A customer tries to sign in to their bank and suddenly their phone has no service. Around the same time, password reset codes begin arriving somewhere else. This is one way a SIM swap can become part of an account takeover.

SIM swap fraud happens when a criminal gets a mobile operator to activate the victim's number on a SIM or device the criminal controls. Calls and texts intended for the customer may then be redirected, including some security messages. The event is a serious risk signal, but a recent SIM change by itself does not prove fraud: customers replace lost or damaged SIMs and change devices for legitimate reasons.

For businesses that rely on mobile numbers in onboarding, account recovery or high-risk account changes, the useful question is not simply whether a SIM changed. It is whether available carrier-derived information should influence the next step in the business's own process.

What is SIM swap fraud?

A SIM swap is a change that moves a mobile number's service from one SIM to another. In a fraudulent SIM swap, someone impersonates the customer or otherwise manipulates the operator's process so that the new SIM is under the criminal's control. If successful, the criminal may receive calls and SMS messages sent to that number.

That can matter when a service uses text messages for password recovery, one-time passcodes or notifications. A SIM swap does not automatically give access to an online account: the attacker may still need credentials or to defeat other controls. It can, however, weaken a control that assumes the legitimate customer still receives messages sent to their number.

The UK Government has described SIM-swap attacks as a route criminals use to intercept one-time passcodes and bypass some SMS-based two-factor authentication. Read its overview of unauthorised fraud and SIM-swap attacks for current UK context.

A simple account takeover story

Imagine a customer who has used the same mobile number for years. A criminal obtains enough personal information to impersonate them with the mobile provider. The provider is persuaded to move the number to a different SIM. The customer loses service, while the criminal can receive messages sent to the number.

The criminal then attempts a password reset on an account that relies on SMS. If the account's other safeguards are weak, a code may help the criminal progress. A carrier-derived SIM-change signal can give the business another piece of context when the customer or account requests a sensitive action.

That signal is not a verdict. It does not identify the person making the request and it does not tell a business to reject a customer. The business can apply its own rules, for example by allowing the normal journey, requesting additional verification or sending the case for review.

Warning signs associated with a possible SIM swap

For an individual, sudden loss of mobile service, an unexpected message about a SIM activation or unexplained account activity can be reasons to contact the mobile provider and affected financial services promptly. NatWest's SIM swap fraud guidance describes common consumer warning signs.

For a business, the signals are different. A service may not see whether a customer has lost reception, but it can check carrier-derived information available for the number at the time of a transaction or account event. Depending on the service and its response, this can include recent SIM activity and other mobile-number risk indicators.

Useful business triggers to consider include:

  • A password reset followed by a high-value action.
  • A new payee, payout destination or payment instrument.
  • A change to contact or recovery details.
  • An unusual account recovery request.
  • An application where the mobile number is an important contact or authentication channel.

These are examples of where a business might choose to assess mobile signals. They are not rules that fit every customer or product.

How businesses can use a SIM swap signal

The point is to place the check where it can inform a decision, not to treat one signal as a fraud decision. A typical flow is:

  1. Collect or confirm the mobile number the customer is using for the journey.
  2. Run a carrier-derived mobile risk check at a relevant event, such as onboarding or an account change.
  3. Read the Trust Score and any returned reason codes alongside the rest of the case.
  4. Apply the organisation's own policy to continue, request more evidence or route for review.
  5. Record the check and the resulting action in the organisation's process.

TDS Risk Trust Score provides carrier-derived mobile risk information for a business's workflow. It is separate from Mobile KYC, which compares submitted identity details with carrier-held details associated with the number entered. See TDS Risk, the reason code guide and pricing for product details.

A mobile account change shown alongside a carrier signal and a review step, illustrating how a recent SIM event can add context to a security check.

A recent SIM change is useful context for a risk decision; it is not proof that the customer is a fraudster.

SIM swap checks are one layer, not the whole control

Mobile risk information is most useful alongside controls that address other parts of the journey. Depending on the business, those may include authentication that does not depend on SMS alone, device and session signals, account history, transaction monitoring and a clear recovery process.

It is also important to avoid using a mobile signal as a blanket reason to deny service. A legitimate SIM replacement, number transfer or device change can produce events that deserve context. The organisation should decide what evidence is relevant, how long it remains relevant and what proportionate follow-up is appropriate.

For teams building an integration, the TDS Risk quickstart explains how to begin. Continue with how to detect SIM swap risk before account takeover for a practical workflow.

What to remember

SIM swap fraud can redirect calls and texts, which may put SMS-based account recovery at risk. Recent SIM activity can help businesses add context around onboarding, account recovery or sensitive changes. It should be combined with other evidence and handled under the business's own rules, because a signal is not a final decision.

If you want to understand what a change signal can add to your existing checks, start with TDS Risk and review the Trust Score pricing.

See how carrier-derived mobile risk signals can add context to your existing checks.

Explore Trust Score 👉🏼
FAQ

Frequently asked questions

If it's not here, ask us directly — we reply within one UK business day.

What is SIM swap fraud?
SIM swap fraud is when a criminal persuades or manipulates a mobile operator into moving a victim's number to a SIM or device the criminal controls, potentially allowing calls and texts to be redirected.
Does a SIM swap always mean fraud?
No. Customers may replace a lost or damaged SIM or change devices for legitimate reasons. A recent SIM change is a risk signal to interpret with other information, not proof of fraud.
Can SIM swap detection stop account takeover?
A carrier-derived SIM-change signal can help a business assess risk at a relevant point, but it cannot guarantee prevention. The business should combine it with other controls and apply its own policy.
How is Trust Score different from Mobile KYC?
Trust Score assesses carrier-derived mobile risk signals. Mobile KYC compares the submitted name, address and date of birth with carrier-held information associated with the number entered.
When should a business check for recent SIM activity?
A business may choose to check around onboarding, account recovery or sensitive account changes. The appropriate point and response depend on its own risk model and workflow.

Relevant tags:

#SIM Swap Fraud #SIM Swap Detection #Mobile Risk #Account Takeover #Trust Score