{
 "slug": "line-change-authorization",
 "topic_id": "TOPIC-151",
 "cluster": "Telecom Carrier & Subscriber Identity",
 "tier": "Tier A",
 "title": "The subscriber never signs: why SIM-swap rules harden the wrong side",
 "summary": "FCC rules require carriers to authenticate securely before a SIM change or port. That is a control on the carrier. eSIM provisioning compressed the attack to about two minutes, and the one party who could end it is never asked for anything.",
 "lede": "Every control the industry has deployed asks the carrier to be better at recognising an impostor. None asks the subscriber to produce something an impostor cannot. As long as a line change can be completed by convincing a human at the carrier, it will be.",
 "date": "2026-01-23",
 "category": "Vertical",
 "author_id": "margot-reyes",
 "tags": [
  "SIM swap",
  "port-out fraud",
  "eSIM",
  "FCC",
  "carrier security",
  "account takeover"
 ],
 "image_title": "Line Change Authorization",
 "schema": "Article",
 "key_takeaways": [
  "FBI IC3 logged 982 SIM swap complaints and $25,983,946 in losses in 2024 — a figure that undercounts because downstream losses are reported under other categories.",
  "eSIM QR provisioning removed the physical SIM and the in-store handoff. A rep or a bribed insider can complete a port in roughly two minutes.",
  "The enrolment-recovery paradox is the real engineering problem: bootstrapping a subscriber credential without recreating the support-channel bypass the control exists to eliminate."
 ],
 "body": [
  {
   "type": "h2",
   "text": "The numbers, with their denominators"
  },
  {
   "type": "diagram",
   "kind": "compare",
   "alt": "Two sides of a line change, one of them regulated",
   "caption": "The subscriber is the only party who can definitively answer the question, and is never asked.",
   "nodes": [],
   "left": {
    "title": "Carrier side (regulated)",
    "items": [
     "Authenticate before change",
     "Notify the subscriber",
     "Record the request",
     "All defeated by a convincing caller"
    ]
   },
   "right": {
    "title": "Subscriber side (unregulated)",
    "items": [
     "Signs nothing",
     "Learns afterwards",
     "Cannot pre-authorise",
     "Could end the attack in one gesture"
    ]
   }
  },
  {
   "type": "p",
   "html": "The FBI's Internet Crime Complaint Center recorded 982 SIM swap complaints in 2024, with reported losses of $25,983,946 — down from 2,026 complaints the prior year. Read those figures carefully before drawing comfort from the decline."
  },
  {
   "type": "p",
   "html": "Complaint counts measure reporting, not incidence, and SIM swap is systematically under-reported because victims experience it as a bank fraud or an exchange account theft. The reported loss attaches to whichever category the victim filed under. A $25.98M direct figure sits alongside downstream losses that are counted elsewhere and are, on every practitioner account, substantially larger."
  },
  {
   "type": "p",
   "html": "The honest summary is: the direct complaint volume fell, the per-incident downstream consequence rose, and neither number tells you about the attempt rate, which carriers hold and do not publish."
  },
  {
   "type": "h2",
   "text": "What the FCC rules do"
  },
  {
   "type": "p",
   "html": "The Commission adopted rules addressing SIM swap and port-out fraud, revising its CPNI and local number portability rules. In substance: carriers must use secure methods of authenticating a customer before effecting a SIM change or a port-out, must notify customers immediately of such requests, and must maintain records of requests and responses."
  },
  {
   "type": "p",
   "html": "Every one of those obligations sits on the carrier. That is the correct place to put a regulatory obligation — the carrier is the regulated entity — and it is also the reason the rules cannot solve the problem, because the attack works by persuading the carrier."
  },
  {
   "type": "h2",
   "text": "What eSIM changed"
  },
  {
   "type": "p",
   "html": "Physical SIM swap had friction: a card, a store, a handoff, sometimes a courier. Remote SIM provisioning replaced all of that with a QR code and an activation code."
  },
  {
   "type": "p",
   "html": "The practical consequence, described by security practitioners and visible in the provisioning architecture itself, is that a profile can be moved to an attacker-controlled device in about two minutes, with no physical artefact and no in-store identity check. An insider at a retail or care desk can complete it inside a normal-looking transaction."
