A password reset looks routine: the customer has forgotten their password, requests a code and wants to regain access. The risk changes if the mobile number receiving that code was recently moved to another SIM.
That is why detecting SIM-swap risk is most useful when it is tied to a meaningful event. A check at the right point can give a business additional carrier-derived context before it changes account details, releases a payout or relies on a mobile number for recovery. It cannot identify the person behind the request or decide what should happen next.
This guide explains where a SIM swap signal may fit, what it can and cannot tell you, and how to use it as one part of a layered account takeover control.
What does it mean to detect SIM swap fraud?
In a SIM swap, a mobile number's service is transferred to another SIM. If the change is unauthorised, someone else may receive calls or SMS messages for the number. A detection check looks for carrier-derived evidence of a recent SIM change or related mobile risk information, then returns a signal for the business to assess.
The result is not a statement that the account holder is fraudulent. A customer may have replaced a damaged SIM, moved to a new device or made another legitimate change. The signal needs to be read with the context of the request, the time since the change and other information available to the business.
For background on the fraud itself, read what SIM swap fraud is and the warning signs.
Where should a business check for SIM swap risk?
The best integration point is the moment when the signal can affect a risk-sensitive action. Checking every login may add noise or cost without changing the decision. A business could consider using a check when a request involves:
Password reset or account recovery
If the mobile number is used to recover an account, recent SIM activity may be relevant before the recovery flow grants access or changes authentication settings. Combine it with other checks, such as established device history and the account's normal recovery controls.
Adding a payee or changing payout details
A new destination for funds can be a high-impact change. A business may assess mobile signals before accepting the change or releasing a payment, based on its own policy and the full case context.
Changing contact or security details
If someone changes the phone number, email address or recovery method, a recent mobile event can add useful context. The business can decide whether to proceed normally, ask for another form of verification or route the request for review.
High-risk transactions
Some businesses may include a mobile risk check before a transaction that is unusually large or different from the customer's normal activity. Mobile signals should sit alongside transaction and account controls rather than replace them.
A practical detection flow
- Identify the event. Decide which actions warrant the check, such as account recovery or a payout detail change.
- Use the number connected to the event. Send the mobile number relevant to the customer's current request.
- Read the returned signal and reason codes. Assess the result as evidence, not as an automated conclusion about intent.
- Apply proportionate rules. Continue, add verification or refer for review according to your risk policy.
- Keep an operational record. Link the check and the business action in your own control environment so the case can be understood later.
TDS Risk Trust Score provides a carrier-derived mobile risk view and reason codes. The business defines how its own systems respond. See the TDS Risk reason code guide and API quickstart for implementation information.
The useful signal is not a decision by itself; it is timely evidence that helps your existing controls choose the right next step.
What a SIM swap signal cannot prove
A carrier-derived signal does not prove who is using the phone, why a SIM changed or whether a specific transaction is fraudulent. It cannot replace customer authentication, account history, device analysis or transaction monitoring. It should not be described as a guarantee that account takeover will be prevented.
It is also separate from Mobile KYC. Trust Score assesses mobile-number risk signals. Mobile KYC checks whether submitted name, address and date of birth match carrier-held information associated with the specific number provided. A business may use one or both, depending on the question it needs to answer.
Make the response fair and useful
Set out in advance how a recent SIM signal can affect the journey. A high-impact action may warrant an additional check, while a lower-risk interaction may continue. Give legitimate customers an accessible way to complete verification and make sure any review process has clear ownership.
Measure the effect using your own outcomes. Compare how often the signal appears in different event types, how frequently a review changes the action and whether the process adds friction for legitimate customers. Do not assume that every flagged event represents a confirmed fraud case.
Review TDS Risk pricing or the Trust Score overview to see how carrier-derived checks can fit into your existing workflow.
Summary
To detect SIM-swap risk before account takeover, place a carrier-derived check around actions where the mobile channel matters: recovery, contact changes, payee or payout changes and selected high-risk transactions. Interpret the signal with other evidence and let your own policy determine the next step.
For another related guide, see SIM swap fraud warning signs and SIM swap versus number porting.
Use carrier-derived mobile risk signals as evidence within your own account security controls.
Explore Trust Score 👉🏼Frequently asked questions
If it's not here, ask us directly — we reply within one UK business day.
