); T-Mobile Comments at 2 (“[W]hat constitutes a ‘secure method
of authentication’ is likely to change over time.”); Better Identity Coalition at 4 (“One constant in cybersecurity is
that threats are constantly evolving, as are the tools used to stop threats. But regulations are permanent, or in a best-
case scenario, infrequently updated. Any regulatory approach that seeks to tie MNOs to using specific
authentication technologies is certain to fail to keep up as threat and security both evolve.”).
82 See, e.g., CTIA Reply at 15 (arguing that “a more flexible approach that allows for innovation and iteration is
best”); CCA Comments at 4 (asserting that any rules the Commission adopts should be “sufficiently flexible to
account for evolving technologies”); Princeton Comments at 4 (“Authentication methods and security practices
continue to evolve, and carriers should be welcome—and encouraged—to adopt innovative safeguards.”); T-Mobile
Comments at 12-13 (“Flexibility will promote innovation and improved security for customers.”); NCTA Comments
at 7 (“An adaptable standard as discussed above will best incentivize carriers to adopt solutions that provide
effective security for their customers and services while not handcuffing carriers to specific technology or processes
as new solutions emerge.”).
83 See, e.g., CTIA Comments at 10-11 (asserting that “[f]lexibility is a cornerstone of effective risk management, as
it allows providers to develop and deploy innovative tools that can meet evolving threats and stay ahead of the
fraudsters, as opposed to ‘checking the box’ on stagnant compliance requirements”); CTIA Reply at 15-16
(explaining that flexibility will help prevent security practices from lagging behind bad actor tactics); Verizon
Comments at 5 (“[P]roviders must have flexibility both to develop and implement new methods beyond those
enumerated in the draft rule to keep ahead of bad actors and to abandon measures that no longer work.”); CCA
(continued….)
13
Federal Communications Commission FCC 23-95
AT&T that “[t]he best way to combat ever-evolving fraud tactics is to allow industry players the ability to
adapt and respond to these changing threats in real-time,”84 and we afford wireless providers this
flexibility with the rules we adopt in this Report and Order.
22. Flexibility will also permit wireless providers to use the specific security practices that
are effective and appropriate under the circumstances. We are persuaded that any given measure will
rarely prove foolproof, necessary, or suitable in all instances,85 and therefore that wireless providers
should have the ability to tailor the security mechanisms they use. AT&T, for instance, asserts that it has
had success in deploying measures strategically to reduce the incidents of SIM swap and port-out fraud,86
and with our rules, we seek to foster such outcomes. Our flexible approach enables wireless providers to
implement security measures that are designed to address a customer’s particular circumstances and
preferences, and also allows wireless providers to implement measures that are best suited for their
business models, technologies, and the services they offer.87 We also recognize that some wireless
providers may seek to use a risk-based model, whereby they apply different mechanisms to protect
customers based on the likelihood of fraud for a particular SIM change or port-out request, and we do not
want to hinder these targeted efforts.88 For these reasons, we conclude that wireless providers should
have the flexibility to determine which specific measure will be most effective at protecting customers
against SIM swap and port-out fraud in a given circumstance in accordance with our baseline rules.
23. We further anticipate that our flexible approach will enhance protections for customers
without placing undue costs and burdens on wireless providers. We are cognizant that in some instances,
strict prescriptive requirements to prevent SIM swap and port-out fraud could be technically and
(Continued from previous page)
Comments at 5 (asserting that “the Commission should allow for flexibility for carriers to respond quickly and
nimbly to new threats and to encourage adopting innovative solutions to threats”); Somos Comments at 2 (“As with
most fraud the telecom industry suffers, the bad actors are constantly evolving. Solutions should evolve, as well.”).
84 AT&T Comments at 2.
85 See, e.g., AT&T Comments at 5 & 12-13 (explaining that “no method of authentication is foolproof or effective in
every instance” and that “[e]ven proposals that have merit in certain circumstances should not be foisted onto all
carriers in all circumstances”); T-Mobile Comments at 12 (noting that failed authentication attempts occur with
regularity for legitimate users and therefore may not necessarily signal nefarious activity that requires heightened
security measures); FIDO Alliance Comments at 3-4 (explaining, for example, that one-time use passcodes sent by
SMS as a method of authentication are “useless” if a customer’s phone is lost or stolen).
86 AT&T Comments at 2-3 (“Wireless carriers have developed substantial expertise in detecting and combating new
forms of fraud. Significantly, AT&T has limited the incidences of fraudulent SIM swaps and port-outs by remaining
flexible and varied in the tools it employs, allowing us to be at least as agile as the fraudsters.”).
87 See, e.g., CTIA Comments at 3 & 18 (explaining that flexibility for notifications is needed so that providers can
“account for the complexities of notifications in various contexts”); CTIA Reply at 15-16 (noting that the record
illustrates “that flexibility is important to continue to allow providers to meet the diverse needs of their customers”);
Princeton Comments at 11-12 (declining to take a position on how investigations of fraud should be conducted,
“since the details will vary by account compromise”); AT&T Comments at 5 (explaining that the tools it uses to
combat SIM swap and port-out fraud “are tailored to different customers, services, and technologies because they
must be”); id. at 11 (explaining that because customer needs vary, the “diverse characteristics of these customers and
the products and services they utilize lend themselves to different risk-management approaches”); CCA Comments
at 5 (explaining that “[c]arriers often adopt policies that serve the specific needs of their consumers”); T-Mobile
Comments at 9 (asserting that notification methods “should be flexible and reflect customers’ preferences”).
88 See, e.g., AT&T Comments at 13-14 (“AT&T employs data-driven analytics to make an initial risk assessment for
specific postpaid transactions, which drives confidence in the authenticity of the transactions and allows them to be
completed without delay or burden to the customer.”); CTIA Reply at 11-12 (“One key step in protecting consumers
and businesses against account takeovers is for organizations to deploy risk-appropriate authentication practices.”);
T-Mobile Comments at 2 (“Organizations should use authentication measures that correspond to the value and
sensitivity of the accounts involved.”).
14
Federal Communications Commission FCC 23-95
economically infeasible for wireless providers to implement, particularly for smaller providers.89 Even in
the instances when wireless providers do have the means to implement prescriptive requirements, those
requirements could prove burdensome on providers if they become obsolete or ineffective and providers
are compelled to maintain them alongside new and better practices they adopt to address the evolving
threat landscape.90 By setting baseline requirements and giving wireless providers flexibility on how to
meet them, we allow providers to adopt the most cost-effective and least burdensome solutions to achieve
the level of security needed to protect customers against SIM swap and port-out fraud in a given
circumstance. Additionally, because many of our rules build on existing mechanisms that many wireless
providers already use, we expect that our new rules will further minimize the costs and burdens for those
providers.
A. Strengthening the Commission’s CPNI Rules to Protect Consumers
24. In this section, we adopt baseline measures designed to reduce the incidence of SIM swap
fraud without impinging on customers’ ability to upgrade and replace their devices. As proposed in the
SIM Swap and Port-Out Fraud Notice,91 we require wireless providers to use secure methods to
authenticate customers that are reasonably designed to confirm a customer’s identity prior to effectuating
SIM changes, but we depart from our proposal specifying particular methods of authentication, to allow
providers the flexibility they need to implement the most modern and effective authentication methods on
an ongoing basis. We also adopt rules to require wireless providers to implement procedures to address
failed authentication attempts and to notify customers of SIM change requests prior to effectuating a SIM
change. Additionally, we adopt rules that allow customers to lock their accounts to prevent SIM changes,
require wireless providers to track the effectiveness of the authentication measures they have
implemented, and safeguard against employee access to CPNI prior to authentication. In each instance,
we afford wireless providers needed flexibility while enhancing protections for customers.
25. The record makes clear that because SIMs are only used to facilitate service for mobile
wireless devices, SIM swap fraud is a practice that is exclusive to mobile wireless services.92 Thus, we
89 See, e.g., CCA Comments at 6 (“The Commission should also keep in mind the constraints with which many
small carriers operate against in adopting security measures. Smaller carriers may have more limited app or e-
commerce platforms, and may not currently have the capability, for example, to generate a one-time port out PIN via
an app on a 24/7/365 basis.”); T-Mobile Comments at 12 (asserting that it would be technically difficulty to track
multiple failed authentication attempts because users attempt to access their accounts across various platforms, such
as over the phone, online, or in retail stores run by the carrier or a third party); CTIA Comments at 16 (same).
90 See, e.g., AT&T Comments at 13 (asserting that the methods of authentication proposed by the Commission
“would introduce new and often unwanted complexities in the SIM swap process for carriers and their customers.
Fundamentally, requiring the use of particular authentication methods for every SIM swap would impose
tremendous burdens on carriers and customers without clear additional benefit”).
91 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14130, para. 23.
92 See, e.g., AT&T Comments at 1 (noting that “SIM swaps allow customers to replace a defective SIM or, more
commonly, to upgrade or replace an outdated, lost, stolen, or damaged phone, tablet, or other mobile device, without
disruption to their wireless service”); CCA Comments at 1 (explaining that SIM swap fraud is a method malicious
actors use to steal mobile accounts); CTIA Comments at 1-2 (discussing SIM swap fraud exclusively in the context
of wireless services); National Consumer Law Center (NCLC) and Electronic Privacy Information Center (EPIC)
Comments at 2 (NCLC/EPIC Comments) (noting that “American cell phone users . . . are extremely vulnerable to
having their telephone numbers hijacked by fraudsters through the process of SIM swapping and port-out fraud”);
NCTA Comments at 1 (explaining that with SIM swap fraud, “the bad actor convinces the wireless provider to
transfer the customer’s service from the subscriber identity module (SIM) in the customer’s phone to a new SIM in
the bad actor’s phone”); T-Mobile Comments at 1 (expressing support for “the Commission’s efforts to make it
harder for bad actors to take control of consumers’ cell phone accounts through fraudulent subscriber identity
module (‘SIM’) swapping”); Verizon Comments at 2 (explaining that “SIM changes help customers by enabling
them to easily move a mobile phone number to a new SIM card”); see also Lee et al. at 61 (explaining that a SIM
(continued….)
15
Federal Communications Commission FCC 23-95
apply these new requirements to providers of commercial mobile radio service (CMRS), as defined in
section 20.3 of Title 47 of the Code of Federal Regulations,93 including resellers of CMRS. We apply
these new requirements to all SIM changes that wireless providers perform.94 Further, we require
wireless providers to implement these rules with respect to customers of both pre-paid and post-paid
services, consistent with the protections afforded by section 222. We see no reason why the protections
should not apply to all customers of CMRS, including customers of resellers, particularly considering
indications in the record that pre-paid customers are disproportionately impacted by fraud and that many
customers impacted by such fraud are low-income customers who can ill afford such losses.95 We make
clear, however, that the rules we adopt today do not require providers to collect more information about
pre-paid customers than they otherwise do in the normal course of business, nor should they be
interpreted to impose disparate burdens on pre-paid customers related to information collection or
authentication.96
1. Customer Authentication Requirements
26. We update our CPNI rules to protect customers from the risk of fraudulent SIM swaps by
requiring wireless providers, prior to conducting a SIM change, to use secure methods to authenticate a
customer that are reasonably designed to confirm a customer’s identity,97 except to the extent otherwise
required by the Safe Connections Act or the Commission’s rules implementing that statute.98 We define
(Continued from previous page)
swap attack involves “unauthorized change to the victim’s mobile carrier account” whereby “the attacker diverts
service, including calls and messages, to a new SIM card and device that they control”).
93 47 CFR § 20.3. Under this definition, our new rules apply to both facilities-based wireless providers as well as
resellers of wireless services. Additionally, given that section 332(c)(1)(A) of the Act requires that providers of
commercial mobile service be treated as common carriers, 47 U.S.C. § 332(c)(1)(A), our rules cover “any officer,
agent, or other person acting for or employed by any common carrier or user, acting within the scope of his
employment.” 47 U.S.C. § 217.