  },
  {
   "type": "table",
   "caption": "Where each control acts. Note that every row operates on the carrier side.",
   "head": [
    "Control",
    "Acts on",
    "Defeated by"
   ],
   "rows": [
    [
     "Account PIN",
     "Carrier verification",
     "Social engineering; PIN reset through the same channel"
    ],
    [
     "Port freeze",
     "Carrier verification",
     "Removal through the same channel"
    ],
    [
     "In-store ID check",
     "Carrier verification",
     "Not invoked for eSIM remote provisioning"
    ],
    [
     "Delay window",
     "Carrier verification",
     "Patience"
    ],
    [
     "Fraud scoring on change requests",
     "Carrier verification",
     "A request that looks ordinary"
    ],
    [
     "Subscriber signature",
     "<strong style=\"font-weight:600\">Subscriber</strong>",
     "Nothing the carrier can be persuaded to do"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "The last row, stated precisely"
  },
  {
   "type": "p",
   "html": "If a line change requires a fresh assertion from a credential held on the subscriber's enrolled device, then no amount of persuasion applied to carrier staff produces the change. The insider cannot complete it. The social engineer cannot complete it. The person who knows the subscriber's mother's maiden name, last four payments and account PIN cannot complete it."
  },
  {
   "type": "p",
   "html": "That is a categorical difference from every other row, and it is the reason this is worth the engineering difficulty that follows."
  },
  {
   "type": "h2",
   "text": "The enrolment-recovery paradox"
  },
  {
   "type": "p",
   "html": "Here is the hard part, and any proposal that skips it is not serious. The subscriber's credential lives on a device. Devices are lost, broken, stolen and replaced. So there must be a recovery path — and a recovery path that carrier staff can execute is precisely the support-channel bypass the control was built to eliminate."
  },
  {
   "type": "p",
   "html": "Three designs, honestly scored:"
  },
  {
   "type": "table",
   "head": [
    "Design",
    "Insider resistance",
    "Social engineering resistance",
    "Usability on device loss"
   ],
   "rows": [
    [
     "Carrier staff can re-enrol on verification",
     "None",
     "None",
     "Excellent"
    ],
    [
     "Second enrolled authenticator required; staff cannot re-enrol",
     "Strong",
     "Strong",
     "Poor if the subscriber enrolled only one"
    ],
    [
     "Staff can initiate re-enrolment; completion requires a delay plus notification to all prior authenticators",
     "Moderate",
     "Moderate",
     "Good"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The second row is correct and will strand subscribers. The third is a compromise and is where most deployments will land. The first is where most deployments will land if nobody makes the argument, and it is worth nothing."
  },
  {
   "type": "h2",
   "text": "Making the override a signed exception"
  },
  {
   "type": "p",
   "html": "If a human override path must exist — and for a consumer service at national scale it must — then make it an artefact rather than a capability."
  },
  {
   "type": "p",
   "html": "An override is performed by a named supervisor, signs a canonical statement of what was overridden and on what basis, carries a delay, and notifies every enrolled authenticator. It becomes a rare, attributable, reviewable event rather than an unlogged discretion exercised thousands of times a day."
  },
  {
   "type": "h2",
   "text": "What to measure"
  },
  {
   "type": "ol",
   "items": [
    "Line changes per month, split by channel: self-service, care, retail, dealer.",
    "Share of subscribers with any authenticator enrolled, and share with two.",
    "Override rate per thousand changes, by store and by agent.",
    "Time from change to subscriber notification, measured rather than specified."
   ]
  },
  {
   "type": "p",
   "html": "The third of these will be the uncomfortable one, and it is the one that tells you whether the control is real."
  },
  {
   "type": "h2",
   "text": "What eSIM changed"
  },
  {
   "type": "table",
   "caption": "Provisioning time and attacker economics",
   "head": [
    "Era",
    "Change mechanics",
    "Attack window"
   ],
   "rows": [
    [
     "Physical SIM",
     "Ship or collect in store",
     "Days"
    ],
    [
     "Store activation",
     "In person",
     "Hours"
    ],
    [
     "<strong style=\"font-weight:600\">eSIM remote provisioning</strong>",
     "<strong style=\"font-weight:600\">Download a profile</strong>",
     "<strong style=\"font-weight:600\">Minutes</strong>"
    ]
   ]
  },
  {
   "type": "p",
   "html": "A control designed around a delay does not survive the delay disappearing. Notification after the fact is now notification after the accounts have been drained."
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Carriers are doing what the rules require.”</strong> Largely, yes. The rules constrain the carrier and the attack targets the carrier's staff, so compliance and exposure move independently."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“A subscriber signature adds friction to a legitimate change.”</strong> Once, on a change most subscribers make every few years. Compare that to the friction of an account takeover."
