Protecting Consumers from SIM Swap and Port-Out Fraud, Report and Order and FNPRM (FCC 23-95, WC Docket 21-341) (Part 3 of 3)
Document text
Research, not advice. Part of the Bitcoin research archive (October 2026). Claims labelled unverified, contested or fringe are reported, not endorsed; statuses of bills and rules are as of the date checked. Government, court and patent records are public domain; the research notes are CC BY 4.0.
of Shipments, or
Revenue Size of Firms for the U.S.: 2017, Table ID: EC1700SIZEREVFIRM, NAICS Code 517919,
https://data.census.gov/cedsci/table?y=2017&n=517919&tid=ECNSIZE2017.EC1700SIZEREVFIRM&hidePrevie
w=false.
120 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard. We also note that according to the U.S. Census Bureau glossary, the terms receipts and
revenues are used interchangeably, see https://www.census.gov/glossary/#term_ReceiptsRevenueServices.
79
Federal Communications Commission FCC 23-95
wireless providers to use existing methods of notification that are reasonably designed to reach the
affected customer. Several of our rules build on existing mechanisms that many wireless providers
already use, and therefore, we expect that our new rules will further minimize the costs and burdens for
those providers, and should significantly reduce compliance requirements for small entities that may have
smaller staff and fewer resources.
F. Steps Taken to Minimize the Significant Economic Impact on Small Entities, and
Significant Alternatives Considered
28. The RFA requires an agency to provide “a description of the steps the agency has taken
to minimize the significant economic impact on small entities . . .including a statement of the factual,
policy, and legal reasons for selecting the alternative adopted in the final rule and why each one of the
other significant alternatives to the rule considered by the agency which affect the impact on small entities
was rejected.”121
29. The requirements established in this Report and Order are designed to minimize the
economic impact on wireless providers, including small providers. The baseline, flexible rules adopted
reflect a recognition that, in some cases, strict prescriptive requirements to prevent SIM swap and port-out
fraud could be technically and economically infeasible for wireless providers to implement, particularly
for smaller providers. We therefore decline to adopt certain specific authentication methods mentioned in
the SIM Swap and Port-Out Fraud Notice because they may discourage carriers from adopting new
methods to address evolving techniques used by bad actors. The record shows that many wireless
providers already have in place some of the policies and procedures this Report and Order adopts and that
the rules may therefore only require them to adapt, refine, or consistently apply those existing practices.
Additionally, by setting baseline requirements and giving wireless providers flexibility on how to meet
them, this Report and Order allows providers to adopt the most cost-effective and least burdensome
solutions to achieve the level of security needed to protect customers against SIM swap and port-out fraud
in a given circumstance. The Report and Order further minimizes any potential burdens of customer
notifications by declining to prescribe particular content and wording and giving wireless providers
flexibility on how to deliver such notifications. Similarly, for customer notices, the Report and Order
declines to require a specific format and content and declines to require such notices be delivered to
customers annually. With respect to employee training, we decline to adopt overly prescriptive
safeguards, such as two-employee sign off. Instead, the requirement this Report and Order adopts
minimizes potential burdens because it builds on the Commission’s existing CPNI training rule and gives
wireless providers flexibility on how to develop their training programs. Further, the Report and Order
mitigates the potential burdens of the recordkeeping requirement by declining to require that wireless
providers include historic data in their recordkeeping, which the Report and Order acknowledged would
be particularly burdensome for small providers, and declining to require that providers report this data to
the Commission regularly.
G. Report to Congress
30. The Commission will send a copy of the SIM Swap and Port-Out Fraud Report and
Order, including this FRFA, in a report to be sent to Congress pursuant to the Congressional Review
Act.122 In addition, the Commission will send a copy of the SIM Swap and Port-Out Fraud Report and
Order, including this FRFA, to the Chief Counsel for Advocacy of the SBA. A copy of the SIM Swap
and Port-Out Fraud Report and Order (or summaries thereof) will also be published in the Federal
Register.123
121 5 U.S.C. § 604(a)(6).
122 Id. § 801(a)(1)(A).
123 Id. § 604(b).
80
Federal Communications Commission FCC 23-95
81
Federal Communications Commission FCC 23-95
APPENDIX C
Initial Regulatory Flexibility Analysis
1. As required by the Regulatory Flexibility Act of 1980, as amended (RFA),1 the
Commission has prepared this Initial Regulatory Flexibility Analysis (IRFA) of the possible significant
economic impact on a substantial number of small entities by the policies and rules proposed in the
Protecting Consumers from SIM Swap and Port-Out Fraud Further Notice of Proposed Rulemaking
(Further Notice). Written comments are requested on this IRFA. Comments must be identified as
responses to the IRFA and must be filed by the deadlines for comments on the Further Notice provided
on the first page of the item. The Commission will send a copy of the Further Notice, including this
IRFA, to the Chief Counsel for Advocacy of the Small Business Administration (SBA).2 In addition, the
Further Notice and IRFA (or summaries thereof) will be published in the Federal Register.3
A. Need for, and Objectives of, the Proposed Rules
2. In the SIM Swap and Port-Out Fraud Report and Order (Report and Order), the
Commission adopts rules to address fraudulent practices that transfer a customer’s wireless service to a
bad actor, allowing the bad actor to gain access to information associated with the customer’s account,
and permitting the bad actor to receive the text messages and phone calls intended for the customer..
Specifically, the Report and Order revises the Commission’s Customer Proprietary Network Information
(CPNI) and Local Number Portability (LNP) rules to require wireless providers to adopt secure methods
of authenticating a customer before redirecting a customer’s phone number to a new device or provider.
The Report and Order also requires wireless providers to immediately notify customers whenever a SIM
change or port-out request is made on customers’ accounts, and take additional steps to protect customers
from SIM swap and port-out fraud. This approach sets baseline requirements that establish a uniform
framework across the mobile wireless industry while giving wireless providers the flexibility to deliver
the most advanced and appropriate fraud protection measures available.
3. In this Further Notice, we seek comment on whether to harmonize the existing
requirements governing customer access to CPNI4 with the SIM change authentication and protection
measures adopted in the Report and Order. This Further Notice expands on questions asked in the SIM
Swap and Port-Out Fraud Notice and several comments in the record, but seeks more targeted feedback
on a specific approach. The Further Notice explores whether justifications identified by commenters in
the record, or any other justifications, provide a rationale for harmonizing the existing CPNI rules with
the customer protection measures adopted in the Report and Order, as well as any reasons why the
Commission should not harmonize its existing CPNI rules with the SIM swap fraud protection measures
adopted in the Report and Order.