94 Verizon suggests that requirements we adopt may not be necessary for all SIM changes, asserting that “[t]he vast
majority of SIM changes do not raise security concerns,” Verizon Comments at 6, but Verizon did not explain how
carriers may know that certain SIM changes are lower risk than others and its assertion did not receive support in the
record, so we decline to limit the applicability of our requirements to only certain SIM changes.
95 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14137, para. 45 (seeking comment on whether the rule
should apply only to certain services or accounts); see also, e.g., Princeton Comments at 13 (recommending that
“any new rules apply to both prepaid and postpaid wireless carriers”); NCLC/EPIC Comments at 2 (noting that
“American cell phone users, particularly those who rely on prepaid phones, are extremely vulnerable to having their
telephone numbers hijacked by fraudsters” and that prepaid phone customers are “generally low-income
consumers”).
96 See Letter from Avonne Bell, Director, Connected Life, CTIA, to Marlene H. Dortch, Secretary, FCC, WC
Docket No. 21-341, at 10 (filed Nov. 8, 2023) (CTIA Nov. 8, 2023 Ex Parte Letter).
97 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14130, para. 23. We encourage wireless providers to use
secure authentication methods that accommodate the needs of the broad spectrum of customers they may serve. See
infra para. 56.
98 The Safe Connections Act of 2022, Pub. L. No. 117-223, 136 Stat. 2280 (Safe Connections Act), which is
codified at 47 U.S.C. § 345, requires wireless providers to separate lines from a multi-line account upon request of a
survivor of domestic violence and other related crimes and abuses. 47 U.S.C. § 345(b)(1). The Commission
proposed rules implementing this requirement and sought comment both on authentication of survivors seeking line
separations and how to prevent fraud related to line separation requests. See Supporting Survivors of Domestic and
Sexual Violence; Lifeline and Link Up Reform and Modernization; Affordable Connectivity Program, WC Docket
Nos. 22-238, 11-42, 21-450, Notice of Proposed Rulemaking, FCC 23-9, paras. 44-45, 103 (rel. Feb. 17, 2023) (Safe
Connections Notice). In an Order adopted today implementing the Safe Connections Act, the Commission adopted
rules to require covered providers to attempt to authenticate, using multiple authentication methods if necessary, that
a survivor requesting a line separation is a user of a specific line or lines. See Supporting Survivors of Domestic and
(continued….)
16
Federal Communications Commission FCC 23-95
“SIM,” for purposes of these rules, as “a physical or virtual card associated with a device that stores
unique information that can be identified to a specific mobile network.”99 The record reflects significant
support for strengthening authentication requirements for SIM change requests,100 and we find that the
requirement we adopt today most appropriately balances the need to increase protection for customers
from these types of fraudulent schemes while providing wireless providers the flexibility the record shows
they need to respond to new and emerging threats.101 We are persuaded by commenters that a general
security authentication standard will afford customers the highest level of protection by allowing wireless
providers to implement the authentication methods raised in the record,102 or develop new authentication
(Continued from previous page)
Sexual Violence, WC Docket No. 22-238, Report and Order, FCC 23-96, para. 52 (rel. Nov. 16, 2023) (Safe
Connections Order). Covered providers must use methods that are reasonably designed to confirm the survivor is
actually a user of the specified line(s) on the account when the survivor is not the primary account holder or a
designated user, and this authentication shall be sufficient for requesting a SIM change when made in connection
with a line separation request. See id. To the extent this requirement differs from other authentication requirements,
including those in 47 CFR § 64.2010, the line separation authentication requirements the Commission adopts to
implement 47 U.S.C. § 345 serve as an exception to those other requirements. See id. We also make clear that the
Safe Connections Act-related exceptions to our new SIM change and LNP rules for any SIM change or port-out
requests made in connection with a legitimate line separation request apply regardless of whether a line separation
request is technically or operationally infeasible.
99 See Appx. A (new 47 CFR § 64.2010(h)). We slightly revise this definition from that proposed in the SIM Swap
and Port-Out Fraud Notice to provide greater clarity that a SIM is not necessarily a physical card. See SIM Swap
and Port-Out Fraud Notice, 36 FCC Rcd at 14130, para. 23 (proposing a similar definition but with “contained
within ” in place of “associated with”); NCLC/EPIC Comments at 3 (writing that they are “encouraged” by the
Commission’s proposal and definition of “SIM”).
100 See, e.g., Bank Policy Institute/BITS (BPI/BITS) Comments at 1 (“BPI/BITS supports reasonable measures to
require additional authentication factors to reduce these risks.”); CCA Comments at 3 (agreeing that “some degree
of heightened authentication procedure is appropriate in the context of SIM swaps or port outs to prevent the
increasing risk of fraud”); Princeton Comments at 2 (“We support the Commission’s proposal to require that carriers
complete strong customer authentication before effectuating a SIM swap.”); Somos Comments at 2 (“It should be
required that trusted identity verification and validation, as qualification of a SIM swap transaction must be
implemented.”); ATL Comments at 1 (supporting “additional fraud prevention methods and requiring all carriers to
adopt secure methods of authenticating a customer before SIM changes”); Prove Comments at 2-3 (“Prove believes
that carriers should securely authenticate customers prior to effectuating any SIM swap or port-out request.”).
101 See AT&T Comments at 11; Verizon Comments at 5; CCA Comments at 5; CTIA Comments at 16-17; T-Mobile
Comments at 12-13; NCTA Comments at 2-6; Somos Comments at 2; CTIA Reply at 15.
102 See, e.g., FIDO Alliance Comments at 4 (citing the benefits of the FIDO standards public key cryptography
approach); Better Identity Coalition Comments at 3-4 (explaining that “industry and government are moving away
from knowledge-based approaches to authentication (i.e. passwords) to those that are possession-based, such as
authentication based on the FIDO2 standards”); OPUS Research Reply at 1 (promoting the use of “voice biometrics
as part of a multi-factor approach to strong customer authentication”); Prove Comments at 2-6 (suggesting
development and use of a “neutral, cross-industry, consumer-managed tool” based on the authentication factors of
possession, reputation, and ownership); Princeton Comments at 5-6, 12 (supporting the use of multi-factor
authentication and implementation of a system for carriers to check whether a SIM was recently swapped); NCTA
Comments at 5 (asserting that “multi-factor authentication that considers biometrics, devices, app-based tokens, and
other unique identifiers . . . also provide security and offer benefits to consumers, including ease of use”); Robert
Ross Comments at 5-8 (recommending the Commission require authentication solutions based on the principles of
layered security, non-profit solutions, a combination of customer-facing and non-customer facing methods, and a
combination of technology and human solutions, with examples provided); BPI/BITS Comments at 2-3 (expressing
support for “app-based push notification to a trusted mobile device, biometrics identifiers, or cryptographic keys,”
for certain types of data); ID.me Comments at 4 (“The FCC should require carriers to comply with NIST SP 800-63-
3 IAL2, AAL2, and FAL2 before authorizing SIM Swap and Port-Out transactions.”); iProov Comments at 5-7
(recommending the Commission require “at least two independent authentication factors” be used and that the list of
secure methods include a strong multi-factor authentication factor, such as cloud biometrics, “that does not rely on
(continued….)
17
Federal Communications Commission FCC 23-95
methods, in ways that both account for advances in the technology and tactics used by bad actors and that
work best for their customers and the particular services they offer.103 Additionally, we believe this
flexibility alleviates record concerns about the limited information wireless providers may have to
authenticate customers of pre-paid accounts.104
27. While the approach we take today gives wireless providers the flexibility to adapt to
evolving threats, it also creates an obligation that they adapt to those threats. Specifically, our rule
establishes a requirement that wireless providers regularly, but not less than annually, review and, as
necessary, update their customer authentication methods to ensure those methods continue to be secure.105
The record reflects that while many authentication measures may be effective today, evolving tactics may
mean those methods will not work tomorrow or in all circumstances.106 If wireless providers fail to
evolve their authentication methods over time, we expect their methods eventually will become
ineffective. Therefore, we require wireless providers to regularly, but not less than annually, review their
authentication methods, and update them as necessary to ensure that the authentication methods remain
effective.
28. Because we impose a general requirement for secure and reasonably designed customer
authentication, both permitting and obligating wireless providers to design effective methods to
authenticate customers, we decline to enumerate the four specific authentication methods the Commission
specified in the SIM Swap and Port-Out Fraud Notice as those that would meet the standard of secure
authentication methods.107 We are convinced by the record that specifying approved authentication
methods may incentivize wireless providers to rely exclusively on those methods or discourage them from
(Continued from previous page)
possession of the device or number”); T-Mobile Comments at 3 (explaining that customers are permitted to set up
multi-factor authentication “using methods including security questions, SMS, or device-based biometrics such as
Face ID or fingerprint recognition on devices that support such features”).
103 See, e.g., CTIA Reply at 11-12 (“One key step in protecting consumers and businesses against account takeovers
is for organizations to deploy risk-appropriate authentication practices.”); T-Mobile Comments at 2 (“Organizations
should use authentication measures that correspond to the value and sensitivity of the accounts involved.”).
104 See CTIA Comments at 14-15 (noting that “fighting fraud in the pre-paid context is different than in the post-paid
context” and that “providers ordinarily do not collect or have detailed identity information for pre-paid customers”);
T-Mobile Comments at 8 (stating that “[p]repaid service generally does not require identity validation for account
set-up”); CCA Comments at 6 (noting that pre-paid customers “often do not provide an accurate address or other
identifying information, making it difficult for carriers to authenticate an account request”); CTIA Comments at 19-
20 (noting that a flexible approach will better serve customers, including pre-paid customers).
105 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14132, para. 27 (seeking comment on how we can
account for changes in technology, recognizing that some methods may become hackable over time while additional
secure methods of authentication will likely be developed).
106 See AT&T Comments at 11 (“While passwords remain a useful and typically effective authentication tool,
especially when used in combination with other security mechanisms, that may not be the case in the future. New
forms of network-based authentication offer promise for preventing unauthorized access incidents in ways that may
be more user-friendly as well.”); Better Identity Coalition Comments at 5-6 (explaining that some forms of multi-
factor authentication can be subject to phishing, but other forms are phishing resistant); iProov Comments at 5-7
(explaining that some biometrics can be vulnerable to social engineering and that device-based biometrics are not as
secure as cloud-based biometrics).
107 Those four methods were: (i) the use of a pre-established password; (ii) a one-time passcode sent via text
message to the account phone number or a pre-registered backup number; (iii) a one-time passcode sent via e-mail
to the e-mail address associated with the account; or (iv) a passcode sent using a voice call to the account phone
number or a preregistered back-up telephone number. SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14130,
para. 23. No commenters supported our imposing these as the exclusive forms of authentication.
18
Federal Communications Commission FCC 23-95
adopting new methods to address evolving techniques used by bad actors.108 Further, some commenters
assert that requiring specific authentication methods would be burdensome for wireless providers.109
Additionally, the record reflects that setting specific authentication methods could provide a roadmap for
bad actors seeking to commit fraud.110 The record also highlights potential vulnerabilities of the four
authentication methods we proposed,111 which counsels against us codifying these as secure methods of
authentication in perpetuity. For these reasons, we conclude it is most appropriate to allow wireless
providers to analyze and implement the most effective and secure methods of authenticating customers
requesting a SIM change.112
29. We nevertheless place boundaries on the use of certain information for customer
authentication for SIM change requests in light of evidence in the record of their particular vulnerability.
