Section: Account security · Last updated: October 26, 2026
This guide is based on the FCC Report and Order “Protecting Consumers from SIM-Swap and Port-Out Fraud” (FCC 23-95, WC Docket No. 21-341, 88 FR 85794, December 8, 2023) and the text of 47 CFR 52.37 and 64.2010(h) in the Electronic Code of Federal Regulations as of October 1, 2026. It is general information, not legal advice.
In a SIM swap, someone persuades a mobile carrier to move your phone number to a SIM card they control. In a port-out, they move your number to a different carrier. Either way, calls and text messages, including one-time sign-in codes, go to them instead of you. The FCC describes both as ways to take control of a cell phone account “without ever gaining physical control of a consumer’s phone”.
In November 2023 the FCC adopted rules for U.S. wireless providers, including resellers and both prepaid and postpaid service. The rules were split into two groups with different start dates, and that split matters when you ask your carrier what it must do.
1. What the FCC adopted
| Requirement | SIM change 47 CFR 64.2010(h) |
Port-out 47 CFR 52.37 |
Group |
|---|---|---|---|
| Secure authentication before acting on the request | (h)(1) | (b) | A |
| Staff cannot see account data (CPNI) until the caller is authenticated | (h)(1) | — | A |
| Employee training on fraudulent requests | (h)(7) | (f) | A |
| Procedures for failed authentication attempts | (h)(2) | — | B |
| Immediate notice to you before the change is made | (h)(3) | (c) | B |
| Free account lock you can turn on and off | (h)(4) | (d) | B |
| Notice of protection options on the website and app | (h)(5) | (e) | B |
| Free fraud reporting, prompt investigation, and documentation on request | (h)(6) | (g) | B |
| Records of SIM change requests kept for at least three years | (h)(8) | — | B |
Group A became effective with the order on January 8, 2024, and the order gave carriers six months to comply. Group B contains information-collection requirements, so the Federal Register notice says those paragraphs are “delayed indefinitely” until the FCC publishes an effective date after review by the Office of Management and Budget.
2. Where the rules stand in the current code
In the eCFR text as of October 1, 2026:
- 64.2010(h)(2) to (6) and (h)(8) are shown as “[Reserved]”, and so are 52.37(c) to (e) and (g). The notice, lock, reporting and recordkeeping text from the 2023 order is not yet printed in the code.
- Both sections still end with a compliance paragraph saying compliance “will not be required until this paragraph is removed or contains a compliance date.”
So the order sets out what the FCC expects, but the dates printed in the code have not caught up. Before relying on a specific duty, check the FCC’s docket (WC Docket No. 21-341) and the current eCFR for a compliance date.
3. What “secure authentication” excludes
Paragraph (h)(1) says a carrier’s authentication methods “shall not rely on” these, unless the Safe Connections Act rules for survivors of domestic violence allow otherwise:
- readily available biographical information
- account information
- recent payment information
- call detail information
The carrier must also review its authentication methods “not less than annually”. In plain terms, a caller who knows your address, your last bill amount or who you called last week should not be able to move your number on that alone.
4. Steps you can take now
- Ask your carrier which protections it offers. Ask about options such as an account PIN or a lock on SIM changes and number transfers, and turn on what is available.
- Move important accounts off text-message codes. If your bank, email or crypto account allows an authenticator app, a security key or a passkey, use it instead of SMS. A number moved by fraud then cannot receive your sign-in codes.
- Watch for sudden loss of service. If your phone shows no signal in a place where it normally works, and you did not change anything, contact your carrier from another phone right away.
- Report fraud to the carrier and keep records. Ask for written documentation of the fraudulent change; the 2023 order includes this among the Group B duties.
- File a complaint if needed. The FCC order states that it encourages customers to submit complaints and evidence of providers failing to follow these rules. Complaints go through the FCC Consumer Complaint Center.
FAQ
Q. Does this apply to eSIMs?
Yes. The rule defines SIM as “a physical or virtual card” associated with a device that stores information identifying it to a mobile network.
Q. Will an account lock stop me from switching carriers?
Under the adopted text, the carrier may not process a port-out while the lock is on, so you would turn it off first. The order requires that turning the lock on and off not be “unduly burdensome”.
Q. Can the carrier lock my account without asking?
The adopted text allows it when the carrier reasonably believes you are at high risk of fraud, but it must tell you clearly, explain how to turn the lock off, and promptly honor a legitimate request to do so.
Q. Are there exceptions for survivors of domestic violence?
Yes. Notices and locks do not block a legitimate line separation request under the Safe Connections Act (47 U.S.C. 345).
Official sources
- Federal Register, 88 FR 85794 (December 8, 2023) — Protecting Consumers from SIM-Swap and Port-Out Fraud, FCC 23-95, WC Docket No. 21-341
- Electronic Code of Federal Regulations (ecfr.gov) — 47 CFR 52.37 and 47 CFR 64.2010(h)
- Federal Communications Commission (fcc.gov) — Consumer Complaint Center and the WC Docket No. 21-341 record
This article is general information and not legal advice. Compliance dates for the delayed paragraphs are announced by the FCC; check the current eCFR and FCC notices before relying on any requirement.