4. Recognizing that there may be other efforts within the government to tackle SIM swap
and port-out fraud to address the broader implications of these harmful practices, the Further Notice also
seeks comment on information about those other efforts and what steps the Commission can take to
harmonize government efforts to address SIM swap and port-out fraud. The Further Notice also seeks
comment on whether to require wireless providers to immediately notify customers in the event of a failed
authentication attempt, except to the extent otherwise required by the Safe Connections Act of 2022 (47
U.S.C. § 345) or the Commission’s rules implementing that statute, or whether to permit carriers to
employ reasonable risk assessment techniques to determine when a failed authentication attempt requires
1 5 U.S.C. § 603.
The RFA, 5 U.S.C. §§ 601–612, has been amended by the Small Business Regulatory
Enforcement Fairness Act of 1996 (SBREFA), Pub. L. No. 104-121, Title II, 110 Stat. 857 (1996).
2 5 U.S.C. § 603(a).
3 Id.
4 See 47 CFR § 64.2010.
82
Federal Communications Commission FCC 23-95
customer notification, or require notification only in instances of multiple failed attempts or when there is
reasonable suspicion of fraud.
B. Legal Basis
5. The proposed action is authorized pursuant to sections 1, 4, 201, 222, 251, 303(r), and
332 of the Communications Act of 1934, as amended, 47 U.S.C. §§ 151, 154, 201, 222, 251, 303(r), and
332.
C. Description and Estimate of the Number of Small Entities to Which the Proposed
Rules Will Apply
6. The RFA directs agencies to provide a description of, and where feasible, an estimate of
the number of small entities that may be affected by the proposed rules, if adopted.5 The RFA generally
defines the term “small entity” as having the same meaning as the terms “small business,” “small
organization,” and “small governmental jurisdiction.”6 In addition, the term “small business” has the
same meaning as the term “small business concern” under the Small Business Act.7 A “small business
concern” is one which: (1) is independently owned and operated; (2) is not dominant in its field of
operation; and (3) satisfies any additional criteria established by the SBA.8
7. Small Businesses, Small Organizations, Small Governmental Jurisdictions. Our actions,
over time, may affect small entities that are not easily categorized at present. We therefore describe, at
the outset, three broad groups of small entities that could be directly affected herein.9 First, while there
are industry specific size standards for small businesses that are used in the regulatory flexibility analysis,
according to data from the Small Business Administration’s (SBA) Office of Advocacy, in general a
small business is an independent business having fewer than 500 employees.10 These types of small
businesses represent 99.9% of all businesses in the United States, which translates to 33.2 million
businesses.11
8. Next, the type of small entity described as a “small organization” is generally “any not-
for-profit enterprise which is independently owned and operated and is not dominant in its field.”12 The
Internal Revenue Service (IRS) uses a revenue benchmark of $50,000 or less to delineate its annual
electronic filing requirements for small exempt organizations.13 Nationwide, for tax year 2020, there
5 5 U.S.C. § 603(b)(3).
6 Id. § 601(6).
7 Id. § 601(3) (incorporating by reference the definition of “small-business concern” in the Small Business Act, 15
U.S.C. § 632). Pursuant to 5 U.S.C. § 601(3), the statutory definition of a small business applies “unless an agency,
after consultation with the Office of Advocacy of the Small Business Administration and after opportunity for public
comment, establishes one or more definitions of such term which are appropriate to the activities of the agency and
publishes such definition(s) in the Federal Register.”
8 15 U.S.C. § 632.
9 5 U.S.C. § 601(3)-(6).
10 SBA, Office of Advocacy, “What’s New With Small Business?,” https://advocacy.sba.gov/wp-
content/uploads/2023/03/Whats-New-Infographic-March-2023-508c.pdf. (Mar. 2023).
11 Id.
12 5 U.S.C. § 601(4).
13 The IRS benchmark is similar to the population of less than 50,000 benchmark in 5 U.S.C § 601(5) that is used to
define a small governmental jurisdiction. Therefore, the IRS benchmark has been used to estimate the number of
small organizations in this small entity description. See Annual Electronic Filing Requirement for Small Exempt
Organizations – Form 990-N (e-Postcard), “Who must file,” https://www.irs.gov/charities-non-profits/annual-
electronic-filing-requirement-for-small-exempt-organizations-form-990-n-e-postcard. We note that the IRS data
(continued….)
83
Federal Communications Commission FCC 23-95
were approximately 447,689 small exempt organizations in the U.S. reporting revenues of $50,000 or less
according to the registration and tax data for exempt organizations available from the IRS.14
9. Finally, the small entity described as a “small governmental jurisdiction” is defined
generally as “governments of cities, counties, towns, townships, villages, school districts, or special
districts, with a population of less than fifty thousand.”15 U.S. Census Bureau data from the 2017 Census
of Governments16 indicate there were 90,075 local governmental jurisdictions consisting of general
purpose governments and special purpose governments in the United States.17 Of this number, there were
36,931 general purpose governments (county,18 municipal, and town or township19) with populations of
less than 50,000 and 12,040 special purpose governments—independent school districts20 with enrollment
populations of less than 50,000.21 Accordingly, based on the 2017 U.S. Census of Governments data, we
estimate that at least 48,971 entities fall into the category of “small governmental jurisdictions.”22
(Continued from previous page)
does not provide information on whether a small exempt organization is independently owned and operated or
dominant in its field.
14 See Exempt Organizations Business Master File Extract (EO BMF), “CSV Files by Region,”
https://www.irs.gov/charities-non-profits/exempt-organizations-business-master-file-extract-eo-bmf. The IRS
Exempt Organization Business Master File (EO BMF) Extract provides information on all registered tax-
exempt/non-profit organizations. The data utilized for purposes of this description was extracted from the IRS EO
BMF data for businesses for the tax year 2020 with revenue less than or equal to $50,000 for Region 1-Northeast
Area (58,577), Region 2-Mid-Atlantic and Great Lakes Areas (175,272), and Region 3-Gulf Coast and Pacific Coast
Areas (213,840) that includes the continental U.S., Alaska, and Hawaii. This data does not include information for
Puerto Rico.
15 5 U.S.C. § 601(5).
16 13 U.S.C. § 161.The Census of Governments survey is conducted every five (5) years compiling data for years
ending with “2” and “7”. See also Census of Governments, https://www.census.gov/programs-
surveys/cog/about.html.