Namely, we conclude, consistent with our proposal, that methods of authentication that use readily
available biographical information, account information, recent payment information, and call detail
information do not constitute secure methods of authentication.113
108 See AT&T Comments at 14 (“The practical effect of the list is that carriers will feel constrained in using non-
listed methods for fear that anything else would be unauthorized.”); Better Identity Coalition at 4 (“[W]e have some
concerns that if the four authentication methodologies are the only ones listed in the regulation, that it may
discourage the use of stronger, more innovative approaches to authentication.”); FIDO Alliance Comments at 3
(arguing that reliance on the four specified authentication methods may disincentive carriers to adopt stronger
authentication measures).
109 See AT&T Comments at 13 (explaining that “requiring the use of particular authentication methods for every
SIM swap would impose tremendous burdens on carriers and customers without clear additional benefit”); Prove
Comments at 2 (“The authentication protocols proposed in the NPRM are, however, overly prescriptive, out-of-date
(or soon will be), ineffective, easy to compromise, and overly burdensome for both carriers and consumers.”).
110 AT&T Comments at 14-15 (“[F]ixed authentication methods for SIM changes and port-outs will provide a
roadmap to bad actors”); CTIA Comments at 10-11 (“[I]f every provider authenticates requests in the same way,
fraudsters and scammers will find a way around such uniform ‘safeguards.’”).
111 See Better Identity Coalition Comments at 2-3 (asserting that the four methods we proposed “are all based on
authentication methods that are known to be easily compromised” and describing the weaknesses with each); FIDO
Alliance Comments at 3-4 (same); Prove Comments at 2-3 (same).
112 For similar reasons, we also decline to require carriers to comply with the National Institute of Standards and
Technology (NIST) Digital Identity Guidelines or other standards proposed in the record. See SIM Swap and Port-
Out Fraud Notice, 36 FCC Rcd at 14132, para. 28. See CTIA Reply at 18-19 (arguing that while the NIST Digital
Identity Guidelines or FIDO Standards might be useful tools, they should not be mandated); Better Identity
Coalition Comments at 5 (asserting that while the NIST guidelines are a helpful reference point, they should not be
the basis of the Commission’s regulation because they are only updated every 5-7 years and reliance on them “could
inadvertently preclude innovation that might better guard against attacks”); iProov Comments at 8; T-Mobile
Comments at 13 (asserting that the NIST guidelines are a good reference point for best practices but are not a
suitable compliance tool). But see ID.me Comments at 4 (“The FCC should require carriers to comply with NIST
SP 800-63-3 IAL2, AAL2, and FAL2 before authorizing SIM Swap and Port-Out transactions.”).
113 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14132, para. 30; see also Princeton Comments at 11
(affirming the finding in its 2020 report that biographical information, account information, recent payment
information, and call detail information have significant security shortcomings and therefore should not be used as
the exclusive means of authentication, individually or in combination with each other). We decline to establish an
exigent circumstances exception on the use of this information for authentication for when customers are traveling
and may not have access to or remember a PIN, as CTIA asked us to consider. CTIA Nov. 8, 2023 Ex Parte Letter
at 8. We believe that such an exception would establish a significant loophole for fraudulent activity and note that in
these circumstances, customers can use alternative methods of authentication, such as email. We strongly encourage
providers to work with customers to develop backup authentication practices for use in these types of scenarios. We
seek comment in the Further Notice on whether we should harmonize our CPNI rules with the SIM change rules we
adopt today, and we therefore take no action, at this time, to amend our existing rules to prohibit providers from
(continued….)
19
Federal Communications Commission FCC 23-95
30. We decline to restrict the use of SMS-based customer authentication for SIM change
requests, but we strongly encourage wireless providers to use this mechanism only when paired with other
secure methods of authentication, i.e., as part of multi-factor authentication (MFA).114 In the SIM Swap
and Port-Out Fraud Notice, we sought comment on the potential security vulnerabilities of SMS-based
authentication.115 The record clearly expresses concern about the security risks of SMS-based
authentication when used by third parties, such as financial institutions, largely because this
authentication method becomes vulnerable following fraudulent SIM swaps.116 The record evidence is
less clear that SMS-based authentication is an insecure mechanism in every instance it is used, such as to
authenticate the identity of individuals requesting a SIM change, particularly when sent over a provider’s
own network, rather than the Public Switched Telephone Network (PSTN).117 We also acknowledge that,
(Continued from previous page)
relying on recent payment and call detail information to authenticate customers for online, telephone, or in-person
access to CPNI. See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14132-33, para. 30.
114 We reject CTIA’s request to remove the language encouraging wireless providers to pair SMS-based
authentication with secure methods of authentication and replace it with language encouraging wireless providers to
“consider the context in which SMS is deployed, consistent with the discussion in the record” based on the assertion
that wireless providers are “are best suited to determine when and how SMS authentication can be securely deployed
with their own customers on their own networks.” CTIA Nov. 8, 2023 Ex Parte Letter at 11. The existing language
permits providers to make determinations about the best use of SMS-based authentication and simply encourages
that it be paired with more secure authentication measures.
115 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14130-31, para. 24.
116 See, e.g., BPI/BITS Comments at 2-3 (explaining that a one-time passcode (OTP) sent via SMS can be vulnerable
following a fraudulent SIM swap and that “for applications with higher-stakes consumer data such as financial
applications, OTP factors remain a target for bad actors”); iProov Comments at 7 (noting SMS-based authentication
is vulnerable in part because of SIM swaps, which allow bad actors to intercept calls and messages); CTIA
Comments at 5 (“While SMS-based two-factor authentication may be perfectly suitable to some settings, it may not
uniformly be appropriate for all types of transactions.”); CTIA Reply at 12 (“SIM cards and the telecommunications
accounts associated with them are not always an appropriate method of authentication for third-party apps and
services, including organizations like financial and crypto service providers, to rely on to authenticate their end
users.”); T-Mobile Comments at 14 (“Entities with sensitive consumer information or assets (e.g., financial services,
cryptocurrency wallets, healthcare, insurance, etc.) should be encouraged to use appropriate authentication methods
that correspond to the sensitivity of accounts or transactions. SMS as the second factor should not necessarily be the
sole authentication method.”); Yubico Comments at 1 (“[A]uthentication based on a person’s phone number that can
be SIM Swapped is not a sustainable model due to the fact that the phone number is not fully controlled by the end
user.”); FIDO Alliance Comments at 2 (explaining how fraudulent SIM swaps allow criminals and foreign
adversaries “to undermine some weaker forms of multi-factor authentication (MFA) such as one-time passcodes
(OTPs) transmitted via SMS”); Better Identity Coalition Comments at 2 (noting that attackers trick customers into
handing over OTPs sent via SMS when used in other sectors). Several commenters assert that the use of SMS-based
authentication by third parties creates significant incentive for bad actors to carry out SIM swap fraud. See, e.g.,
Better Identity Coalition Comments at 2 (asserting that the fact that SMS “is widely used as an authentication
method [by many companies and organizations] has created incentives for criminals to launch SIM Swap attacks”);
FIDO Alliance Comments at 3 (“To truly eliminate SIM Swap attacks, the best way to do so is to get companies and
organizations to shift from SMS-based authentication to more secure forms of MFA.”); T-Mobile Comments at 14
(“[T]he reliance of financial and cryptocurrency firms on SMS for authentication is driving fraudsters to constantly
pursue new avenues of SIM and porting fraud.”).
117 See, e.g., Verizon Comments at 5 & n.12 (noting that in some cases, SMS “can be an effective authenticator” and
that the FTC has found that “in some cases ‘use of SMS text messages as a factor may be the best solution because
of its low cost and easy use’” (quoting the FTC’s Safeguards Rule)); AT&T Comments at 6 (noting that “[a]t a
higher risk threshold, AT&T uses SMS confirmations � two-way, no charge communications sent to postpaid
customers asking them to approve or reject a pending SIM swap or port-out transaction”); Princeton Comments at 3
(“We support allowing SMS and voice call authentication methods when the carrier can deliver the passcode
exclusively over its own network and to a specific known device (e.g., smartphone) or point of service (e.g., landline
phone) connected to the network and controlled by the customer.”); CTIA Comments at 5 (“SMS text messaging
(continued….)
20
Federal Communications Commission FCC 23-95
in some instances, it may be the most practical means a provider can authenticate a customer, particularly
when considering the needs of a particular customer.118 We anticipate that the approach we take here
strikes the right balance between protecting customers against SIM swap fraud while preserving the
relative ease with which customers can obtain legitimate SIM changes. We emphasize, however, that our
rules create an ongoing obligation that wireless providers ensure the authentication methods they use are
secure. Accordingly, permitting wireless providers to use SMS-based authentication does not create a
safe harbor for use of this authentication method. We will continue to monitor the use of SMS-based
authentication and may later revisit our decision to permit its continued use.119
2. Response to Failed Authentication Attempts
31. We require wireless providers to develop, maintain, and implement procedures for
responding to failed authentication attempts in connection with a SIM change request that are reasonably
designed to prevent unauthorized access to a customer’s account, which, among other things, take into
consideration the needs of survivors pursuant to the Safe Connections Act and our implementing rules.120
We are bolstered by the Princeton University researchers who found evidence that wireless providers’
procedures to respond to suspicious authentication attempts may be inadequate or nonexistent.121
Specifically, they determined that some wireless providers only required callers to successfully respond to
one authentication challenge to obtain a SIM change even if the caller had failed numerous previous
(Continued from previous page)
may be an appropriate authentication factor, depending on the nature and the sensitivity of the information being
accessed and whether the consumer maintains control over the device and the number associated with it.”); CTIA
Reply at 16 (acknowledging that a OTP sent via SMS may not be useful in the case of a lost or stolen phone, but that
it “may be perfectly appropriate [for SIM change authentications] when the customer is in possession of the
device”). In the SIM Swap and Port-Out Fraud Notice, we highlighted an investigation which found that SMS-
based text messages could be easily intercepted and re-routed using a low-cost, online marketing service, but we
also explained that wireless providers had reportedly mitigated that vulnerability and no commenters raised this as a
concern in the record. SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14130-31, para. 24.
118 See, e.g., CCA Comments at 6 (“[C]ustomers often do not update their carrier with their most recent email
addresses or do not regularly check email, whereas a phone number is current and texts are easily accessible. Other
carriers have noted that for customers with prepaid accounts, customers often do not provide an accurate address or
other identifying information, making it difficult for carriers to authenticate an account request with this kind of
information.”); CTIA Reply at 16 (“[T]he record makes clear that customer needs vary, for example as between
consumer and business customers, and that those variable customer needs inform authentication practices.”). We
recognize that SMS-based authentication also is a common authentication method used by wireless providers. See,
e.g., AT&T Comments at 6 (“AT&T routinely uses a one-time PIN delivered via SMS message or an outbound
voice call to a postpaid customer’s device for enhanced customer validation, including with SIM swaps.”); CCA
Comments at 3 (noting that two-factor authentication with a OTP sent to a phone number is “among the procedures
that already are gaining prevalence” by wireless providers and noting that several of CCA’s members prefer text
messages for authentication purposes); CTIA Comments at 3-4 (noting that some wireless providers combat SIM
swap and port-out fraud by “[e]mploying multi-factor authentication when account changes are requested, including
one-time passcodes sent via text message”).
119 Princeton Comments at 3 (“Commission staff should periodically revisit the security of these authentication
methods and reevaluate whether to retain them.”).
120 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14133, para. 33; Princeton Comments at 7. See also 47
U.S.C. § 345; 47 CFR § 64.6402(b) (a covered provider shall attempt to authenticate, using multiple methods if
necessary, that a survivor requesting a line separation is the user of a specific line); 47 CFR § 64.6402(i) (a covered
provider shall not notify a primary account holder of a survivor’s request for a SIM change when made in
connection with a line separation request pursuant to 47 U.S.C. § 345 and this subpart).
121 See Princeton Comments at 7 (“We saw no evident response from carriers to our suspicious customer
authentication attempts.”).
