Briefing / Primer / Policy
The FCC’s SIM-swap rules: what carriers now have to do
The 2023 order puts the burden on wireless carriers to authenticate customers before a phone number moves. Here is what it requires, and what it doesn’t.
[EDITORIAL: sample briefing drafted with AI assistance. Verify every claim against its sources before launch.]
BLUF The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
High confidence
Based on the Federal Register rule and FCC orders, primary sources.
Key points
- Adopted November 15, 2023, and published in the Federal Register on December 8, 2023.
- Covers wireless carriers, not banks or app developers.
- Carriers must authenticate before a SIM change or port-out, and notify the customer.
What does the order require?
The Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules.[1][2] Wireless carriers must:
- Authenticate securely before redirecting a customer’s number to a new device or another carrier.
- Handle failed attempts: have procedures for responding to failed authentication.
- Notify customers promptly when a SIM change or port-out is requested.
- Offer account locks that customers can switch on to block number changes.
- Train staff and keep records of SIM change and port-out requests.
When did it take effect?
The rules were published in the Federal Register on December 8, 2023.[1] The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review.[3] Check the FCC’s current notice before citing a compliance date.
What doesn’t it cover?
The order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.
Sources
- Protecting Consumers from SIM Swap and Port-Out Fraud Federal Register, 2023-12-08
- Report and Order FCC 23-95 FCC
- Order on compliance date (DA 24-649) FCC
Changelog
- Clarified the compliance-date history.
- Published.