Port-out fraud and SIM swaps: who actually protects a business number?

The short version

This is research, not legal advice. Each regulatory statement links to the rule, order or regulator's letter, and what we could not confirm is said plainly.

Two ways to steal a number without touching the phone

Both attacks have the same goal: make the telephone network deliver your calls and texts to a device the criminal holds. Neither needs your handset, your password or any malware on your computer. They work by persuading, bribing or tricking the carrier.

SIM swap. The FCC describes it as "a scam in which a bad actor convinces a victim's wireless provider to transfer the victim's mobile service and number from the victim's cell phone to a cell phone in the bad actor's possession."4 The number never leaves your carrier; the carrier simply re-points it to a new SIM or eSIM. The FBI identifies three ways it is done: social engineering, where the criminal impersonates the victim to the carrier; insider threat, where criminals "pay off a mobile carrier employee"; and phishing of carrier employees to plant malware.15 "Once the SIM is swapped, the victim's calls, texts, and other data are diverted to the criminal's device."15

Port-out fraud. Here the number does leave. The FCC's description: a bad actor, "posing as the victim, opening an account with a wireless provider other than the victim's current provider, and then arranging for the victim's phone number to be transferred (or 'ported out') to the account with the new wireless provider controlled by the bad actor."4 This abuses the same right that lets you keep your number when you change provider. A port is designed to be quick: the FCC's order refers to "the industry agreed-upon two-and-a-half hour porting interval for wireless ports".1 That speed is a feature for a customer switching carriers and a gift to a fraudster.

The difference matters when you respond. After a SIM swap your carrier still holds the number and can reverse the change. After a port-out the number sits with another company, and recovering it means a dispute between two carriers while every call and text goes to the criminal.

A third route, for numbers not on a SIM. Our analysis: a cloud phone or VoIP number has no SIM to swap, but it has an online administration portal. Whoever logs in can forward calls, add a device or start a port, so the login is the number. The 2023 rules do not address this, for the reasons set out below.

Why a business number is worth stealing

The number itself is not the prize. The prize is everything that trusts it.

• Password resets and sign-in codes. Banks, payroll platforms, email providers, domain registrars and the carrier itself commonly send one-time codes by text or voice call. The FCC put it directly: fraudulent SIM swaps and port-outs "allow bad actors to perpetrate greater fraud by giving them the means to complete text and voice authentications to access the victim's other accounts".4 The FBI describes the sequence: the criminal sends "'Forgot Password' or 'Account Recovery' requests", and the provider sends "a link or one-time passcode via text to the victim's number, now owned by the criminal".15
• Bank and supplier callbacks. The FBI's standard advice against business email compromise is to "Use secondary channels and/or two-factor authentication to verify requests for changes in account information."17 The secondary channel is very often a phone call. If the criminal holds the number the bank or supplier calls back on, that check confirms the fraud instead of catching it.
• It is published and trusted. The number is on the website, the invoices and the van, so the attacker starts with it in hand, and customers believe whoever answers it.

How big is the problem? The honest answer is that nobody publishes complete figures. The FBI's Internet Crime Complaint Center (IC3) counts only complaints made to it. It recorded 320 SIM swapping complaints from January 2018 to December 2020 (about $12 million in losses), then 1,611 complaints and more than $68 million in 2021 alone.15 Its 2025 annual report shows 1,075 complaints and $48,798,103 in losses for 2023, 982 and $25,983,946 for 2024, and 971 and $17,366,758 for 2025.16 For comparison, business email compromise, the fraud a hijacked callback number helps along, drew 24,768 complaints and $3,046,598,558 in reported losses in 2025.16

We would not read much into the falling SIM swap figures. They are complaints, not incidents, and a business that loses money through an account takeover may never learn that the phone number was the way in.

NIST's current authentication guideline, SP 800-63B-4, says "there is one restricted authenticator: the use of the PSTN for out-of-band authentication", meaning codes sent by text or voice call, and tells verifiers to "consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior)" before using it.18 When the standards body names SIM changes and porting as reasons to distrust the phone channel, a business should not make that channel its only proof of identity.