17 U.S. Census Bureau, 2017 Census of Governments – Organization Table 2. Local Governments by Type and
State: 2017 [CG1700ORG02], https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. Local
governmental jurisdictions are made up of general purpose governments (county, municipal and town or township)
and special purpose governments (special districts and independent school districts). See also tbl.2. CG1700ORG02
Table Notes_Local Governments by Type and State_2017.
18 Id. at tbl.5.
County Governments by Population-Size Group and State: 2017 [CG1700ORG05],
https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 2,105 county governments
with populations less than 50,000. This category does not include subcounty (municipal and township)
governments.
19 Id. at tbl.6.
Subcounty General-Purpose Governments by Population-Size Group and State: 2017
[CG1700ORG06], https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 18,729
municipal and 16,097 town and township governments with populations less than 50,000.
20 Id. at tbl.10.
Elementary and Secondary School Systems by Enrollment-Size Group and State: 2017
[CG1700ORG10], https://www.census.gov/data/tables/2017/econ/gus/2017-governments.html. There were 12,040
independent school districts with enrollment populations less than 50,000. See also tbl.4. Special-Purpose Local
Governments by State Census Years 1942 to 2017 [CG1700ORG04], CG1700ORG04 Table Notes_Special Purpose
Local Governments by State_Census Years 1942 to 2017.
21 While the special purpose governments category also includes local special district governments, the 2017 Census
of Governments data does not provide data aggregated based on population size for the special purpose governments
category. Therefore, only data from independent school districts is included in the special purpose governments
category.
22 This total is derived from the sum of the number of general purpose governments (county, municipal and town or
township) with populations of less than 50,000 (36,931) and the number of special purpose governments -
(continued….)
84
Federal Communications Commission FCC 23-95
1. Providers of Telecommunications and Other Services
10. Wired Telecommunications Carriers. The U.S. Census Bureau defines this industry as
establishments primarily engaged in operating and/or providing access to transmission facilities and
infrastructure that they own and/or lease for the transmission of voice, data, text, sound, and video using
wired communications networks.23 Transmission facilities may be based on a single technology or a
combination of technologies. Establishments in this industry use the wired telecommunications network
facilities that they operate to provide a variety of services, such as wired telephony services, including
VoIP services, wired (cable) audio and video programming distribution, and wired broadband Internet
services.24 By exception, establishments providing satellite television distribution services using facilities
and infrastructure that they operate are included in this industry.25 Wired Telecommunications Carriers
are also referred to as wireline carriers or fixed local service providers.26
11. The SBA small business size standard for Wired Telecommunications Carriers classifies
firms having 1,500 or fewer employees as small.27 U.S. Census Bureau data for 2017 show that there
were 3,054 firms that operated in this industry for the entire year.28 Of this number, 2,964 firms operated
with fewer than 250 employees.29 Additionally, based on Commission data in the 2022 Universal Service
Monitoring Report, as of December 31, 2021, there were 4,590 providers that reported they were engaged
in the provision of fixed local services.30 Of these providers, the Commission estimates that 4,146
providers have 1,500 or fewer employees.31 Consequently, using the SBA’s small business size standard,
most of these providers can be considered small entities.
12. Local Exchange Carriers (LECs). Neither the Commission nor the SBA has developed a
size standard for small businesses specifically applicable to local exchange services. Providers of these
services include both incumbent and competitive local exchange service providers. Wired
(Continued from previous page)
independent school districts with enrollment populations of less than 50,000 (12,040), from the 2017 Census of
Governments - Organizations tbls.5, 6 & 10.
23 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
24 Id.
25 Id.
26 Fixed Local Service Providers include the following types of providers: Incumbent Local Exchange Carriers
(ILECs), Competitive Access Providers (CAPs) and Competitive Local Exchange Carriers (CLECs), Cable/Coax
CLECs, Interconnected VOIP Providers, Non-Interconnected VOIP Providers, Shared-Tenant Service Providers,
Audio Bridge Service Providers, and Other Local Service Providers. Local Resellers fall into another U.S. Census
Bureau industry group and therefore data for these providers is not included in this industry.
27 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
28 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
29 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
30 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf. https://docs.fcc.gov/public/attachments/DOC-
379181A1.pdf
31 Id.
85
Federal Communications Commission FCC 23-95
Telecommunications Carriers32 is the closest industry with an SBA small business size standard.33 Wired
Telecommunications Carriers are also referred to as wireline carriers or fixed local service providers.34
The SBA small business size standard for Wired Telecommunications Carriers classifies firms having
1,500 or fewer employees as small.35 U.S. Census Bureau data for 2017 show that there were 3,054 firms
that operated in this industry for the entire year.36 Of this number, 2,964 firms operated with fewer than
250 employees.37 Additionally, based on Commission data in the 2022 Universal Service Monitoring
Report, as of December 31, 2021, there were 4,590 providers that reported they were fixed local exchange
service providers.38 Of these providers, the Commission estimates that 4,146 providers have 1,500 or
fewer employees.39 Consequently, using the SBA’s small business size standard, most of these providers
can be considered small entities.
13. Incumbent Local Exchange Carriers (Incumbent LECs). Neither the Commission nor the
SBA have developed a small business size standard specifically for incumbent local exchange carriers.
Wired Telecommunications Carriers40 is the closest industry with an SBA small business size standard.41
The SBA small business size standard for Wired Telecommunications Carriers classifies firms having
1,500 or fewer employees as small.42 U.S. Census Bureau data for 2017 show that there were 3,054 firms
in this industry that operated for the entire year.43 Of this number, 2,964 firms operated with fewer than
250 employees.44 Additionally, based on Commission data in the 2022 Universal Service Monitoring
Report, as of December 31, 2021, there were 1,212 providers that reported they were incumbent local
exchange service providers.45 Of these providers, the Commission estimates that 916 providers have
32 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
33 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
34 Fixed Local Exchange Service Providers include the following types of providers: Incumbent Local Exchange
Carriers (ILECs), Competitive Access Providers (CAPs) and Competitive Local Exchange Carriers (CLECs),
Cable/Coax CLECs, Interconnected VoIP Providers, Non-Interconnected VoIP Providers, Shared-Tenant Service
Providers, Audio Bridge Service Providers, Local Resellers, and Other Local Service Providers.
35 Id.
36 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
37 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
38 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
39 Id.
40 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
41 See 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
42 Id.
43 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
44 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
45 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
(continued….)
86
Federal Communications Commission FCC 23-95
1,500 or fewer employees.46 Consequently, using the SBA’s small business size standard, the
Commission estimates that the majority of incumbent local exchange carriers can be considered small
entities.
