The FCC SIM swap rules require every wireless carrier in the United States to verify your identity before moving your phone number to a new SIM card or a different provider, alert you before any such change goes through, and offer you a free lock that blocks SIM changes and port-outs entirely until you remove it. The rules apply to all commercial mobile radio service providers, including prepaid services and resellers, and became enforceable on July 8, 2024.1Federal Communications Commission. FCC Announces Effective Compliance Date for SIM Swapping Item
The rules live at 47 CFR 64.2010 and 47 CFR 52.37, built on the customer privacy obligations Congress imposed on carriers in Section 222 of the Communications Act.2Office of the Law Revision Counsel. 47 USC 222 – Privacy of Customer Information3Federal Register. Protecting Consumers from SIM-Swap and Port-Out Fraud They cover both physical SIM changes and port-outs to a different carrier, and they apply the same way whether your phone uses a removable SIM card or an embedded eSIM.
How Carriers Must Verify Your Identity
Before processing a SIM change or a port-out, a carrier has to authenticate you, and it cannot do so using information a scammer can look up or buy. The rules specifically prohibit authentication based on readily available biographical information or account information. That rules out your date of birth, the last four digits of your Social Security number, your billing address, your payment history, and your call records.4eCFR. 47 CFR 64.2010 – Safeguards on the Disclosure of Customer Proprietary Network Information Those were the exact tools scammers had been using to talk their way past customer service.
How verification actually happens depends on how you contact the carrier:
- By phone or online, the carrier must verify you through a pre-established password that does not rely on easily obtainable personal or account information. The backup procedure for a forgotten password has to meet the same standard.4eCFR. 47 CFR 64.2010 – Safeguards on the Disclosure of Customer Proprietary Network Information
- In a store, the carrier must require a valid government-issued photo ID that matches the account information on file.4eCFR. 47 CFR 64.2010 – Safeguards on the Disclosure of Customer Proprietary Network Information
Carriers also have to run procedures for handling failed authentication attempts, so a fraudster cannot simply keep guessing until something works.5Federal Communications Commission. Protecting Consumers from SIM Swap and Port-out Fraud And employees are barred from pulling up your account details until after you have been authenticated, which limits what a manipulated or complicit representative can do to help someone impersonating you.
Weak PINs are banned too. Carriers cannot let customers set an account PIN based on the last four digits of a Social Security number or the customer’s own phone number.5Federal Communications Commission. Protecting Consumers from SIM Swap and Port-out Fraud
The Free Number Lock Every Carrier Must Offer
The single most useful protection in the rules is the account lock. Every wireless provider must offer you, at no charge, the option to freeze your account so that no SIM change and no port-out can go through until you personally remove the freeze.5Federal Communications Commission. Protecting Consumers from SIM Swap and Port-out Fraud
With the lock in place, a scammer who calls or walks into a store cannot get your number moved regardless of what information they recite. The block is procedural, not evidentiary. Carriers are required to make information about this feature easily accessible online and to describe it in clear language.
The catch is that the protection only works if you turn it on. Ask your carrier to place the freeze on your account; it should not cost anything and should not require you to change service.
Alerts Before a Change Goes Through
Carriers must immediately notify you when someone initiates a SIM change or port-out request on your account, and the notice has to go out before the change is completed so you have a window to stop it.6Federal Communications Commission. Federal Communications Commission Report and Order FCC 23-95 – Protecting Consumers from SIM Swap and Port-Out Fraud The alert must go to a contact method the scammer does not control, meaning a separate email address or an alternate phone number you have pre-registered with the carrier. Sending the alert to the line being swapped would defeat the point.
The notification has to describe the change being requested and tell you how to report fraud immediately if you did not authorize it. This is often where fraud attempts collapse in practice. But it only works if the carrier has somewhere to reach you. If you have never given your provider a backup email or a secondary phone number, do that now.
Who and What Is Covered
The rules cover all commercial mobile radio service providers, including prepaid carriers and wireless resellers. The FCC drew the scope this broadly on evidence that prepaid customers are disproportionately hit by SIM swap fraud and can least afford the resulting losses.3Federal Register. Protecting Consumers from SIM-Swap and Port-Out Fraud Authentication methods also have to accommodate customers who lack data plans, have limited technical skills, or have disabilities.1Federal Communications Commission. FCC Announces Effective Compliance Date for SIM Swapping Item
The rules govern what carriers must do; they do not create a private right for you to sue your carrier for a violation. Your enforcement route runs through the FCC.
What To Do If Your Number Was Swapped
If your phone suddenly loses service and you stop getting calls and texts, treat it as an emergency. Most of the financial damage from a SIM swap happens in the first few hours, while the victim is still figuring out what is going on. The FTC recommends the following steps:7Federal Trade Commission. SIM Swap Scams – How to Protect Yourself
- Contact your carrier immediately from a different phone or in person. Tell them your number was swapped without authorization and demand it be transferred back. Once you regain control, change your account password.
- Check your bank, credit card, and investment accounts for unauthorized transactions and report anything suspicious to those institutions right away.
- If your personal information has been accessed, go to IdentityTheft.gov to create a recovery plan.
- If your carrier failed to follow proper authentication or notification procedures, file a complaint with the FCC.
Carriers also have their own after-the-fact obligations. They must maintain a clearly disclosed, easy-to-use process for reporting fraudulent SIM changes and number ports, promptly investigate and take reasonable steps to fix the problem, and provide documentation of the fraud on request. All of it has to be free to the victim.3Federal Register. Protecting Consumers from SIM-Swap and Port-Out Fraud The rules use the word “promptly” without pinning it to a specific number of hours, which gives carriers flexibility but also leaves room for the FCC to act if a provider is slow.
Filing a Complaint With the FCC
If your carrier ignored the authentication rules, failed to send an alert, refused to place a lock, or dragged its feet after fraud, you can file an informal complaint with the FCC. It is free and you do not need a lawyer. The FCC recommends first trying to resolve the issue with your provider.8Federal Communications Commission. Filing an Informal Complaint
File online at fcc.gov/complaints, which the FCC describes as the most effective method. You can also call 1-888-225-5322 or write to the Consumer Inquiries and Complaints Division at 45 L Street NE, Washington, DC 20554. Include your name, contact information, and as much detail as possible about what happened.8Federal Communications Commission. Filing an Informal Complaint
Once the FCC serves your complaint on the carrier, the carrier has 30 days to respond in writing to both you and the FCC. If the response is inadequate, you can send rebuttal information back to the FCC by replying to the email they sent, and the FCC will decide whether to push the carrier to respond again.9Federal Communications Commission. Filing a Complaint Questions and Answers
Steps To Take Right Now
The regulations give you tools. They only help if you activate them.
- Call your carrier and ask for a port freeze and SIM lock on your account. It is free.
- Set an account PIN that has nothing to do with your Social Security number, phone number, birthday, or address. Treat it like a bank password.
- Register a backup email address or secondary phone number with your carrier so alerts about SIM changes can reach you on a channel a swapper cannot intercept.
- Move your most sensitive accounts off SMS-based two-factor authentication. Use an authenticator app or a physical security key where the account supports one. The FCC rules make SIM swaps harder, not impossible.
A port freeze you never asked for and a backup email you never registered cannot protect you when a scammer decides your number is worth stealing.