21
Federal Communications Commission FCC 23-95
authentication attempts.122 While the SIM Swap and Port-Out Fraud Notice raised these issues, no
commenters offered evidence to counter the researchers’ findings. Without procedures in place to
respond to failed authentication attempts, bad actors can seek to circumvent wireless provider
authentication mechanisms to fraudulently obtain a SIM change. We anticipate that requiring wireless
providers to establish procedures to respond to failed authentication attempts that are reasonably designed
to prevent unauthorized access to a customer’s account will impede these fraud attempts. We conclude
that whatever burdens may be associated with this requirement are outweighed by the Commission’s
interest in protecting customers against fraudulent activity.
32. At the same time, we are persuaded by T-Mobile’s argument that wireless providers need
flexibility with respect to failed authentication attempts because it is common for customers to lose or
forget their authentication data, leading to multiple failed attempts.123 As such, we decline at this time to
adopt prescriptive requirements for how wireless providers must respond to failed authentication attempts
in connection with a SIM change request. We find that anchoring this rule in a reasonableness standard
will give wireless providers flexibility to design procedures to handle failed authentication attempts that
protect against fraudulent activity while preventing unnecessary burdens on legitimate customer
activity.124 We decline, however, to adopt CTIA’s suggestion to require the development and
implementation of such procedures only where a wireless provider has reason to believe multiple
authentication attempts are fraudulent; CTIA does not address how such determinations would be made
absent the very procedures we require.
33. We decline, at this time, to adopt a requirement that wireless providers immediately
notify customers in the event of multiple failed authentication attempts in connection with SIM change
requests.125 Industry commenters assert that “in many cases, providers will not be able to discern whether
a failed authentication attempt is ‘in connection with a SIM change request’ or some other type of
transaction involving account access for which authentication is needed and fails,” and that “a carrier does
not typically know why a customer authenticates until after the customer has successfully
authenticated.”126 Further, commenters raise concerns that tracking such attempts across platforms could
be technically challenging,127 though we are not persuaded that doing so is technically infeasible.128
Given these concerns, we find that requiring wireless providers to notify customers immediately of
122 Lee et al. at 62; see also Princeton Comments at 6 (“[W]e found that carriers did not implement adequate
safeguards for preventing an attacker from repeatedly calling customer service and attempting a SIM swap.”).
123 T-Mobile Comments at 7.
124 See CTIA Reply at 23 (calling for any adopted rules related to failed authentication attempts to be “based on a
reasonableness standard, as it would promote robust authentication practices through a flexible, risk-based lens”);
Princeton Comments at 6-7 (recommending that the Commission “require that the procedures be reasonably
designed to prevent unauthorized access to a customer’s account”).
125 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14133, para. 33 (seeking comment on potential delay
and notification requirements in the case of multiple failed authentication attempts).
126 CTIA Nov. 8, 2023 Ex Parte Letter at 6-7; AT&T Nov. 8, 2023 Ex Parte Letter at 3.
127 See T-Mobile Comments at 12 (asserting that it would be technically difficult to track multiple failed
authentication attempts because users attempt to access their accounts across various platforms, such as over the
phone, online, or in retail stores run by the carrier or a third party); CTIA Comments at 16 (“[D]eveloping
procedures to track multiple failed authentication attempts as contemplated in the NPRM would be challenging for
providers, as authentication attempts may occur across different settings (e.g., in person, online, or over the phone)
and they may occur at disparate times.”).
128 For example, CTIA’s proposal that carriers should only be required to develop and implement procedures for
responding to multiple failed authentication attempts “where a carrier has reason to believe such attempts are
fraudulent” implies that wireless carriers can and do track multiple authentication attempts, or, at a minimum, are
technically capable of doing so.
22
Federal Communications Commission FCC 23-95
multiple failed authentication attempts associated with a SIM change request is not appropriate at this
time. However, we seek comment in the Further Notice below whether we should require wireless
providers, or all telecommunications carriers, to notify customers immediately of all failed authentication
attempts to help protect customers from account fraud, as well as how wireless providers could implement
a customer notice requirement for multiple failed authentication attempts.
34. We also decline to require that wireless providers delay SIM changes for 24 hours in the
event of failed authentication attempts while notifying customers via text message and/or email regarding
the failed authentication attempts.129 The record reflects that strict requirements involving 24-hour delays
or account locks could be overly burdensome for customers that are engaged in legitimate SIM
changes.130 We also anticipate that the requirement to develop, maintain, and implement procedures for
responding to failed authentication attempts in connection with a SIM change request that are reasonably
designed to prevent unauthorized access to a customer’s account, coupled with the requirement we adopt
below that wireless providers immediately notify customers upon receiving a SIM change request, will be
sufficient to empower customers to quickly address unauthorized SIM change attempts.
3. Customer Notification of SIM Change Requests
35. To provide customers with an early warning that their account may be subject to
fraudulent activity, we adopt our proposal to require wireless providers to provide immediate notification
to customers of any requests for a SIM change associated with the customer’s account131 and specify that
the notification must be sent before a wireless provider effectuates a SIM change, except to the extent
otherwise required by the Safe Connections Act of 2022 (47 U.S.C. § 345) the Commission’s rules
implementing that statute.132 The record evinces firm support for this requirement133 and provides good
reason—time is often of the essence with SIM swap fraud, and notifying customers of a SIM change
request before effectuating the request will enable customers to act promptly to mitigate damages and
inconvenience resulting from fraudulent or inadvertent SIM changes.134 We also expect that requiring
129 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14133, para. 33 (seeking comment on potential delay
and notification requirements in the case of multiple failed authentication attempts).
130 See NCTA Comments at 6 ( “[F]orcing providers to lock a customer out of their own account for a certain
amount of time can arbitrarily punish customers who are less adept at navigating the authentication process and
proving their identity in a secure way.”); AT&T Comments at 2-3; CTIA Comments at 16; T-Mobile Comments at
7.
131 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14133, para. 34.
132 See Safe Connections Order, FCC 23-96, at para. 77 and Appx. A (new 47 CFR § 64.6402(i)) (prohibiting a
covered provider from notifying a primary account holder of a survivor’s request for a SIM change when made in
connection with a line separation request pursuant to 47 U.S.C. § 345 and the implementing rules).
133 See, e.g., Princeton Comments at 7 (“We support the Commission’s proposal requiring customer notification for
SIM swap attempts.”); T-Mobile Comments at 2 (“The Commission should adopt its proposal to require reasonable
efforts to notify users of port-out requests and SIM changes.”); DC Stone Comments (Express) (“At the
consumers[’] option, no SIM porting should be permitted without first sending a notifying email (or SMS message)
to a prearranged contact email address (or phone number).”); see also Verizon Comments at 6 (“[N]otifying the
customer of attempted and/or executed SIM changes, can be useful tools in some cases.”).
134 See Princeton Comments at 7 (asserting that notice of a SIM swap attempt is “essential, so that a customer can
take prompt action to protect their telecommunications account (e.g., updating a compromised password), their other
accounts (e.g., stopping a fraudulent payment), and their devices (e.g., removing malware from a compromised
device)”); Prove Comments at 2, 6 (asserting that “consumers should receive timely notice of high risk events such
as SIM swaps and port-out requests, and be afforded the opportunity to prevent account takeovers before they are
completed”); Andreas Carlos Freund Comments (Express) (“Strengthening these rules will . . . ensure customers are
apprised of an attempted attack, so that they can take additional measures to protect their privacy.”); see also 2007
CPNI Order, 22 FCC Rcd at 6942, para. 24 (explaining that, with respect to other types of account changes, the
(continued….)
23
Federal Communications Commission FCC 23-95
notification before the request is processed will prevent the notification from being sent to the bad actor
after a SIM swap has occurred. For these reasons, we agree with Princeton University that “[t]here is an
unambiguous and material security upside,” to immediate customer notification of SIM change requests,
and “the only downside is a very infrequent notification that the customer can easily discard” for
legitimate requests.135
36. We therefore disagree with AT&T’s contention that notification of all SIM change
requests is unnecessary because “AT&T employs various tools to assess the risk level of a particular
postpaid SIM change or port-out request and very often can determine at the outset that a request is
legitimate.”136 The notification requirement we adopt today will provide a uniform safety measure for all
requests across the mobile wireless industry, which we anticipate will reduce the instances and mitigate
the harms of SIM swap fraud. We also disagree with AT&T’s assertion that customers will become so
inundated with SIM change notifications that they will “eventually become numb or immune to them or
tire of and consciously choose to ignore them, thus undermining all value they might otherwise have
when the threat of fraud is real.”137 Nothing in the record, or our understanding of the SIM change
process, supports the notion that customers request SIM changes at such a rate that, upon the adoption of
this rule, wireless providers will be forced to inundate their customers with the required notifications.138
37. Also contrary to AT&T’s assertions,139 we do not anticipate that the notification
requirement we adopt today will be overly burdensome for wireless providers to implement. As an initial
matter, wireless providers should already have processes in place to immediately notify customers of
certain account changes involving CPNI in accordance with our existing rules,140 so they should be able to
build on these processes to provide immediate notification regarding SIM change requests. The record
also demonstrates that some wireless providers already notify customers of SIM change requests in most
instances and therefore will only need to update their processes to notify customers in all cases.141
(Continued from previous page)
Commission has found that notification is an important tool for customers to monitor their account’s security and
enables them to take appropriate action in the event of fraudulent activity).
135 Princeton Comments at 7.
136 AT&T Comments at 15.
137 AT&T Comments at 15; see also CTIA Comments at 18 (asserting that notifications can be appropriate in “many
instances” but that notifications “must be weighed against other goals, and in general, avoid unnecessary friction in
the user experience or other unintended consequences, such as notice fatigue”).
138 See Princeton Comments at 7. For the same reasons, we decline AT&T’s request that we modify the mandatory
SIM change request notification requirement “either to 1) standalone SIM transactions—i.e., SIM swaps that do not
include a device change or upgrade—based on the lower propensity for fraud in transactions involving new devices,
or 2) SIM transactions that a carrier identifies as having a high propensity for fraud,” on the basis such notifications
could cause customer confusion, concern, and fatigue, and could increase costs for carriers because such
notifications increase customer calls. Letter from Caroline Van Wie, Vice President, Federal Regulatory, AT&T, to
Marlene Dortch, Secretary, FCC, WC Docket No. 21-341, at 3 (filed Nov. 8, 2023) (AT&T Nov. 8, 2023 Ex Parte
Letter); see also CTIA Nov. 8, 2023 Ex Parte Letter at 8 (requesting similar SIM transaction notification limitations
as AT&T).
139 See AT&T Comments at 15 (asserting that a notice requirement would impose burdens on wireless providers).
140 47 CFR § 64.2010(f); 2007 CPNI Order, 22 FCC Rcd at 6942, para. 24 (requiring carriers to “notify customer
immediately whenever a password, customer response to a back-up means of authentication for lost or forgotten
passwords, online account, or address of record is created or changed”).
141 See AT&T Comments at 6 (explaining that for transactions meeting a certain threshold of AT&T’s “risk model,”
it will send one-way SMS notifications of a SIM change request, and for transactions meeting a higher risk
threshold, it will require customers confirm the SIM change request via an SMS notification); T-Mobile Comments
at 4 (noting that as part of its efforts to “help customers secure their accounts, T-Mobile notifies customers of
account changes and requests”); Verizon Comments at 6 (“Verizon already employs (or is on track to employ) many
(continued….)
24
Federal Communications Commission FCC 23-95
Additionally, as discussed below, we give wireless providers flexibility on how to provide the required
notifications, which we expect further minimizes any potential burdens associated with our new rule.142
In any event, we find that the benefits of our notification requirement outweigh the potential burdens.