14. Competitive Local Exchange Carriers (Competitive LECs). Neither the Commission nor
the SBA has developed a size standard for small businesses specifically applicable to local exchange
services. Providers of these services include several types of competitive local exchange service
providers.47 Wired Telecommunications Carriers48 is the closest industry with an SBA small business size
standard. The SBA small business size standard for Wired Telecommunications Carriers classifies firms
having 1,500 or fewer employees as small.49 U.S. Census Bureau data for 2017 show that there were
3,054 firms that operated in this industry for the entire year.50 Of this number, 2,964 firms operated with
fewer than 250 employees.51 Additionally, based on Commission data in the 2022 Universal Service
Monitoring Report, as of December 31, 2021, there were 3,378 providers that reported they were
competitive local exchange service providers.52 Of these providers, the Commission estimates that 3,230
providers have 1,500 or fewer employees.53 Consequently, using the SBA’s small business size standard,
most of these providers can be considered small entities.
15. Interexchange Carriers (IXCs). Neither the Commission nor the SBA have developed a
small business size standard specifically for Interexchange Carriers. Wired Telecommunications
Carriers54 is the closest industry with an SBA small business size standard.55 The SBA small business
size standard for Wired Telecommunications Carriers classifies firms having 1,500 or fewer employees as
small.56 U.S. Census Bureau data for 2017 show that there were 3,054 firms that operated in this industry
for the entire year.57 Of this number, 2,964 firms operated with fewer than 250 employees.58
(Continued from previous page)
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
46 Id.
47 Competitive Local Exchange Service Providers include the following types of providers: Competitive Access
Providers (CAPs) and Competitive Local Exchange Carriers (CLECs), Cable/Coax CLECs, Interconnected VOIP
Providers, Non-Interconnected VOIP Providers, Shared-Tenant Service Providers, Audio Bridge Service Providers,
Local Resellers, and Other Local Service Providers.
48 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
49 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
50 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
51 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
52 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
53 Id.
54 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
55 See 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
56 Id.
57 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
(continued….)
87
Federal Communications Commission FCC 23-95
Additionally, based on Commission data in the 2022 Universal Service Monitoring Report, as of
December 31, 2021, there were 127 providers that reported they were engaged in the provision of
interexchange services. Of these providers, the Commission estimates that 109 providers have 1,500 or
fewer employees.59 Consequently, using the SBA’s small business size standard, the Commission
estimates that the majority of providers in this industry can be considered small entities.
16. Local Resellers. Neither the Commission nor the SBA have developed a small business
size standard specifically for Local Resellers. Telecommunications Resellers is the closest industry with
an SBA small business size standard.60 The Telecommunications Resellers industry comprises
establishments engaged in purchasing access and network capacity from owners and operators of
telecommunications networks and reselling wired and wireless telecommunications services (except
satellite) to businesses and households.61 Establishments in this industry resell telecommunications; they
do not operate transmission facilities and infrastructure.62 Mobile virtual network operators (MVNOs) are
included in this industry.63 The SBA small business size standard for Telecommunications Resellers
classifies a business as small if it has 1,500 or fewer employees.64 U.S. Census Bureau data for 2017
show that 1,386 firms in this industry provided resale services for the entire year.65 Of that number, 1,375
firms operated with fewer than 250 employees.66 Additionally, based on Commission data in the 2022
Universal Service Monitoring Report, as of December 31, 2021, there were 207 providers that reported
they were engaged in the provision of local resale services.67 Of these providers, the Commission
estimates that 202 providers have 1,500 or fewer employees.68 Consequently, using the SBA’s small
business size standard, most of these providers can be considered small entities.
17. Toll Resellers. Neither the Commission nor the SBA have developed a small business
size standard specifically for Toll Resellers. Telecommunications Resellers69 is the closest industry with
(Continued from previous page)
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
58 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
59 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
60 See U.S. Census Bureau, 2017 NAICS Definition, “517911 Telecommunications Resellers,”
https://www.census.gov/naics/?input=517911&year=2017&details=517911.
61 Id.
62 Id.
63 Id.
64 13 CFR § 121.201, NAICS Code 517911 (as of 10/1/22, NAICS Code 517121).
65 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517911,
https://data.census.gov/cedsci/table?y=2017&n=517911&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
66 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
67 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
68 Id.
69 See U.S. Census Bureau, 2017 NAICS Definition, “517911 Telecommunications Resellers,”
https://www.census.gov/naics/?input=517911&year=2017&details=517911.
88
Federal Communications Commission FCC 23-95
an SBA small business size standard. The Telecommunications Resellers industry comprises
establishments engaged in purchasing access and network capacity from owners and operators of
telecommunications networks and reselling wired and wireless telecommunications services (except
satellite) to businesses and households. Establishments in this industry resell telecommunications; they
do not operate transmission facilities and infrastructure.70 Mobile virtual network operators (MVNOs) are
included in this industry.71 The SBA small business size standard for Telecommunications Resellers
classifies a business as small if it has 1,500 or fewer employees.72 U.S. Census Bureau data for 2017
show that 1,386 firms in this industry provided resale services for the entire year.73 Of that number, 1,375
firms operated with fewer than 250 employees.74 Additionally, based on Commission data in the 2022
Universal Service Monitoring Report, as of December 31, 2021, there were 457 providers that reported
they were engaged in the provision of toll services.75 Of these providers, the Commission estimates that
438 providers have 1,500 or fewer employees.76 Consequently, using the SBA’s small business size
standard, most of these providers can be considered small entities.
18. Wireless Telecommunications Carriers (except Satellite). This industry comprises
establishments engaged in operating and maintaining switching and transmission facilities to provide
communications via the airwaves.77 Establishments in this industry have spectrum licenses and provide
services using that spectrum, such as cellular services, paging services, wireless Internet access, and
wireless video services.78 The SBA size standard for this industry classifies a business as small if it has
1,500 or fewer employees.79 U.S. Census Bureau data for 2017 show that there were 2,893 firms in this
industry that operated for the entire year.80 Of that number, 2,837 firms employed fewer than 250
employees.81 Additionally, based on Commission data in the 2022 Universal Service Monitoring Report,
as of December 31, 2021, there were 594 providers that reported they were engaged in the provision of
wireless services.82 Of these providers, the Commission estimates that 511 providers have 1,500 or fewer
70 Id.
71 Id.
72 13 CFR § 121.201, NAICS Code 517911 (as of 10/1/22, NAICS Code 517121).