  }
 ],
 "faq": [
  {
   "q": "Do the FCC rules not already require strong authentication?",
   "a": "They require secure authentication methods and prompt notification. Those are obligations on the carrier's verification process. The distinction drawn here is between verifying the requester and requiring an act only the subscriber can perform."
  },
  {
   "q": "What about subscribers with no smartphone?",
   "a": "They need a path that does not exclude them, which means the override exists by design. The goal is to make it rare and attributable, not to eliminate it."
  },
  {
   "q": "Does this stop downstream account takeover?",
   "a": "It removes the phone number as the compromise vector. It does nothing about relying parties who accept other weak recovery factors."
  },
  {
   "q": "Would carriers adopt this voluntarily?",
   "a": "The commercial case is remediation, churn and litigation cost, plus a differentiated position with high-value subscribers. Whether that outweighs implementation cost is a carrier-specific calculation."
  },
  {
   "q": "Why don't carrier rules stop SIM swap?",
   "a": "They constrain the carrier, and the attack works by deceiving carrier staff. Compliance and exposure move independently."
  },
  {
   "q": "What did eSIM change?",
   "a": "It removed the physical step. A change that used to take days now takes minutes, and notification after the fact arrives too late."
  },
  {
   "q": "What would a subscriber signature add?",
   "a": "The one thing no caller can produce. It is friction once every few years against a takeover that drains accounts."
  }
 ],
 "sources": [
  {
   "t": "FCC rules and regulations",
   "u": "https://www.fcc.gov/general/rules-regulations-title-47"
  },
  {
   "t": "FBI IC3 2025 Internet Crime Report",
   "u": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
  },
  {
   "t": "GSMA — eSIM remote SIM provisioning specifications",
   "u": "https://www.gsma.com/esim/esim-specification/"
  },
  {
   "t": "FCC — protecting consumers from SIM swap and port-out fraud",
   "u": "https://www.fcc.gov/sim-swap-port-out-fraud"
  }
 ],
 "related": [
  {
   "slug": "insider-completable-operations",
   "title": "The bribed rep problem",
   "category": "Definitional"
  },
  {
   "slug": "identifier-durability-model",
   "title": "Recycled numbers",
   "category": "Vertical"
  },
  {
   "slug": "carrier-as-authorization-party",
   "title": "Selling the number as a trust signal",
   "category": "Vertical"
  },
  {
   "slug": "wholesale-instruction-receipts",
   "title": "Telecom interconnect and settlement identity",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Line%20Change%20Authorization/1200_630/blog.jpg",
 "wordcount": 1107,
 "url": "/blog/line-change-authorization.html",
 "reading_time": "5 min read",
 "seo_title": "Why SIM-swap rules harden the wrong side",
 "meta_description": "Rules require carriers to authenticate securely before a SIM change or port. eSIM provisioning compressed that attack to minutes.",
 "hub": {
  "slug": "topics/telecom-identity",
  "title": "Telecom and subscriber identity"
 },
 "answer": "Because they impose duties on the carrier, and the one party who could end the attack is never asked for anything. FCC rules require secure authentication before a SIM change or port. eSIM provisioning compressed the attack to minutes, and the subscriber still signs nothing.",
 "answer_q": "Why do SIM-swap rules harden the wrong side?",
 "glossary": [
  {
   "term": "SIM swap",
   "def": "Moving a subscriber's number to an attacker-controlled SIM, usually by deceiving carrier staff."
  },
  {
   "term": "Port-out",
   "def": "Moving a number to a different carrier, which achieves the same result through a different process."
  },
  {
   "term": "eSIM provisioning",
   "def": "Downloading a subscriber profile remotely, which removes the physical step and the delay that came with it."
  }
 ],
 "checklist": {
  "title": "What a carrier could offer",
  "id": "offer",
  "desc": "Four steps, none requiring rule changes.",
  "steps": [
   {
    "name": "Let subscribers enrol a credential.",
    "text": "Optional, and the ones who opt in are the ones with the most to lose."
   },
   {
    "name": "Require a signature for SIM change and port-out.",
    "text": "Rendering the change being made."
   },
   {
    "name": "Offer a pre-authorised delay.",
    "text": "So even a signed change cannot take effect instantly."
   },
   {
    "name": "Expose a verifiable signal to relying parties.",
    "text": "A bank should be able to check recency without calling the carrier."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav puts the subscriber or the authorising party back in the loop for the changes that matter, with a signature bound to the specific change and verifiable by a bank, a regulator or a counterparty without calling the carrier.",
  "href": "../docs.html",
  "label": "See change authorisation"
 }
}