38. We permit wireless providers to determine the method of providing notifications
regarding SIM change requests involving a customer’s account, but specify that the notifications must be
reasonably designed to reach the customer associated with the account,143 and sent in accordance with
customer preferences, if indicated.144 Although some commenters suggest that we should specify the
means by which a wireless provider should deliver SIM change request notifications,145 we agree with
industry commenters that providers need flexibility to determine the most appropriate method to notify
their customers of a pending SIM change request,146 so that providers can account for “the complexities of
notifications in various contexts,”147 as well as the technical capabilities, accessibility needs, or broadband
access of individual customers. For example, when a customer is requesting a SIM change because the
customer’s phone is lost or stolen, our flexible approach enables wireless providers to use methods of
notification that are most likely to reach the customer under those circumstances, such as an email or a
text or call to a pre-determined back-up phone number.148 We also aim to enable wireless providers to
send notifications in accordance with customer preferences, needs, and established expectations.149 As
(Continued from previous page)
of the methods identified in the NPRM, such as notifying customers of high-risk SIM change authentication
attempts, failed or otherwise, and of other account changes.”); CTIA Comments at 18 (explaining that “there are
many instances where notifications to consumers are appropriate and providers can and do make reasonable efforts
to provide them”).
142 For the same reasons, we decline CTIA’s request “to let providers determine whether a notice is warranted or
effective in the first instance” on the basis that such flexibility is needed to deal with instances, for example, when a
phone is lost or stolen and expedient forms of notification may not be available. CTIA Nov. 8, 2023 Ex Parte Letter
at 8. We do not prohibit wireless providers from processing SIM change requests after the notification is sent, and
because bad actors may attempt to commit SIM swap fraud by claiming that a device is lost or stolen, that is
precisely the type of situation when we want to ensure customers are provided a notification of a SIM change
request.
143 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14134, para. 36. Our rule does not impose a duty on
carriers to confirm that the notification has been received and read by the actual customer and therefore it does not
impose strict liability on carriers if the notification fails to reach the customer or require carriers to wait to complete
a SIM change after delivering a notification. See AT&T Comments at 16.
144 For example, this would include delivering a notification in the language of the customer’s choosing, if the
wireless provider permits communications preferences in other languages and the customer has previously indicated
such choice.
145 See, e.g., Princeton Comments at 7; Prove Comments at 6; DC Stone Comments (Express).
146 See, e.g., AT&T Comments at 16; T-Mobile Comments at 2; CTIA Reply at 23.
147 CTIA Comments at 18. See also AT&T Comments at 16 (“[C]arriers should be permitted to communicate with
their customers via the means they deem to be most effective in a particular context.”). Our rule also gives carriers
the flexibility to design a notification process that accommodates scenarios beyond individual customers, such as a
business customer seeking bulk SIM changes to upgrade their equipment. We note that nothing in the customer
safeguard rules we adopt today is inconsistent with or intended to supersede the Commission’s existing business
customer exemption, which permits telecommunications carriers to “bind themselves contractually to
authentications regimes other than those described in this section for services they provide to their business
customers that have both a dedicated account representative and a contract that specifically addresses the carriers’
protection of CPNI.” 47 CFR § 64.2010(g); see also CTIA Nov. 8, 2023 Ex Parte Letter at 10-11.
148 See CTIA Comments at 18 (noting that “where a phone is lost or stolen, certain notifications will not reach
consumers”).
149 See T-Mobile Comments at 6-7 (encouraging the Commission to consider rule changes that meet “legitimate
customer needs” and “promote diversity, inclusion, and accessibility of wireless services”); id. at 9 (asserting that
(continued….)
25
Federal Communications Commission FCC 23-95
such, we permit wireless providers to use existing methods of notification that are reasonably designed to
reach the customer associated with the account,150 and we encourage them to adopt new notification
methods as they are developed to stay responsive to evolving fraud schemes. We acknowledge that our
new rule differs from our existing rule that providers deliver notification of other account changes
involving CPNI, which specifies that those notifications may be delivered through a carrier-originated
voicemail or text message to the telephone number of record, or by mail to the address of record.151 We
find that departing from the existing rule’s approach is appropriate given the depth of harm that can occur
from SIM swap fraud, the need for wireless providers to be able to choose the most effective method of
quickly alerting customers so that customers can take action to mitigate harm, and the importance of
providers adopting new forms of notification.
39. We also decline to prescribe particular content or wording of SIM change notifications,
recognizing that wireless providers are in the best position to determine what will most effectively notify
customers of SIM change requests and potential fraud and will need to tailor notifications to customers’
service plans and circumstances.152 Nevertheless, consistent with the record and our CPNI rules, we
specify that such notifications must use clear and concise language that provides sufficient information to
effectively inform a customer that a SIM change request involving the customer’s SIM was made.153 We
observe that our rule does not prohibit wireless providers from using different content and wording for
notifications depending on a provider’s risk assessment of a given SIM change request, so long as the
notification uses clear and concise language and is reasonably designed to reach the actual customer.154
40. We further decline to require a delay for customer verification or acknowledgement in
connection with notifications prior to completing a SIM change request. In the SIM Swap and Port-Out
Fraud Notice, we sought comment on whether we should require a 24-hour delay (or other period of time)
before a wireless provider effectuates a SIM change while notifying the customer via text message, email,
the provider’s app, or push notification, and requesting verification of the request.155 This approach
received minimal support in the record,156 and we are convinced by other record evidence that the burdens
(Continued from previous page)
the method of customer notification “should be flexible and reflect customers’ preferences”); AT&T Comments at
11 (noting that “[c]ustomer needs also vary. AT&T provides customers a range of products and services to meet
different wireless communications needs. The diverse characteristics of these customers and the products and
services they utilize lend themselves to different risk-management approaches.”).
150 Such methods include, but are not limited to, live or automated telephone calls, text messages, emails, or push
notification through wireless provider software applications. See, e.g., Verizon Comments at 6 (“Providers also
should have discretion to use a push notification together with supplemental verification methods to stop a high risk
transaction.”).
151 47 CFR § 64.2010(f). We seek comment in the Further Notice on whether we should harmonize our CPNI rules
with the SIM change rules we adopt today, including for notifications.
152 T-Mobile Comments at 10 (asserting that the “the exact language should be customizable by the carrier to
account for the type of request, brand, product, and other factors”); see also Verizon Comments at 6 (“Prescriptive
rules for the content . . . of the notification are unnecessary.”).
153 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14133, para. 34 (seeking comment on a notification
requirement); Appx. A (47 CFR § 64.2010(h)(3)). Cf. 47 CFR § 64.2008(c) (stating the CPNI notices must be
comprehensible); T-Mobile Comments at 10 (asserting that notifications should be “clear and specific”).
154 See AT&T Comments at 15 (describing AT&T’s existing risk-based approach for providing SIM change
notifications).
155 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14134, para. 37.
156 See, e.g., Robert Ross Comments at 1; DC Stone Comments (Express); see also Prove Comments at 6-7
(suggesting that a short delay may be appropriate to allow customers to terminate a SIM change request but arguing
against a long delay because it would “impose unnecessary inconveniences and costs on consumers”); T-Mobile
Comments at 10 (explaining that notifications of SIM change requests could seek verification from customers but
(continued….)
26
Federal Communications Commission FCC 23-95
of delay and verification requirements outweigh the benefits, particularly given how regularly customers
seek legitimate SIM changes. For instance, CTIA explains that a blanket delay would “make it
exceedingly difficult for a consumer to obtain a new phone and continued service when a device breaks or
is lost, representing a full day where that consumer could not rely on their wireless service for . . .
‘keeping in touch with friends through voice calls and text messages’ [and] placing life-saving public
safety calls.”157 AT&T and T-Mobile echoed these concerns.158 We also anticipate that the
authentication, notification, and remediation requirements we adopt today will sufficiently mitigate
fraudulent SIM change requests without the need for a burdensome delay and verification process. While
we do not require wireless providers to implement a delay and verification process, we permit them to do
so in instances when they determine these measures are necessary to protect against fraud,159 but stress
that this process should not be used to delay legitimate SIM change requests.
4. Account Locks for SIM Changes
41. We require wireless providers to offer all customers, at no cost, the option to lock or
freeze their account to stop SIM changes.160 We anticipate that this requirement will provide customers
with more consistent and meaningful protection against SIM swap fraud, and this expectation is supported
by the record, which reflects that account locks can be powerful tools against SIM swap fraud,
particularly for customers that are at high-risk of being a target of the practice.161
(Continued from previous page)
also arguing that carriers should be permitted to process requests if it does not receive a response within a certain
amount of time).
157 CTIA Comments at 9 (cleaned up).
158 AT&T Comments at 17-18 (“[F]orcing a customer with a lost, stolen, or damaged phone to wait 24 hours (or just
a few hours for that matter) before obtaining an active replacement would at best frustrate the consumer . . ., and, at
worst, threaten the customer’s safety and impair her ability to engage in commerce, work, and education.”); T-
Mobile Comments at 9 (“A 24-hour delay could cause hardship for customers with legitimate reasons to request the
swap, such as a lost, stolen, or damaged phone.”).
159 CTIA Comments at 9 (asserting that a delay “may be appropriate in some situations and could help to prevent
fraud while balancing important service goals” and that “the Commission should clarify that providers have
flexibility to implement such delays as appropriate to address the unique circumstances of any given request or
consumer”); T-Mobile Comments at 9 (explaining that verification “would help provide increased security for
customers” in some circumstances).
160 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14135, para. 39. We adopt our proposal that account
locks must be offered to all customers at no cost because we find that a customer’s financial means should not
dictate their access to this enhanced security measure, particularly since customers with lesser financial means may
suffer the greatest consequences of SIM swap fraud. This requirement is consistent with other Commission rules
governing preferred carrier freezes for Local Exchange Carriers, see 47 CFR § 64.1190, as well as the requirements
adopted for port-out locks, infra section III.B.3. To simplify the ability for customers to take advantage of account
locks for SIM changes and number ports, we encourage wireless carriers to offer customers the ability to activate
both locks in one step.
161 See BPI/BITS Comments at 3-4 (supporting “the FCC’s suggestion to place control of the ability to manage SIM
changes requested by telephone and/or online access in the hands of the consumer, likely on their very device” and
arguing that “this consumer-managed protection is an additional layer of security”); DC Stone Comments (Express)
at 1 (arguing that the Commission should “[r]equire that account freezes be made available for any consumer phone
account” as “an effective tool for concerned or savvy consumers to prevent unauthorized account activity and
especially fraud, just as with credit reporting agencies”); NCLC/EPIC Comments at 11 (explaining that the ability to
lock one’s own account “may provide meaningful protections” and “is an excellent way for an individual consumer
to guard against fraud”); but see AT&T Comments at 17 (stating that “[a]ccount locks can be an effective tool to
increase the security of customer accounts on occasion,” but opposing that carriers be required to offer them in all
instances).
27
Federal Communications Commission FCC 23-95
42. Like the other rules we adopt today, we give wireless providers flexibility on how to
comply with this measure. In particular, the record does not evince a need for us to prescribe a method or
methods for customers to unlock their accounts or impose a waiting period before an unlocked account
can be transferred, and as such, we decline to do so at this time. We do require, however, that the process
to activate and deactivate an account lock must not be unduly burdensome for customers such that it
effectively inhibits them from implementing their choice.162 Additionally, we stress that when activated,
wireless providers must not fulfill SIM change requests until the customer deactivates the lock,163 except
to the extent otherwise required by the Safe Connections Act or the Commission’s rules implementing
that statute.164 We find that the account lock requirement is technically feasible, particularly given
evidence that some wireless providers already offer this feature to customers.165 Additionally, we are
unpersuaded by AT&T’s claim that “building a system that is capable of widespread adoption of [account
locks] would entail significant carrier costs and time for questionable gain.”166 We anticipate that because
of these existing account lock offerings and the flexible approach we take, the rule will not be unduly
costly for wireless providers to implement, and that to the extent there are costs associated with the
requirement, they are outweighed by the associated benefits of preventing fraudulent activity.