73 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517911,
https://data.census.gov/cedsci/table?y=2017&n=517911&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
74 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
75 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf. https://docs.fcc.gov/public/attachments/DOC-
379181A1.pdf
76 Id.
77 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except
Satellite),” https://www.census.gov/naics/?input=517312&year=2017&details=517312.
78 Id.
79 13 CFR § 121.201, NAICS Code 517312 (as of 10/1/22, NAICS Code 517112).
80 U.S. Census Bureau, 2017 Economic Census of the United States, Employment Size of Firms for the U.S.: 2017,
Table ID: EC1700SIZEEMPFIRM, NAICS Code 517312,
https://data.census.gov/cedsci/table?y=2017&n=517312&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
81 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
82 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
(continued….)
89
Federal Communications Commission FCC 23-95
employees.83 Consequently, using the SBA’s small business size standard, most of these providers can be
considered small entities.
19. Wireless Resellers. Neither the Commission nor the SBA have developed a small
business size standard specifically for Wireless Resellers. The closest industry with an SBA small
business size standard is Telecommunications Resellers.84 The Telecommunications Resellers industry
comprises establishments engaged in purchasing access and network capacity from owners and operators
of telecommunications networks and reselling wired and wireless telecommunications services (except
satellite) to businesses and households.85 Establishments in this industry resell telecommunications and
they do not operate transmission facilities and infrastructure.86 Mobile virtual network operators
(MVNOs) are included in this industry.87 Under the SBA size standard for this industry, a business is
small if it has 1,500 or fewer employees.88 U.S. Census Bureau data for 2017 show that 1,386 firms in
this industry provided resale services during that year.89 Of that number, 1,375 firms operated with fewer
than 250 employees.90 Thus, for this industry under the SBA small business size standard, the majority of
providers can be considered small entities.
20. Satellite Telecommunications. This industry comprises firms “primarily engaged in
providing telecommunications services to other establishments in the telecommunications and
broadcasting industries by forwarding and receiving communications signals via a system of satellites or
reselling satellite telecommunications.”91 Satellite telecommunications service providers include satellite
and earth station operators. The SBA small business size standard for this industry classifies a business
with $38.5 million or less in annual receipts as small.92 U.S. Census Bureau data for 2017 show that 275
firms in this industry operated for the entire year.93 Of this number, 242 firms had revenue of less than
$25 million.94 Additionally, based on Commission data in the 2022 Universal Service Monitoring Report,
(Continued from previous page)
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
83 Id.
84 See U.S. Census Bureau, 2017 NAICS Definition, “517911 Telecommunications Resellers,”
https://www.census.gov/naics/?input=517911&year=2017&details=517911.
85 Id.
86 Id.
87 Id.
88 13 CFR § 121.201, NAICS Code 517911 (as of 10/1/22, NAICS Code 517121).
89 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms for
the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517911,
https://data.census.gov/cedsci/table?y=2017&n=517911&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
90 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
91 See U.S. Census Bureau, 2017 NAICS Definition, “517410 Satellite Telecommunications,”
https://www.census.gov/naics/?input=517410&year=2017&details=517410.
92 13 CFR § 121.201, NAICS Code 517410.
93 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Sales, Value of Shipments, or
Revenue Size of Firms for the U.S.: 2017, Table ID: EC1700SIZEREVFIRM, NAICS Code 517410,
https://data.census.gov/cedsci/table?y=2017&n=517410&tid=ECNSIZE2017.EC1700SIZEREVFIRM&hidePrevie
w=false.
94 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard. We also note that according to the U.S. Census Bureau glossary, the terms receipts and
revenues are used interchangeably, see https://www.census.gov/glossary/#term_ReceiptsRevenueServices.
90
Federal Communications Commission FCC 23-95
as of December 31, 2021, there were 65 providers that reported they were engaged in the provision of
satellite telecommunications services.95 Of these providers, the Commission estimates that approximately
42 providers have 1,500 or fewer employees.96 Consequently, using the SBA’s small business size
standard, a little more than half of these providers can be considered small entities.
21. All Other Telecommunications. This industry is comprised of establishments primarily
engaged in providing specialized telecommunications services, such as satellite tracking, communications
telemetry, and radar station operation.97 This industry also includes establishments primarily engaged in
providing satellite terminal stations and associated facilities connected with one or more terrestrial
systems and capable of transmitting telecommunications to, and receiving telecommunications from,
satellite systems.98 Providers of Internet services (e.g. dial-up ISPs) or Voice over Internet Protocol
(VoIP) services, via client-supplied telecommunications connections are also included in this industry.99
The SBA small business size standard for this industry classifies firms with annual receipts of $35 million
or less as small.100 U.S. Census Bureau data for 2017 show that there were 1,079 firms in this industry
that operated for the entire year.101 Of those firms, 1,039 had revenue of less than $25 million.102 Based
on this data, the Commission estimates that the majority of “All Other Telecommunications” firms can be
considered small.
2. Internet Service Providers
22. Wired Broadband Internet Access Service Providers (Wired ISPs).103 Providers of wired
broadband Internet access service include various types of providers except dial-up Internet access
providers. Wireline service that terminates at an end user location or mobile device and enables the end
user to receive information from and/or send information to the Internet at information transfer rates
exceeding 200 kilobits per second (kbps) in at least one direction is classified as a broadband connection
under the Commission’s rules.104 Wired broadband Internet services fall in the Wired
Telecommunications Carriers industry.105 The SBA small business size standard for this industry
classifies firms having 1,500 or fewer employees as small.106 U.S. Census Bureau data for 2017 show that
95 Federal-State Joint Board on Universal Service, Universal Service Monitoring Report at 26, Table 1.12 (2022),
https://docs.fcc.gov/public/attachments/DOC-391070A1.pdf.
96 Id.
97 See U.S. Census Bureau, 2017 NAICS Definition, “517919 All Other Telecommunications,”
https://www.census.gov/naics/?input=517919&year=2017&details=517919.
98 Id.
99 Id.
100 13 CFR § 121.201, NAICS Code 517919 (as of 10/1/22, NAICS Code 517810).
101 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Sales, Value of Shipments, or
Revenue Size of Firms for the U.S.: 2017, Table ID: EC1700SIZEREVFIRM, NAICS Code 517919,
https://data.census.gov/cedsci/table?y=2017&n=517919&tid=ECNSIZE2017.EC1700SIZEREVFIRM&hidePrevie
w=false.
102 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard. We also note that according to the U.S. Census Bureau glossary, the terms receipts and
revenues are used interchangeably, see https://www.census.gov/glossary/#term_ReceiptsRevenueServices.