What the FCC adopted in November 2023

United States The rules come from the Report and Order in WC Docket No. 21-341, FCC 23-95, adopted on 15 November 2023 and published at 88 FR 85794 on 8 December 2023.1 They amend two sets of rules: the customer proprietary network information (CPNI) rules, by adding paragraph (h) to 47 CFR § 64.2010 for SIM changes,2 and the number portability rules, by adding a new 47 CFR § 52.37 for port-outs.3

The FCC chose "baseline rules, rather than prescriptive requirements", and named no authentication method, because specific requirements "could either provide a roadmap for bad actors seeking to commit fraud or lock in measures that quickly prove to be ineffective or obsolete."1 The core requirements:

Scroll the table sideways to see every column.

The "[Reserved]" paragraphs were adopted in the Federal Register but "delayed indefinitely" pending Paperwork Reduction Act review.1 The lock rule matters most to a business: a carrier "shall offer customers, at no cost, the option to lock their accounts" against ports and "shall not fulfill a port-out request until the customer deactivates the lock"; the SIM-change lock reads the same way.1 The FCC declined to make locks the default,1 so a lock protects only those who turn it on. Notice must come before the change, so it reaches the real customer rather than the criminal's new SIM, and compliance "is not a safe harbor for wireless providers".1

Adopted in 2023, still not required in 2026

Most summaries report "compliance by July 2024" and stop there. The record says otherwise.

Scroll the table sideways to see every column.

To check whether the compliance date had been announced, we searched the Federal Register for every document since July 2024 that mentions "port-out", § 64.2010 or § 52.37. We found only the PRA notice and the Unified Agenda entries.58 We also read the docket's filing list in the FCC's comment system: after the July 2024 order it shows comments and an ex parte notice, but no Bureau public notice.9 On that record, almost three years after adoption, the FCC's SIM swap and port-out rules have no compliance date, and carriers are not yet required to follow them. If a notice has been issued somewhere we could not see, it has not reached the Code of Federal Regulations.

The FCC also opened a Further Notice on aligning the older CPNI rules with the new measures and on whether "limitations on employee access to CPNI prior to customer authentication should be extended to all telecommunications carriers".11 Comments closed in February 2024,11 and the Unified Agenda shows no next step.8

What the rules do not cover

The FCC was explicit about scope. For SIM changes, it reasoned that "because SIMs are only used to facilitate service for mobile wireless devices, SIM swap fraud is a practice that is exclusive to mobile wireless services." For port-outs: "we apply these new requirements exclusively to providers of CMRS ... as the record shows that port-out fraud is focused on mobile wireless customers."1 CMRS (commercial mobile radio service) means mobile carriers and their resellers, prepaid and postpaid alike.13

That leaves out most of the places a business number actually lives:

Scroll the table sideways to see every column.

The general CPNI rules are weaker than they sound. Carriers must "properly authenticate a customer prior to disclosing CPNI" and notify customers immediately when a password, online account or address of record is created or changed.2 These are rules about disclosing information. They do not say how to authenticate someone who asks to forward the line, add a device or move the number.

For a landline or VoIP number, the porting rule works against extra checks. Section 52.36 says a carrier "may require only the data described" in its list of fourteen fields "to accomplish a simple port order request", and that "The Passcode field shall be optional unless the passcode has been requested and assigned by the end user."13 The list exists to stop losing carriers from blocking legitimate ports with paperwork. The side effect: unless you have asked for a passcode, a port request is checked against the account number, ZIP code and similar details, many of which are printed on every bill. Asking your landline or VoIP provider for a port-out passcode takes ten minutes, and the rule then makes it a required field.

Large accounts can contract out. Section 64.2010(g) lets carriers agree "authentication regimes other than those described in this section" with business customers that have "both a dedicated account representative and a contract that specifically addresses the carriers' protection of CPNI".2 The FCC said the new rules are not "intended to supersede" that exemption.1 If that is you, your protection is whatever the contract says.

Canada: no rule, a confidential industry fix

Canada There is no Canadian regulation on SIM swap or port-out fraud. We found no CRTC decision, regulatory policy or code provision setting authentication, notification or lock requirements for SIM changes or number transfers. What exists is a staff-level information-gathering file, 8665-C12-202000280, "Fraudulent Wireless Customer Transfers".34

It began on 15 January 2020, when CRTC staff told the Canadian Wireless Telecommunications Association (CWTA) that "certain Canadian mobile customers have been subject to fraudulent activity involving unauthorized porting of their mobile phone numbers" and asked for the industry's plans.28 In May 2020 staff asked each carrier for monthly data and for "whether and how the person's identity is verified" for a SIM swap.29