43. Consistent with this flexible approach, we permit wireless providers to proactively
initiate a SIM swap lock on a customer’s account when a provider believes the customer may be at high
risk of fraud. We are persuaded by T-Mobile’s assertion that such capability is valuable because wireless
providers are sometimes positioned to know when a customer is at high risk of SIM swap fraud and that
this tool allows them to help customers secure their accounts.167 However, we require that wireless
providers promptly provide clear notification to the customer that the lock has been activated with
instructions on how the customer can deactivate the account lock if the customer chooses, and to
promptly comply with the customer’s legitimate request to deactivate the account lock.168 We also
162 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14135, para. 39.
163 Id.
164 See 47 U.S.C. § 345(b)(2) (prohibiting carriers from making valid line separation requests from survivors of
domestic violence contingent on any requirement or limitation); Safe Connections Order, FCC 23-96, at para. 76
and Appx. A (new 47 CFR § 64.6402(l)) (requiring a covered provider to effectuate a legitimate line separation
request, and any associated number port and SIM change requests, regardless of whether an account lock is activated
on the account); id. at Appx. A (new 47 CFR § 64.6402(k)) (requiring that as soon as feasible after receiving a
legitimate line separation request from a survivor, a covered provider shall lock the account affected by the line
separation request to prevent all SIM changes, number ports, and line cancellations other than those requested as
part of the line separation request pursuant to 47 U.S.C. § 345 and the Commission’s rules until the request is
processed or denied).
165 See T-Mobile Comments at 4 (“[F]or most types of customers, T-Mobile can institute a ‘SIM change block’ that
helps protect the customer’s SIM from being used in other devices.”); NCTA Comments at 4-5 (“Wireless providers
already engage in many [measures to prevent to prevent SIM swap and port-out fraud] today, including . . .
providing the ability to lock or freeze wireless accounts.”); CTIA Reply at 26-27 (“The record demonstrates that
absent a requirement, many providers already offer account freeze options to their customers.”); CCA Comments at
3-4 (describing T-Mobile’s free service called “Account Takeover Protection” which “blocks unauthorized users
from porting numbers and allows only the billing responsible party to turn the feature off”); see also Verizon,
Additional Support Information, https://www.verizon.com/support/port-out-faqs/#setup-freeze (last visited Oct. 18,
2023) (offering a “Number Lock” service that is a customer-managed porting freeze option accessible by dialing
611 or through the MyVerizon app); T-Mobile, Account Takeover Protection by T-Mobile, https://www.t-
mobile.com/support/plans-features/account-takeover-protection (last visited Oct. 18, 2023) (providing information
on account its Account Takeover Protection feature, which “adds additional security to your account by blocking
unauthorized users from transferring your lines to another wireless carrier”).
166 AT&T Comments at 17.
167 See T-Mobile Comments at 2, 4.
168 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14135, para. 39.
28
Federal Communications Commission FCC 23-95
caution wireless providers that any proactive initiation of a SIM change lock must be limited in duration
and extend only so long as the high risk of fraud is evident to the provider. In establishing this limitation,
we intend to prohibit wireless provider abuse of SIM change locks to avoid, among other outcomes,
preventing the customer from terminating service with the provider or moving to another competing
provider.
44. Given the protection that account locks can provide to customers, we conclude that it
should be offered to customers of both pre-paid and post-paid services.169 We are unpersuaded by
AT&T’s assertion that pre-paid service is not amenable to account locks because “[s]ome prepaid
customers provide little personal information when they activate their account,” which could make it
difficult to authenticate a customer to unlock an account.170 Because the account lock is an optional
security measure for customers, wireless providers can, if necessary, require customers to provide
information to use for authentication purposes to activate the account lock.
45. We also disagree with AT&T that an account lock option “should remain a tool that
carriers can choose, but are not required, to offer.”171 AT&T acknowledges that “[a]ccount locks can be
an effective tool to increase the security of customer accounts on occasion,” but it suggests that because
“they are not needed to manage the risk of fraud in every case and for every customer,” wireless providers
should not be required to offer them to all customers.172 While AT&T’s approach would leave the choice
of whether an account lock is necessary exclusively in the hands of wireless providers, we conclude this
choice should be placed principally in the hands of the customer,173 the party that is potentially at risk for
SIM swap fraud, and therefore we require providers to offer the option to all customers. Likewise,
AT&T’s concern that “an account lock can be a source of friction” even for a postpaid customer when the
“customer forgets having placed the freeze on the account or dislikes the efforts needed to unfreeze the
account”174 is not, we conclude, a valid basis for declining to require that wireless providers offer SIM
change locks. The benefits of this account security measure outweigh any potential friction, and we
expect that wireless providers can take steps to mitigate any such friction if they choose, such as by
providing customers with periodic reminders that they have activated the account lock and on how they
can deactivate the lock.175 We are also unconvinced by comments claiming that SIM change locks may
169 DC Stone Comments (Express) at 1 (arguing that account locks must be available for any customer account,
including pre-paid accounts); cf. Verizon Comments at 4 (“A service provider will have limited information about
the prepaid customer, and in many cases, about the customer’s device. Even so, Verizon only allows authentication
using reliable, available methods, and has begun integrating systems used for postpaid customers to further align and
improve our methods to prevent . . . fraudulent activity.”).
170 AT&T Comments at 17; see also CTIA Comments at 15 (asserting that account locks “may negatively impact
pre-paid customers whose devices are lost or stolen, as the pre-paid market offers consumers the option to purchase
service with less identifiable information than post-paid, and thus information that may be necessary to deactivate a
freeze may not have been provided when an account is initialized. Thus this may limit a consumer’s ability to
remove a freeze and validate an account where the consumer does not have a working device.”).
171 AT&T Comments at 17; see also CTIA Reply at 26-27 (arguing that “the Commission should allow wireless
providers the flexibility to facilitate choice and competition for all customers when it comes to account freezes” and
not require providers to offer account locks).
172 AT&T Comments at 17.
173 See BPI/BITS Comments at 3-4 (expressing support for requiring carriers to offer account locks because it
“place[s] control of the ability to manage SIM changes requested by telephone and/or online access in the hands of
the consumer”).
174 AT&T Comments at 17.
175 Because of the authentication challenges for pre-paid customers and the potential friction for customers who may
not want SIM changes to be more difficult, we decline to require account locks be activated by default, on an opt-out
basis, as BPI/BITS suggests. BPI/BITS Comments at 3-4.
29
Federal Communications Commission FCC 23-95
be of limited value to customers.176 This requirement empowers high-risk and security-minded customers
to enable additional protections beyond the enhanced authentication requirements and other security
measures we adopt today, and it need not be activated by a large percentage of customers for it to be
valuable.
5. Tracking Effectiveness of SIM Change Protection Measures
46. We require wireless providers to establish processes to reasonably track and maintain
information regarding SIM change requests and their authentication measures, and to retain that
information for a minimum of three years.177 We agree with the Princeton University researchers that a
tracking requirement will equip wireless providers “to measure the effectiveness of their customer
authentication and account protection measures,”178 and find that they would not otherwise be able to do
so effectively without collecting such information. Consistent with recommendations in the record by the
Princeton University researchers, we specifically require wireless providers to collect and maintain the
following information regarding SIM change requests and authentication measures: the total number of
SIM change requests, the number of successful SIM changes requests, the number of failed SIM change
requests, the number of successful fraudulent SIM change requests, the average time to remediate a
fraudulent SIM change, the total number of complaints received regarding fraudulent SIM changes, the
authentication measures the wireless provider has implemented, and when those authentication measures
change.179 We also strongly encourage them to collect and retain any additional information that will help
them measure the effectiveness of their customer authentication and account protection measures. We
find that the three-year retention period is appropriate because it allows providers to track the
effectiveness of their measures over time and ensures the information is available for a sufficient time
should the Commission request it for review.
47. We disagree with CTIA’s assertions that a recordkeeping requirement will divert
resources from combating incidences of SIM swap fraud.180 Instead we find that this data tracking
requirement is critical to wireless providers’ efforts to keep ahead of evolving fraud techniques. And the
record reflects that some wireless providers already track and analyze information regarding SIM swap
fraud and their account protection measures to improve those measures,181 indicating that this is a
176 NCLC/EPIC Comments at 11-12 (“Disclosures and the ability to freeze one’s account are valuable only to those
consumers who are savvy enough to a) understand the dynamics involved in freezing, b) understand that the benefits
of freezing outweigh the extra burdens imposed (such as requiring that the consumer go through a series of steps to
unfreeze the account, and c) actually follow through and freeze one’s account.”); Verizon Comments at 5 (“[A]n
account freeze or lock may be superfluous or of limited interest to consumers given the corresponding need for
rigorous authentication to remove the freeze or lock.”).
177 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14136, para. 43 (seeking comment on whether to
require carriers to track data regarding SIM swap complaints).
178 See Princeton Comments at 12; see also CTIA Nov. 8, 2023 Ex Parte Letter at 9-10 (requesting that we modify
the recordkeeping requirements to incorporate a reasonableness standard on the basis that such a change will still
permit the FCC to accomplish its goals while recognizing that providers may not be able to accurately capture all the
information required in every instance); CCA Nov. 9. 2023 Ex Parte Letter at 2 (same).
179 See id.The requirement that wireless providers collect and maintain information regarding when authentication
measures change simply means that providers must track the introduction and removal of such measures, and not
updates or refinements to existing measures.
180 CTIA Reply at 24-25 (“Others call for overly onerous reporting and recordkeeping requirements. These types of
rules would require wireless providers to divert resources from protecting customers to looking in the rearview
mirror.”).
181 See AT&T Comments at 2 & 7-8 (indicating that it has tracked the total instances of SIM swap fraud and that it
“continually assesses the effectiveness of its countermeasures and refines them over time as needed”); T-Mobile
Comments at 6 (“T-Mobile engages in ongoing, proactive threat evaluation, and information collection on threats
(continued….)
30
Federal Communications Commission FCC 23-95
practical and cost-effective practice. Thus, while we recognize that this recordkeeping requirement may
not be without cost, particularly for wireless providers who do not already collect such information, we
find that the benefits of this requirement far exceed any potential costs.
48. We agree with CTIA that the data tracking and retention requirements should only be
prospective in nature,182 and as such, we make clear that our rule does not obligate wireless providers to
research and collect historic data. We conclude that including historic data in the data tracking
requirements we adopt would be burdensome, or even impossible, for small wireless providers and those
who do not already track this information.183
49. We decline to adopt reporting and audit requirements in conjunction with our data
tracking requirement,184 but we do require wireless providers to make the information they collect
available to the Commission upon request.185 Although regular reporting and audit requirements can
improve wireless provider incentives and accountability, we do not find that such measures are necessary
at this time in light of the other measures we adopt today and providers’ ongoing commitment to be
vigilant in combating fraud.186 We maintain the ability to obtain collected information from wireless
providers as needed, not only as a potential tool to evaluate whether providers are implementing sufficient
measures to address SIM swap fraud, but also to evaluate whether the specific requirements we adopt
today continue to be effective or in need of updates to address the evolution of fraud techniques.
Consequently, we find that there are insufficient benefits of a regular reporting requirement to outweigh
the potential costs.
6. Safeguards on Employee Access to CPNI
50. We require wireless providers to establish safeguards and processes so that employees
who receive inbound customer communications are unable to access CPNI in the course of that customer
interaction until after a customer has been properly authenticated.187 We find, based on the record before
(Continued from previous page)
and fraud for internal purposes.”); CTIA Reply at 1 (stating that its members report tracking the number of
legitimate SIM swaps).