103 Formerly included in the scope of the Internet Service Providers (Broadband), Wired Telecommunications
Carriers and All Other Telecommunications small entity industry descriptions.
104 47 CFR § 1.7001(a)(1).
105 See U.S. Census Bureau, 2017 NAICS Definition, “517311 Wired Telecommunications Carriers,”
https://www.census.gov/naics/?input=517311&year=2017&details=517311.
106 13 CFR § 121.201, NAICS Code 517311 (as of 10/1/22, NAICS Code 517111).
91
Federal Communications Commission FCC 23-95
there were 3,054 firms that operated in this industry for the entire year.107 Of this number, 2,964 firms
operated with fewer than 250 employees.108
23. Additionally, according to Commission data on Internet access services as of December
31, 2018, nationwide there were approximately 2,700 providers of connections over 200 kbps in at least
one direction using various wireline technologies.109 The Commission does not collect data on the
number of employees for providers of these services, therefore, at this time we are not able to estimate the
number of providers that would qualify as small under the SBA’s small business size standard. However,
in light of the general data on fixed technology service providers in the Commission’s 2022
Communications Marketplace Report,110 we believe that the majority of wireline Internet access service
providers can be considered small entities.
24. Wireless Broadband Internet Access Service Providers (Wireless ISPs or WISPs).111
Providers of wireless broadband Internet access service include fixed and mobile wireless providers. The
Commission defines a WISP as “[a] company that provides end-users with wireless access to the
Internet[.]”112 Wireless service that terminates at an end user location or mobile device and enables the
end user to receive information from and/or send information to the Internet at information transfer rates
exceeding 200 kilobits per second (kbps) in at least one direction is classified as a broadband connection
under the Commission’s rules.113 Neither the SBA nor the Commission have developed a size standard
specifically applicable to Wireless Broadband Internet Access Service Providers. The closest applicable
industry with an SBA small business size standard is Wireless Telecommunications Carriers (except
Satellite).114 The SBA size standard for this industry classifies a business as small if it has 1,500 or fewer
employees.115 U.S. Census Bureau data for 2017 show that there were 2,893 firms in this industry that
operated for the entire year.116 Of that number, 2,837 firms employed fewer than 250 employees.117
107 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Employment Size of Firms
for the U.S.: 2017, Table ID: EC1700SIZEEMPFIRM, NAICS Code 517311,
https://data.census.gov/cedsci/table?y=2017&n=517311&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
108 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
109 See IAS Status 2018, Fig. 30 (The technologies used by providers include aDSL, sDSL, Other Wireline, Cable
Modem and FTTP). Other wireline includes: all copper-wire based technologies other than xDSL (such as Ethernet
over copper, T-1/DS-1 and T3/DS-1) as well as power line technologies which are included in this category to
maintain the confidentiality of the providers.
110 Communications Marketplace Report, GN Docket No. 22-203, 2022 WL 18110553 at 10, paras. 26-27, Figs.
II.A.5-7. (2022) (2022 Communications Marketplace Report).
111 Formerly included in the scope of the Internet Service Providers (Broadband), Wireless Telecommunications
Carriers (except Satellite) and All Other Telecommunications small entity industry descriptions.
112 Federal Communications Commission, Internet Access Services: Status as of December 31, 2018 (IAS Status
2018), Industry Analysis Division, Office of Economics & Analytics (September 2020). The report can be accessed
at https://www.fcc.gov/economics-analytics/industry-analysis-division/iad-data-statistical-reports.
113 47 CFR § 1.7001(a)(1).
114 See U.S. Census Bureau, 2017 NAICS Definition, “517312 Wireless Telecommunications Carriers (except
Satellite),” https://www.census.gov/naics/?input=517312&year=2017&details=517312.
115 13 CFR § 121.201, NAICS Code 517312 (as of 10/1/22, NAICS Code 517112).
116 U.S. Census Bureau, 2017 Economic Census of the United States, Employment Size of Firms for the U.S.: 2017,
Table ID: EC1700SIZEEMPFIRM, NAICS Code 517312,
https://data.census.gov/cedsci/table?y=2017&n=517312&tid=ECNSIZE2017.EC1700SIZEEMPFIRM&hidePrevie
w=false.
92
Federal Communications Commission FCC 23-95
25. Additionally, according to Commission data on Internet access services as of December
31, 2018, nationwide there were approximately 1,209 fixed wireless and 71 mobile wireless providers of
connections over 200 kbps in at least one direction.118 The Commission does not collect data on the
number of employees for providers of these services, therefore, at this time we are not able to estimate the
number of providers that would qualify as small under the SBA’s small business size standard. However,
based on data in the Commission’s 2022 Communications Marketplace Report on the small number of
large mobile wireless nationwide and regional facilities-based providers, the dozens of small regional
facilities-based providers and the number of wireless mobile virtual network providers in general,119 as
well as on terrestrial fixed wireless broadband providers in general,120 we believe that the majority of
wireless Internet access service providers can be considered small entities.
26. Internet Service Providers (Non-Broadband). Internet access service providers using
client-supplied telecommunications connections (e.g., dial-up ISPs) as well as VoIP service providers
using client-supplied telecommunications connections fall in the industry classification of All Other
Telecommunications.121 The SBA small business size standard for this industry classifies firms with
annual receipts of $35 million or less as small.122 For this industry, U.S. Census Bureau data for 2017
show that there were 1,079 firms in this industry that operated for the entire year.123 Of those firms, 1,039
had revenue of less than $25 million.124 Consequently, under the SBA size standard a majority of firms in
this industry can be considered small.
D. Description of Projected Reporting, Recordkeeping, and Other Compliance
Requirements for Small Entities
27. In this Further Notice, we seek comment on whether to harmonize the existing
requirements governing customer access to CPNI125 with the SIM change authentication and protection
measures adopted in the Report and Order, and if so, the extent to which the rules should be harmonized.
We tentatively conclude that harmonized authentication and protection requirements will be easier for
wireless providers to implement and therefore will reduce costs and burdens on carriers, including small
carriers. Recognizing that there may be other efforts within the government to tackle SIM swap and port-
out fraud to address the broader implications of these harmful practices, the Further Notice also seeks
comment on information about those other efforts and what steps the Commission can take to harmonize
government efforts to address SIM swap and port-out fraud.
28. Should the Commission decide to modify existing rules or adopt new rules to harmonize
(Continued from previous page)
117 Id. The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard.
118 See IAS Status 2018, Fig. 30.
119 2022 Communications Marketplace Report, 2022 WL 18110553 at 27, paras. 64-68.