The industry's answer was an enhanced validation process designed through the CWTA, and its details are confidential. The Public Interest Advocacy Centre sought disclosure and a public consultation; in October 2020 staff refused, concluding that "the specific measures being implemented to enhance the verification process for transfers of mobile telephone numbers and SIM swaps should not be disclosed" because disclosure "would provide fraudsters with a better understanding of the processes intended to elude them".30 Staff also declined to publish the carriers' fraud counts.30

What was disclosed is the result. In July 2021 CRTC staff announced "a 95% decline in the total number of unauthorized mobile telephone number transfers and SIM swaps from October 2020 to May 2021."31 In February 2022 staff thanked carriers "for having succeeded in significantly reducing the occurrence of these fraudulent activities" and cut the monthly reporting back.32 By June 2023, in a letter headed "Compliance and Enforcement", carriers were asked to report unauthorized SIM swaps and unauthorized ports only for months in which the total across all their brands reached six or more.33 The last staff letter in the public file, in an Internet Archive copy from October 2025, is dated 18 January 2024.34

The visible part of the fix is a text message. Rogers says that "As of November 3rd, 2020, you will need to authorize your number transfer before it can be completed": the account holder gets a text, must reply "Yes", and if there is no reply within 90 minutes the request is cancelled.35 Its fraud page gives the wording, "To approve this request, please reply YES. To cancel it, simply reply NO."36 We did not verify equivalent first-party pages from Bell or TELUS, so we do not claim the same wording or window applies there.

Our view on the Canadian model: a confirmation text works well against port-out fraud on its own. It does nothing if the attacker has already done a SIM swap, because the text then goes to the attacker. The ordering attack (swap the SIM, then approve the port) is exactly what a lock on SIM changes is for. Canada has no public requirement for that lock, and the CRTC's own file shows how much the protection depends on a text being seen: it cites a news report of a customer who missed a warning text and "assumed it was a scam".29

What the major carriers offer today

The large US carriers already publish free tools that do most of what the 2023 rules would require. They are opt-in, they sit in different menus, and some must be enabled per line.

Scroll the table sideways to see every column.

Three details are worth knowing before you need them. After SIM Protection is turned off, Verizon keeps SIM changes and upgrades "blocked for 15 minutes"22, a delay that works against someone in a hurry. Verizon says "Number Lock must be turned off to successfully port out"22, and T-Mobile's porting steps start with disabling Port Out Protection25, so a forgotten lock will also block your own legitimate port; our porting guide lists a port-out freeze as a common cause of rejection. And the person who can lift the lock is the real control. If that is a former office manager's login, fix it now.

Landline and VoIP providers vary too much to tabulate. Ask yours in writing: can you put a passcode on port-out requests13; can the account be locked against port-outs and call-forwarding changes; and how will you tell us about a port request, on a channel other than the number itself?

A protection checklist for a business number

Ordered by how much protection each step buys for the time it takes. None of it depends on the FCC's rules coming into force.

1. Find out what the number actually is. Mobile, landline, VoIP or toll-free; who holds the account, under which legal name; which login can authorise changes. You need the same facts for a clean port.
2. Turn on every lock the carrier offers, on every line that matters. On mobile: the port-out lock and the SIM-change lock, since they are separate features at Verizon and T-Mobile.2224 Check per-line settings where they apply.24
3. Set an account PIN or passcode, and a port-out passcode on landline and VoIP accounts. For a simple landline or VoIP port, the passcode field is optional unless you asked for one, so ask.13 Use a random value kept in the company password manager, not a date or the last digits of the number.
4. Secure the carrier's own login. The carrier portal is where locks are lifted and PINs are generated.1923 Protect it with an authenticator app or security key, and do not let its recovery codes go by text to the line it controls.
5. Take the business number out of SMS two-factor sign-in. Start with email, bank, payroll, domain registrar, DNS host and the carrier itself, and move them to an authenticator app or security key, as the FBI advises ("physical security tokens, or standalone authentication applications").15 Where a service offers only SMS, use a separate, unpublished, locked number, never the published line.
6. Agree a bank callback procedure that does not rest on one number. The FBI says to verify changes through a secondary channel.17 Have the bank call a named person on a number that is not the published line, and use a passphrase or in-app confirmation for large transfers.
7. Limit who can talk to the carrier for you. Remove former staff and old authorised users. On AT&T, primary and secondary users can switch the lock;19 on Verizon, account owners and managers;22 on T-Mobile, only the primary account holder can remove protection.24 Keep that list short.
8. Watch for the warning signs. A phone that suddenly shows no service or emergency calls only while others nearby are fine; a text or email about a SIM change, a port request or a transfer PIN you did not ask for; customers saying calls are not reaching you. At Rogers the confirmation text gives you 90 minutes;35 make sure the line that receives it is watched.
9. Write the incident plan now. The carrier's fraud number and your account number, kept somewhere that does not depend on the hijacked phone, and the bank's fraud line. After a fraudulent transfer, the FBI says, "time is of the essence".17
10. Review once a year. The FCC tells carriers to review their authentication "not less than annually".2 Do the same: who holds the account, which locks are on, which services still text codes to the business number.

