Use carrier account locks and change alerts against SIM swaps, and check when the FCC’s new rules take effect

The FCC’s November 2023 SIM swap and port-out fraud order requires wireless carriers to authenticate customers before moving a number, notify them of SIM changes and port requests, and offer account locks. A 2024 bureau order tied compliance to a later Federal Register notice.

Source facts

The FCC’s November 15, 2023 announcement says new rules require wireless providers to adopt secure methods of authenticating a customer before redirecting a customer’s phone number to a new device or provider, and to immediately notify customers whenever a SIM change or port-out request is made on their accounts. It describes SIM swapping as a bad actor convincing the carrier to move the victim’s service to a phone the bad actor holds, and port-out fraud as opening an account at another carrier and transferring the victim’s number to it.

A later Wireline Competition Bureau order, DA 24-649, summarizes the rules as also requiring processes for failed authentication attempts, employee training, and safeguards that keep customer-facing employees from accessing account data until customers are authenticated. Carriers must offer customers the option to lock their accounts to block SIM changes and number ports and give advance notice of available account protection mechanisms.

That order denied an industry request to waive all of the rules until March 10, 2025, but waived compliance so that all of them become required together only after OMB completes its Paperwork Reduction Act review and the Commission publishes a compliance date in the Federal Register.

Applicability

Use this for any organization that relies on mobile numbers for staff contact or account verification. Whether and when each carrier must comply depends on the compliance-date notice described in the bureau order; check the FCC’s current docket before relying on a specific rule.

DSE recommendation

DSE recommends turning on every available carrier account lock and port-out protection for company phone lines, and removing SMS codes from privileged accounts. Set a strong carrier account PIN, route SIM-change and port-out alerts to the IT team as well as the user, and move administrators and finance staff to phishing-resistant sign-in so a hijacked number cannot reset their access.

Verification

Confirm lock and PIN settings on the carrier business account quarterly, test that a SIM-change alert reaches IT, and review identity provider settings to verify privileged accounts no longer accept SMS or voice codes.

Official references

Federal Communications Commission — FCC Adopts Rules to Protect Consumers’ Cell Phone Accounts (November 15, 2023). FCC Wireline Competition Bureau — Order DA 24-649 on the SIM Swap and Port-Out Fraud Order. Reviewed October 18, 2026.