182 Compare CTIA Reply at 24-25 (explaining that if the Commission adopts recordkeeping requirements, it should
be prospective) with Princeton Comments at 12 (“We encourage the Commission to also consider collecting a
limited amount of historical data on SIM swaps and port-outs, to understand how trends in customer use and
fraudulent activity are affected by changes in authentication requirements.”).
183 See, e.g., CTIA Reply at 25.
184 See Princeton Comments at 12 (suggesting that carriers should be required to track and report information on
SIM swap and port-out fraud to the Commission); NCLC/EPIC Comments at 6 (arguing that carriers should include
information regarding SIM swap and port-out fraud in annual reports to the Commission); Robert Ross Comments at
8 (arguing that “[c]arriers must be required to report all SIM swaps and Port-outs on a monthly basis to the FCC”
and undergo annual independent audits).
185 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14136, para. 43. Because the information we require
wireless providers to collect does not include personally identifiable information (PII) or CPNI, wireless providers
will not be required to provide PII or CPNI in response to Commission requests for this information, but the
Enforcement Bureau may request PII or CPNI in the course of a specific investigation.
186 AT&T Comments at 1 (“AT&T is committed to protecting its customers and deterring bad actors intent on
misusing processes designed for consumer benefit to inflict harm.”); T-Mobile Comments at 8 (“T-Mobile remains
vigilant in its efforts to evolve its safeguards to prevent fraud.”); CTIA Comments at 3 (“The wireless industry and
the Commission share the goal of protecting consumers from fraud—full stop.”).
187 See Appx. A (revised 47 CFR § 64.2010(h)(1)); SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14134,
para. 38 (seeking comment on whether the Commission should “require carriers to modify customer record systems
so that customer service representatives are unable to access CPNI until after the customer has been properly
authenticated”); see also Letter from Glenn S. Richards, Counsel for Voice on the Net Coalition (VON), to Marlene
H. Dortch, Secretary, FCC, WC Docket No. 21-341 (filed Nov. 7, 2023) (VON Nov. 7, 2023 Ex Parte Letter)
(continued….)
31
Federal Communications Commission FCC 23-95
us, that requiring wireless providers to limit access to CPNI by employees who receive inbound customer
communications until after the customer has been properly authenticated will help to minimize the
incidences of SIM swap fraud by preventing customer service representatives from inadvertently or
intentionally assisting bad actors in fraudulent schemes.188 We are persuaded that, even with the customer
service representative training requirements we adopt today,189 allowing employees who receive inbound
customer communications to access CPNI prior to proper authentication of the customer is unnecessary
and possibly “invites adversaries to exploit sympathetic, inattentive, or malicious customer service
representatives for account access.”190 While we anticipate that employees will comply with training
requirements in good faith, “[t]here should be no opportunity for a representative to give a hint or a free
pass” that will help bad actors commit fraud.191 We therefore conclude that requiring wireless providers
to establish safeguards and processes so that employees who receive inbound customer communications
are unable to access CPNI in the course of that customer interaction until after the customer has been
properly authenticated—“a straightforward fix”192 and standard data security best practice193—will
provide meaningful protection in helping to combat SIM swap fraud.194 We find that the benefits of this
requirement outweigh any potential costs, and that any such costs will be mitigated by allowing
telecommunications carriers flexibility to determine the particular safeguards and processes that will
prevent employees who receive inbound customer communications from accessing CPNI in the course of
that customer interaction until after a customer has been properly authenticated. Below, we seek
comment on whether to require all telecommunications carriers to limit access to CPNI by employees
(Continued from previous page)
(recommending that the Commission make clear that its rule regarding employee access to CPNI apply only to
inbound customer support requests to ensure that technical support personal, customer success managers, and other
support personnel have appropriate access to support the communications service); CTIA Nov. 8, 2023 Ex Parte
Letter at 5 (encouraging the FCC to make clear that the employee access limitations apply to employees who are
interacting directly with a customer in the course of that interaction, raising concerns that a broader application
could be read to prevent providers’ employees from accessing CPNI outside the context of a direct customer
interaction); CCA Nov. 9. 2023 Ex Parte Letter at 2 (similar); Letter from Jill Canfield, General Counsel, VP of
Policy, NTCA, to Marlene H. Dortch, Secretary, FCC, WC Docket No. 21-341, at 1-2 (filed Nov. 8, 2023) (NTCA
Nov. 8, 2023 Ex Parte Letter) (similar).
188 See, e.g., Princeton Comments at 8; NCLC/EPIC Comments at 8-9.
189 See infra section III.C (establishing requirements that carriers develop and implement training for customer
service representatives to specifically address fraudulent SIM change and port-out attempts, complaints, and
remediation).
190 Princeton Comments at 9.
191 Id.
192 Id.
193 See, e.g., NCLC/EPIC Comments at 8-9 (explaining that minimizing access to and retention of customer data is a
security best practice); Princeton Comments at 7-8 (explaining that access to CPNI prior to authorization “is an
unnecessary exposure of customer data and a violation of the information security principle of minimizing system
permissions”); Protecting Personal Information: A Guide for Business, Federal Trade Commission,
https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business (last updated
October 2016) (“Scale down access to data. Follow the ‘principle of least privilege.’ That means each employee
should have access only to those resources needed to do their particular job.”).
194 CTIA asserts that applying this rule “represents a sea change in the Commission’s historical approach of
prohibiting only disclosure of CPNI prior to authentication that was not clearly or adequately raised” in the NPRM.
CTIA Nov. 8, 2023 Ex Parte Letter at 5. We disagree. The Commission specifically sought comment on whether it
should “require carriers to modify customer record systems so that customer service representatives are unable to
access CPNI until after the customer has been properly authenticated.” SIM Swap and Port-Out Fraud Notice, 36
FCC Rcd at 14134, para. 38.
32
Federal Communications Commission FCC 23-95
who receive inbound customer communications until after the customer has been properly authenticated
to minimize customer account fraud.195
51. We decline to adopt other suggested employee safeguards that are overly prescriptive and
for which the costs outweigh the benefits. In the SIM Swap and Port-Out Fraud Notice we sought
comment on other ways to avoid employee malfeasance, such as requiring two employees to sign off on
every SIM change.196 Although we anticipate that two-employee sign off could be an effective account
protection mechanism and encourage wireless providers to use this procedure when appropriate,197 we are
persuaded by AT&T’s argument that requiring this procedure for every SIM change would be a
significant burden on legitimate SIM change requests given the uncertainty regarding whether it would
prevent SIM swap fraud in most instances,198 and therefore decline to adopt it. We also reject several
other requirements proposed in the record concerning customer service representatives who perform SIM
changes. Specifically, a mandate that employees who perform SIM swaps be subject to enhanced
background checks199 may be financially and practically infeasible for large and small wireless providers
alike, and could create an incentive for providers to reduce the number of employees capable of
performing SIM changes, which would slow the processing of legitimate changes. Requiring employees
to swipe a company badge when entering secure facilities is a good practice that we encourage wireless
providers to adopt,200 but the record does not address how this requirement would serve to prevent SIM
swap fraud. The proposal to require employees to sign a restrictive confidentiality agreement is faulty for
the same reason.201 Moreover, a proposed restriction on use of performance incentives202 is overly broad,
could stifle competition, and might prevent customers from accessing special offers. Finally, we decline
to adopt a proposal that wireless providers “be required to have heightened SIM swap customer care
during [weekends and evenings].”203 We find that providers are best positioned to implement procedures
tailored to the level of risk at any given time and should have the flexibility to adjust their practices to
address the evolving nature of fraudulent activity.
195 See infra para. 202; see also SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14137, para. 46 (“We seek
comment on whether any heightened authentication measures required (or prohibited) should apply for access to all
CPNI, or only in cases where SIM change requests are being made.”); Letter from Steven F. Morris, Vice President
& Deputy General Counsel, NCTA – The Internet & Television Association, and Josh Bercu, Vice President, Policy
and Advocacy, USTelecom – The Broadband Association, to Marlene H. Dortch, Secretary, FCC, WC Docket No.
21-341 et al., at 2 (filed Nov. 7, 2023) (requesting that the Commission solicit additional comment on whether to
apply the limits on employee access to CPNI to wireline providers).
196 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14134, para. 38.
197 Verizon Comments at 3 (“Two-employee sign-off can be appropriate in circumstances when other authentication
methods are unavailable, and Verizon trains select employees to assist customers this way.”).
198 AT&T Comments at 18 (“Such a step would be time-intensive, increasing the length of the SIM swap process,
and would remain susceptible to social engineering and collusion. Also, it is unclear how the second employee
would evaluate the transaction separately from the first employee, or what would happen if, as can occur, a second
employee is not available. Last, the frequency (and thus sheer number) of legitimate SIM changes makes this
suggestion infeasible in practice.”).
199 Robert Ross Comments at 7.
200 Id.
201 Id.
202 Id.
203 Id. at 8 (“SIM swappers come out on weekends and evenings when they know that customer service at mobile
carriers, banks and cryptocurrency exchanges are closed. Carriers must be required to have heightened SIM swap
customer care during these times.”).
33
Federal Communications Commission FCC 23-95
7. Telecommunications Carriers’ Duty to Protect CPNI
52. While the record shows that some wireless providers have implemented CPNI security
practices beyond those required by current rules,204 SIM swap fraud persists. We are also concerned that
some wireless providers may view the protection measures we adopt today as sufficient, rather than
baseline, protections against SIM swap fraud. To ensure that wireless providers adapt their security
practices on an ongoing basis to address evolving techniques used by bad actors to commit SIM swap
fraud,205 we take this opportunity to remind all telecommunications carriers of their statutory duty to
“protect the confidentiality of proprietary information of, and relating to . . . customers,”206 and their
continuing preexisting legal obligation to “take reasonable measures to discover and protect against
attempts to gain unauthorized access to CPNI.”207 Consistent with the Commission’s approach in the
2007 CPNI Order,208 we conclude that these existing legal obligations necessarily obligate
telecommunications carriers to proactively and regularly review and monitor their policies and procedures
to ensure that they continue to be effective at addressing evolving fraud techniques against customer
accounts and services—including SIM swap and port-out fraud209—and to conduct analyses of fraud
incidents to determine how the fraud occurred and implement measures to prevent such tactics from being
successful again in the future.210
B. Strengthening the Commission’s Number Porting Rules to Protect Consumers
53. Given the potential for consumer harm from port-out fraud, we conclude that the time is
ripe to strengthen our number porting rules with baseline measures to increase the protections for
customers against fraudulent port-outs. As with our new SIM change rules, the backbone of our new
204 See, e.g., AT&T Comments at 4-7 (explaining that “AT&T employs a diverse set of measures to help thwart
these bad actors – above and beyond existing regulatory requirements and those proposed in the NPRM,” including
scanning an in-store customer’s ID with technology to verify its authenticity, utilizing data analytics to assess a
customer’s risk for fraud, and conducting customer education); Better Identity Coalition at 4 (“Notably, two major
mobile network operators (MNOs) already support FIDO authentication for their customers, meaning that it is
widely used in customer-facing accounts today.”); T-Mobile Comments at 6 (“T-Mobile participates in efforts with
other stakeholders to address verification issues and stay at the cutting edge of fraud risk management.”).
205 See Verizon Comments at 1-2, 5; AT&T Comments at 2 & 11; CCA Comments at 4-5; CTIA Comments at 10-
11; CTIA Reply at 15-16; Verizon Comments at 5; Somos Comments at 2.
206 47 U.S.C. § 222(a).
207 47 CFR § 64.2010(a); see also NCLC/EPIC Comments at 9 (“Providers must take affirmative measures to
discover and protect against fraudulent activity beyond what is specifically dictated by the Commission’s rules.”).