If your number goes dark

A SIM swap or port-out is a race. The attacker needs only minutes to collect sign-in codes once the number is theirs.

1. Call the carrier from another phone, report a suspected SIM swap or fraudulent port, and ask them to reverse it, freeze the account and note the time.
2. Call your bank's fraud line and tell them not to trust that number until you confirm. If money has moved, the FBI says to "Immediately contact your financial institution and request a recall of the funds".17
3. From a clean device, change passwords and second factors, email first (it can reset everything else), then banking, payroll, the registrar and the carrier portal.
4. Report it. In the US, the FBI asks victims to file with IC3 "as soon as possible".17 In Canada, Rogers points victims to the police and the Canadian Anti-Fraud Centre, as well as their bank, card issuers and the credit bureaus.36
5. Get documentation. Ask the carrier, in writing, for a record of the fraudulent change. The FCC's adopted text would make carriers "Promptly provide customers, upon request, with documentation of fraudulent number ports",1 but until a compliance date is announced that is a request, not a right.

Our view: where the regulatory gap is

The FCC's 2023 order is sound in substance: baseline rules, a free lock, notice before the change, and SIM-change authentication that may not rely on "readily available biographical information" or "recent payment information", which is exactly how these attacks succeed.2 Our four criticisms rest on the record above.

1. A finished rule is waiting on an administrative step. OMB finished its review on 15 January 2025.67 The 2024 order said the remaining step was a Federal Register notice of the compliance date.4 It has not appeared, so not even the parts that never needed OMB review are yet required.23 In 2024 the Bureau refused the industry's request for a longer delay, citing "the urgency of addressing these types of pernicious fraudulent schemes".4 Twenty-one months after OMB approval, that urgency is hard to see in the CFR.

2. The scope follows the 2021 record, not where business numbers live now. The FCC limited the rules to mobile carriers because "the record shows that port-out fraud is focused on mobile wireless customers".1 A small business's published number is now often on a cloud phone system or VoIP line, where the port check is a short list of fields with the passcode optional by default,13 and no specific rule governs a call-forwarding change made in an online portal. We think the Further Notice question on extending employee-access limits "to all telecommunications carriers"11 should be widened to port-out authentication and locks for VoIP and wireline numbers. Interconnected VoIP providers already count as "telecommunications carriers" for the CPNI subpart.12

3. The real weakness sits with the businesses that trust the phone number. The FCC acknowledged that "the harmful effects of SIM swap and port-out fraud may extend beyond the control of wireless providers and that the incentives to engage in such fraud implicate the security practices of other industries".1 It then confined itself, reasonably, to what is within its own authority.1 But as long as banks, email providers and registrars accept a text to a phone number as proof of identity, carriers carry a burden they cannot fully meet. NIST has given its answer: phone-delivered codes are "restricted".18 The overdue step is for those relying parties to stop making the published business line the key to the account.

4. Canada's approach worked, as far as anyone outside can tell, but it cannot be checked. A 95% fall between October 2020 and May 2021 is a strong result.31 But the measures are confidential,30 small monthly counts are no longer reported,33 and there is no public rule a business could cite in a dispute. Confidentiality has some force for technical details, none for the basics: whether a SIM-change lock exists, whether it is free, and whether a carrier must document a fraudulent transfer. A short public CRTC baseline along the lines of the FCC's lock, notice and remediation paragraphs would cost the industry little.

Until then, the protection is in your hands: lock every line, add a passcode where the rules make it optional, and take the business number off the list of things that prove who you are. For moving a number legitimately, see our porting guide and the long-form article how long does it take to port a phone number.