120 Id. at 8, para. 22.
121 See U.S. Census Bureau, 2017 NAICS Definition, “517919 All Other Telecommunications,”
https://www.census.gov/naics/?input=517919&year=2017&details=517919.
122 13 CFR § 121.201, NAICS Code 517919 (as of 10/1/22, NAICS Code 517810).
123 U.S. Census Bureau, 2017 Economic Census of the United States, Selected Sectors: Sales, Value of Shipments, or
Revenue Size of Firms for the U.S.: 2017, Table ID: EC1700SIZEREVFIRM, NAICS Code 517919,
https://data.census.gov/cedsci/table?y=2017&n=517919&tid=ECNSIZE2017.EC1700SIZEREVFIRM&hidePrevie
w=false.
124 Id.The available U.S. Census Bureau data does not provide a more precise estimate of the number of firms that
meet the SBA size standard. We also note that according to the U.S. Census Bureau glossary, the terms receipts and
revenues are used interchangeably, see https://www.census.gov/glossary/#term_ReceiptsRevenueServices.
125 47 CFR § 64.2010.
93
Federal Communications Commission FCC 23-95
its existing CPNI rules with rules to protect customers from SIM swap fraud, such action could
potentially result in increased, reduced, or otherwise modified recordkeeping, reporting, or other
compliance requirements for affected providers of service. Likewise, should the Commission decide to
adopt rules requiring notification of a failed authentication attempt, such action could potentially result in
increased, reduced, or otherwise modified recordkeeping, reporting, or other compliance requirements.
We seek comment on the effect of any proposals on small entities. Entities, especially small businesses,
are encouraged to quantify the costs and benefits of any reporting, recordkeeping, or compliance
requirement that may be established in this proceeding. We anticipate the information we receive in
comments including, where requested, cost and benefit analyses, will help the Commission identify and
evaluate relevant compliance matters for small entities, including compliance costs and other burdens that
may result from the proposals and inquiries we make in the Further Notice.
E. Steps Taken to Minimize the Significant Economic Impact on Small Entities, and
Significant Alternatives Considered
29. The RFA requires an agency to describe any significant, specifically small business,
alternatives that it has considered in reaching its proposed approach, which may include the following
four alternatives (among others): “(1) the establishment of differing compliance or reporting requirements
or timetables that take into account the resources available to small entities; (2) the clarification,
consolidation, or simplification of compliance and reporting requirements under the rule for such small
entities; (3) the use of performance rather than design standards; and (4) an exemption from coverage of
the rule, or any part thereof, for such small entities.”126
30. In this Further Notice, we seek comment on whether we should harmonize the existing
requirements governing customer access to CPNI127 with the SIM change authentication and protection
measures adopted in the Report and Order, and if so, the extent to which the rules should be harmonized.
Among the justifications on which we seek comment are whether inconsistent rules are more burdensome
on carriers and whether carriers need flexibility to implement more secure authentication measures. We
also tentatively conclude that harmonized authentication and protection requirements will be easier for
wireless providers to implement and therefore will reduce costs and burdens on carriers. In considering
additional alternatives, we also ask whether it would it be costly and burdensome for carriers to adjust the
CPNI authentication and protection practices they have already implemented to comply with the
authentication requirements adopted in the Report and Order, and whether there are other reasons
harmonized rules could increase the costs or burdens on carriers, including small carriers. Regarding
notification to customers of failed authentication attempts, the Further Notice seeks comment whether the
Commission should require immediate notification by all telecommunications carriers or only wireless
providers. The Further Notice also asks whether providers should be required to notify customers
immediately of all failed authentication attempts, or whether instead to permit carriers to employ
reasonable risk assessment techniques to determine when failed authentication attempts require customer
notification, or require notification only in instances of multiple failed attempts or when there is
reasonable suspicion of fraud. The Commission expects to consider the economic impact on small
entities, as identified in comments filed in response to the Further Notice and this IRFA, in reaching its
final conclusions and taking action in this proceeding.
F. Federal Rules that May Duplicate, Overlap, or Conflict with the Proposed Rules
31. None.
126 5 U.S.C. § 603(c)(1)–(4).
127 47 CFR § 64.2010.
94
Federal Communications Commission FCC 23-95
STATEMENT OF
CHAIRWOMAN JESSICA ROSENWORCEL
Re: Protecting Consumers from SIM Swap and Port-Out Fraud, WC Docket No. 21-341, Report and
Order and Further Notice of Proposed Rulemaking (November 15, 2023).
If you want to know something about someone, just look at their phone. Because our phones do
more than just connect us to friends and family. They are a record of where we have been and who we
are. For many of us, these devices are internet gateways to our bank accounts, health records, social
media profiles, and more. The convenience of accessing all of this through our phones is undeniable. But
it also makes our devices a growing target for fraud—like SIM-swapping scams.
SIM cards are the dime-sized chips that are inserted into a mobile phone to identify and
authenticate subscribers. When you want to upgrade your device, transferring your SIM card makes it
easy to move your subscriber information to a new phone. But that’s where fraudsters step in. A bad
actor can call up your wireless provider and convince the customer service representative on the other end
of the line that you really need to transfer your SIM card to a new device—a device that is in their control,
not yours. If they are successful, they can divert two-factor authentication messages to drain your bank
account, take over your social media profile, and hijack your e-mail.
The Federal Bureau of Investigation reports SIM-swapping scams are on the rise. But they are
not alone. Because we see it here, too. At the Federal Communications Commission we are getting more
and more complaints from consumers who have suffered losses due to SIM-swapping fraud. On top of
this, the Cyber Safety Review Board at the Department of Homeland Security recently released a report
investigating a bad actor responsible for extortion of a mix of companies and government agencies though
SIM-swapping fraud. The report recommended that we take action to support consumer privacy and cut
off these scams.
That is exactly what we do today. We require wireless carriers to give subscribers more control
over their accounts and provide notice to consumers whenever there is a SIM transfer request, in order to
protect against fraudulent requests made by bad actors. We also revise our customer proprietary network
information and local number portability rules to make it harder for scam artists to make requests that get
them access to your sensitive subscriber information.
We take these steps to improve consumer privacy and put an end to SIM scams. Because we
know our phones know a lot about us. They are an entry to our records, our accounts, and so much that
we value. That is why across the board we need policies that make sure our information is secure. It is
also why I created the Commission’s first-ever Privacy and Data Protection Task Force earlier this year. I
want to thank them for their work on this initiative.