208 2007 CPNI Order, 22 FCC Rcd at 6945-46, paras. 33 & 35 (making clear that the adoption of rules designed to
protect against pretexting “does not relieve carriers of their fundamental duty to remain vigilant in their protection of
CPNI” and expressing the Commission’s “expectation that carriers will take affirmative measures to discover and
protect against activity that is indicative of pretexting beyond what is required by the Commission’s current rules”).
209 See, e.g., AT&T Comments at 7 (“AT&T’s suite of tools is not static. AT&T continually assesses the
effectiveness of its countermeasures and refines them over time as needed.”); T-Mobile Comments at 6 (“T-Mobile
engages in ongoing, proactive threat evaluation, and information collection on threats and fraud for internal
purposes. For example, T-Mobile gathers and acts on threat intelligence about cybercriminals potentially targeting
wireless carriers and customers, conducts penetration tests of our systems, and engages stakeholders to understand
emerging attack patterns. Further, as bad actors pivot to new methods and the account takeover fraud landscape
changes, T-Mobile implements new strategies to address both known and potential fraud techniques.”).
210 See AT&T Comments at 7 (“AT&T conducts routine forensic analysis of unauthorized SIM swaps and port-outs
to assess the root cause and evaluate whether new or different countermeasures are appropriate to enhance security.
This assessment has resulted in process changes, implementation of new security procedures, and more to guard
against threats.”); NCLC/EPIC Comments at 6 (arguing that upon being notified of fraud, carriers should establish
“[a] detailed explanation of the fraud, along with an analysis of what measures the provider has taken to prevent a
repeat of this breach”).
34
Federal Communications Commission FCC 23-95
number porting rules is a requirement that wireless providers use secure methods to authenticate
customers that are reasonably designed to confirm a customer’s identity prior to effectuating number
ports, and we also require wireless providers to notify customers of port-out requests and allow customers
to lock their accounts to prevent port-outs.211 To future-proof our requirements, we give wireless
providers flexibility in how to implement them. We anticipate that these new rules will work together to
provide meaningful protection to customers while preserving the efficient and effective processing of
port-out requests that promotes customer choice and competition. As with our new SIM change rules, we
apply these new requirements exclusively to providers of CMRS, as defined in section 20.3 of Title 47 of
the Code of Federal Regulations,212 including resellers of CMRS, as the record shows that port-out fraud
is focused on mobile wireless customers.213 We likewise require wireless providers to implement these
rules with respect to customers of both pre-paid and postpaid services.214
1. Customer Authentication Requirements
54. We revise our porting rules to require that wireless providers use secure methods to
authenticate customers that are reasonably designed to confirm a customer’s identity before completing a
port-out request,215 except to the extent otherwise required by the Safe Connections Act or the
Commission’s rules implementing that statute.216 Consistent with our new SIM change authentication
rules,217 we require wireless providers to regularly, but not less than annually, review and, as necessary,
update their customer authentication methods to ensure those methods continue to be secure.218
55. As in the SIM change context, we are persuaded by commenters that a general security
authentication standard will best allow wireless providers the flexibility to respond to advances in the
technology and tactics used by bad actors, providing the greatest protection for customers, and enabling
providers to implement authentication methods in ways that work best for the particular services they
offer.219 The record reflects that the benefits of allowing wireless providers to determine the best method
211 See Appx. A (adding 47 CFR § 52.37).
212 See supra para. 25.
213 See, e.g., AT&T Comments at 1 (noting that “SIM swaps and port-outs are, in short, integral features of the
competitive wireless marketplace”); CCA Comments at 1 (explaining that port-out fraud is a method malicious
actors use to steal mobile accounts); CTIA Comments at 1-2 (discussing port-out fraud exclusively in the context of
wireless services); NCLC/EPIC Comments at 2 (noting that “American cell phone users . . . are extremely
vulnerable to having their telephone numbers hijacked by fraudsters through the process of SIM swapping and port-
out fraud”); NCTA Comments at 1 (explaining that with port-out fraud, a bad actor “ports the customer’s mobile
phone number to the account with the new carrier controlled by the bad actor”).
214 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14141, para. 55.
215 See id. at 14139-41, paras. 53-56 (seeking comment on whether and how to authenticate customers for port-out
requests).
216 The Safe Connections Act prohibits wireless providers from making a line separation contingent on a prohibition
or limitation on number portability, provided such portability is technically feasible. 47 U.S.C. § 345(b)(2)(D). The
Commission’s rules adopted today implementing the Safe Connections Act require covered providers to attempt to
authenticate, using multiple authentication methods if necessary, that a survivor requesting a line separation is a user
of a specific line or lines. See Safe Connections Order, FCC 23-96, at para. 52. Covered providers must use
methods that are reasonably designed to confirm the survivor is actually a user of the specified line(s) on the account
when the survivor is not the primary account holder or a designated user. See id. To the extent this requirement
differs from other authentication requirements, including those in 47 CFR § 64.2010, the line separation
authentication requirements the Commission adopts to implement 47 U.S.C. § 345 serve as an exception to those
other requirements. See id.
217 See supra para. 27.
218 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14132, para. 27 (seeking comment on whether we
should adopt a flexible standard requiring heightened authentication measures for SIM swap requests).
35
Federal Communications Commission FCC 23-95
for authenticating customers outweigh speculative concerns that absent standardized authentication
methods, nationwide providers could arbitrarily determine which authentication methods or controls are
sufficient before effectuating ports.220 We also agree with CCA that our approach will better serve small
wireless providers by permitting them to “use technologies that are reasonably available and have choice
in the approach to take in authenticating their customers.”221 Additionally, as we concluded with regard to
authentication for SIM changes, this flexible approach should resolve concerns about authenticating
customers of pre-paid accounts.222
56. We are mindful of the potential effect on competition of our new customer authentication
requirements, and thus, we require that the secure authentication methods wireless providers adopt
accommodate the needs of the broad spectrum of customers they may serve, including those who do not
have data plans or data-enabled devices, have varying degrees of technological literacy, or have
disabilities or accommodation needs.223 To illustrate, we observe that wireless providers may find
(Continued from previous page)
219 See supra para. 29 (finding that in the SIM change context, readily available biographical information, account
information, recent payment information, and call detail information do not constitute secure methods of
authentication); 47 CFR § 64.2010(b).
220 Compare T-Mobile Comments at 12-13 (stating that “flexibility to offer various secure methods of customer
authentication . . . will promote innovation and improved security for customers”); CTIA Reply at 15-16
(“Flexibility is a critical attribute in any authentication standard: it will help prevent authentication practices from
lagging behind bad actor tactics, it will facilitate continued improvements in authentication practices, and it will help
providers be able to continue to meet customer needs.”); CCA Comments at 5 (explaining that flexibility will allow
carriers to adopt future authentication technologies that “prove[] to be more effective or secure than today’s
technologies”); Princeton Comments at 4 (“We strongly agree that the Commission’s customer authentication rules
should not be technically prescriptive. Authentication methods and security practices continue to evolve, and
carriers should be welcome—and encouraged—to adopt innovative safeguards.”); Verizon Comments at 10-11
(“[P]roviders should retain the flexibility they enjoy today to nimbly adopt new authentication safeguards to stay
ahead of bad actors.”); with RWA Comments at 12-13 (raising concerns that without a “set of uniform
authentication standards” nationwide carriers could “arbitrarily determine which authentication methods or controls
are sufficient” thereby potentially increasing costs, creating “barriers for small and rural providers,” or allowing
nationwide carriers to “refuse ports from smaller providers deemed ‘unsecure’”). We note also that under the Act
and our existing rules, all carriers are required to complete legitimate ports, see supra para. 14, and that our new
customer authentication requirements do not give carriers the authority to make determinations about the sufficiency
of another carrier’s authentication methods—that responsibility will belong to the Commission, and we will address
any concerns regarding the adequacy of authentication methods, as well as inappropriate port denials, as needed.
221 CCA Comments at 5 (“The Commission should also keep in mind the constraints with which many small carriers
operate against in adopting security measures. Smaller carriers may have more limited app or e-commerce
platforms, and may not currently have the capability, for example, to generate a one-time port out PIN via an app on
a 24/7/365 basis.”); but see ID.me Comments at 6-7 (describing its 530 commercial partners, many of which are
“smaller businesses with smaller use cases” and asserting that “[c]omplying with NIST guidelines does not pose any
difficulties for smaller providers when the integration is enabled by a turnkey, SaaS, credential service provider
operating with open protocols”).
222 See CTIA Comments at 14-15 (noting that “fighting fraud in the pre-paid context is different than in the post-paid
context” and that “providers ordinarily do not collect or have detailed identity information for pre-paid customers”);
T-Mobile Comments at 8 (stating that “[p]repaid service generally does not require identity validation for account
set-up”); CCA Comments at 6 (noting that pre-paid customers “often do not provide an accurate address or other
identifying information, making it difficult for carriers to authenticate an account request”); CTIA Comments at 19-
20 (noting that a flexible approach will better serve customers, including pre-paid customers).
223 See SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14139-41, paras. 53-56 (seeking comment on
customer authentication requirements); NCLC/EPIC Comments at 8 (recognizing that “online authentication is not a
viable option for all consumers, especially senior consumers who may not always be technologically savvy” or
“[l]ow-income households and households of color [that] are also likely to have limited bandwidth available to use
on their mobile phones, making online authentication more difficult for them”); CCA Comments at 7 (“CCA
members report experience with potential incoming customers who are unable to find the port PIN provided by their
(continued….)
36
Federal Communications Commission FCC 23-95
requiring a one-time port-out PIN obtained through a provider app is an effective means for
authenticating customers with a data-enabled smart phone, but that authentication measure may not be a
feasible option for customers without data plans or smartphones, or for those customers who are unable to
navigate the technology. As such, this requirement may necessitate the use of multiple authentication
methods, such as in-person authentication using government-issued identification, over-the-phone
authentication, or alternative methods for individuals with disabilities.224
57. We do not anticipate that using secure methods to authenticate a customer requesting a
port-out will be burdensome to wireless providers or unreasonably delay the processing of port-out
requests. The record reflects that many wireless providers have already developed and implemented
some form of customer authentication for port-out requests.225 The approach we adopt today will allow
wireless providers to continue using or building upon what is already working in the industry, helping to
streamline implementation and costs. We expect wireless providers to design and implement customer
authentication processes for port-out requests that minimize porting delays and maintain the industry
agreed-upon two-and-a-half hour porting interval for wireless ports.226
2. Customer Notification of Port-Out Requests
58. We also revise our numbering rules to require wireless providers to provide immediate
notification to their customers whenever a port-out request is made, sent in accordance with customer
preferences, if indicated,227 and specify that the notification must be sent before a provider effectuates a
port, except to the extent otherwise required by the Safe Connections Act of 2022 (47 U.S.C. § 345) or
(Continued from previous page)
current provider and experience significant frustration” and “especially those who are older or less familiar with
technology, may be deterred from selecting a provider who may offer a better service”); Verizon Comments at 6
(noting that in-store customers may be less tech savvy and so flexibility with authentication is necessary).
224 SIM Swap and Port-Out Fraud Notice, 36 FCC Rcd at 14131, 14146, paras. 25-26 & 73. See 47 CFR §§
6.3(a)(1)(i) & 14.21(b)(1)(i) (requiring carriers to “[p]rovide at least one mode that does not require user vision” to
operate a phone or use an account); 47 CFR §§ 6.3(a)(1)(iv) & 14.21(b)(1)(iv) (requiring carriers to “[p]rovide at
least one mode that does not require user auditory perception” to operate a phone or use an account); 47 CFR §§
6.3(a)(1)(ix) & 14.21(b)(1)(ix) (requiring carriers to “[p]rovide at least one mode that does not require user speech”
to operate a phone or use an account).
225 See, e.g., AT&T Comments at 6-7