I also want to thank Allison Baker, Emily Caditz, Callie Coker, Adam Copeland, CJ Ferraro,
Trent Harkrader, Melissa Kirkel, Chris Laughlin, Jodie May, and Jordan Reth from the Wireline
Competition Bureau; Diane Burstein, Eliot Greenwald, Erica McMahon, Ike Ofobike, Suzy Rosen
Singleton, Karen Schroeder, Kristi Thornton, and Kimberly Wild from the Consumer and Governmental
Affairs Bureau; Loyaan Egal, Michael Epshteyn, James Graves, Phil Rosario, Kimbarly Taylor, Kristi
Thompson, and Shana Yates from the Enforcement Bureau; Justin Cain, Ken Carlberg, Debra Jordan,
Nicole McGinnis, Zenji Nakazawa, Erika Olsen, and Austin Randazzo from the Public Safety and
Homeland Security Bureau; Garnet Hanly and Jennifer Salhus from the Wireless Telecommunications
Bureau; Mark Azic, Patrick Brogan, Chelsea Fallon, Eugene Kiselev, Eric Ralph, and Emily Talaga from
the Office of Economics and Analytics; Andrea Kearney, Doug Klein, Richard Mallen, and Derek
Yeo from the Office of General Counsel; and Joycelyn James and Joy Ragsdale from the Office of
Communications Business Opportunities.
95
Federal Communications Commission FCC 23-95
STATEMENT OF
COMMISSIONER GEOFFREY STARKS
Re: Protecting Consumers from SIM Swap and Port-Out Fraud, WC Docket No. 21-34,
Report and Order and Further Notice of Proposed Rulemaking (November 15, 2023).
It’s a frightening thought – that a stranger could successfully impersonate you to your phone
company, and in one conversation gain access to your primary means of communication. But this is more
than a thought, it’s reality. Bad actors are taking advantage of the services that let you keep your old
number when you change phones or providers, leveraging identity authentication protocols and
underdeveloped fraud response systems to, essentially, steal your phone and your account – without ever
gaining physical control of it.
These scams – SIM swap and port-out fraud – don’t just put wireless account access and details at
risk. Because we so frequently use our phone numbers for two-factor authentication, a bad actor who
takes control of a phone can also take control of financial accounts, social media accounts, the list goes
on. Consumers must be able to count on secure verification procedures and reliable privacy guarantees
from their wireless providers. And they should be able to go about their day without fearing that
someone, somewhere, might take control of their phone without a single warning sign.
Today, we take action to provide that security. This order updates the Commission’s existing
Customer Proprietary Network Information (“CPNI”) and Local Number Portability (“LNP”) rules to
protect against SIM swap and port-out fraud. While the framework we implement today is responsive to
the current scope of these deceptive practices, it is also forward-looking. We require wireless providers to
adopt secure authentication methods and to immediately notify customers of SIM change or port-out
requests before they are processed, among other things. But we emphasize that these are baseline
requirements, rather than prescriptive rules. In doing so, we acknowledge two things the record makes
clear: first, that many providers may already have certain protective measures in place that may fulfill
some of these new requirements, and second, that the threat landscape is rapidly evolving, and providers
need flexibility to adopt and adapt their security methods accordingly.
Cell phones are near-ubiquitous, and many Americans rely on them as their sole means of
connection, as well as the key to their many online accounts. The Commission’s statutory duty to
safeguard consumer privacy within the telecommunications space, and our unparalleled regulatory
expertise within that space, gives rise to the strength of today’s item. I thank the Chairwoman for her
focus and leadership on these issues, and I thank the Commission staff for their excellent work on this
item. It has my full support.
96
Federal Communications Commission FCC 23-95
STATEMENT OF
COMMISSIONER ANNA M. GOMEZ
Re: Protecting Consumers from SIM Swap and Port-Out Fraud, WC Docket No. 21-341, Report and
Order and Further Notice of Proposed Rulemaking (November 15, 2023).
Phone numbers are a lifeline. In addition to keeping us connected to our family and friends, our
phone numbers are associated with a variety of digital accounts used for everything from banking to
healthcare. And now, messages sent to our phones for multifactor authentication are also used to grant
access to these accounts that hold so much of our personal information.
Through two types of fraudulent activity, SIM swapping and number port-outs, malicious actors
are able to take over control of a victim’s phone, meaning phone number, without ever accessing their
physical phone. Then, using this control, they go after the sensitive consumer information they now have
access to. This is unacceptable.
Today, we take meaningful steps to protect consumers against SIM swap and port-out fraud. We
will require more secure customer authentication, notify consumers before a SIM swap occurs, and
provide the option for consumers to lock their SIM to prevent changes.
Thank you to the Wireline Competition Bureau for your work on this item and to Chairwoman
Rosenworcel’s office for incorporating our edits that ensure notifications are available in consumers’
language of choice.
97
Federal Communications Commission FCC 23-95
DECLARACIÓN DE LA COMISIONADA
ANNA M. GOMEZ
Re: Protecting Consumers from SIM Swap and Port-Out Fraud, WC Docket No. 21-341, Report and
Order and Further Notice of Proposed Rulemaking (November 15, 2023).
Los números de teléfono son un salvavidas. Además de mantenernos conectados con nuestra
familia y amigos, nuestros números telefónicos están asociados con una variedad de cuentas digitales que
se utilizan para todo, desde los trámites bancarios hasta la atención médica. Y ahora, los mensajes
enviados a nuestros teléfonos para la autenticación multifactorial también se utilizan para otorgar acceso a
estas cuentas que contienen gran parte de nuestra información personal.
A través de dos tipos de actividad fraudulenta: el intercambio de tarjetas SIM y la transferencia de
números (la estafa “port-out”, en inglés), personas malintencionadas pueden adueñarse del número
telefónico de una víctima, sin siquiera acceder a su teléfono físico. Luego, buscan la información
confidencial del consumidor utilizando su número telefónico para lograr acceso a los datos. Eso es
inaceptable.
Hoy, tomamos medidas significativas para proteger a los consumidores contra el fraude de
transferencia y el cambio de tarjetas SIM. Requeriremos una autenticación de cliente más segura,
notificaremos a los consumidores antes de que se produzca un intercambio de tarjetas SIM y brindaremos
a los consumidores la opción de bloquear su tarjeta SIM para evitar cambios.
Agradecemos a la oficina de competencia en línea fija (Wireline Competition Bureau) por su
trabajo en este tema, y a la oficina de la presidenta de la FCC, Jessica Rosenworcel, por incorporar los
cambios que hemos sugerido para garantizar que las notificaciones estén disponibles en el idioma elegido
por los consumidores.
98