SIM Swap Detection

Direct integration with mobile network operator APIs to receive real-time notifications of SIM card changes. This is the gold standard signal, providing authoritative confirmation that a subscriber identity module has been reassigned.

• SS7 signaling analysis detects the exact moment a new SIM is provisioned
• Number Portability Check identifies if a number was recently ported to a new carrier
• IMSI change detection flags when the International Mobile Subscriber Identity associated with a phone number changes
• Typical latency: sub-second to 30 seconds depending on carrier integration depth

When a SIM swap occurs, the victim's phone number is now associated with an attacker's physical device. Monitoring for abrupt device identity changes tied to the same account provides a strong heuristic signal.

• Device ID hash changes when the same phone number appears on new hardware
• IMEI mismatch between the expected device and the newly registered handset
• Operating system version and browser fingerprint inconsistencies with historical baselines
• This signal is passive, requiring no carrier relationship, but is susceptible to emulator spoofing

Cross-referencing the IP address geolocation and network provider against the claimed mobile carrier to detect inconsistencies. A legitimate SIM swap should not cause an immediate, impossible geographic relocation.

• IP-to-carrier mismatch: Device claims to be on Verizon but IP originates from a T-Mobile data center
• Geolocation discontinuity: Phone number last seen in Chicago suddenly authenticates from Lagos within minutes
• ASN analysis reveals if traffic routes through unexpected autonomous systems or hosting providers
• Combine with impossible travel velocity checks for high-confidence scoring

Monitoring the delivery status of SMS-based one-time passcodes as a passive detection layer. When a SIM swap executes, the legitimate user's device stops receiving messages while the attacker's device begins receiving them.

• Delivery receipt codes shift from 'delivered' to 'undeliverable' or 'absent subscriber'
• Sudden SMS routing changes to a different SMSC address
• Time-to-deliver spikes as messages traverse unfamiliar network paths
• This signal is retrospective but provides strong confirmation when correlated with other indicators

After a SIM swap, the human operating the account changes entirely. Passive behavioral signals detect this identity shift even if the attacker has valid credentials.

• Keystroke dynamics and typing cadence deviate from the established user profile
• Touchscreen pressure patterns and swipe geometry change on mobile applications
• Interaction timing with security prompts differs from historical norms
• This signal is continuous and operates post-authentication, catching attackers who bypass initial SIM swap detection

Deep packet inspection of telecom signaling protocols to detect SIM provisioning events at the network layer. This requires specialized telecom infrastructure access but provides the earliest possible detection.

• Update Location Request messages in SS7 indicate a subscriber's association with a new MSC/VLR
• Insert Subscriber Data operations in Diameter signaling reveal profile changes
• Cancel Location messages sent to the previous MSC confirm the handover
• This is the same signaling data used by carriers internally, offering near-zero false positive rates when properly instrumented

A geolocation-based security rule that flags a login when the physical distance between two successive access points cannot be traversed in the elapsed time. SIM swap attacks often originate from a different geographic location than the victim.

• Mechanism: Calculates speed required between two geolocated events
• SIM swap correlation: A login from a new location immediately following a SIM swap event is a critical risk signal
• False positive mitigation: Combine with device fingerprint changes to reduce friction for legitimate device upgrades

A security mechanism that persistently validates user identity throughout a session by passively analyzing behavioral biometrics and device signals. Post-SIM swap, the attacker's behavioral patterns will diverge from the established baseline.

• Signals analyzed: Keystroke dynamics, mouse movements, touchscreen pressure, swipe patterns
• Advantage over point-in-time auth: Detects account takeover even after the initial login succeeds
• SIM swap response: Triggers step-up authentication or session termination when behavioral mismatch coincides with carrier change events

An adaptive security framework that dynamically adjusts authentication requirements based on a real-time risk score. A confirmed SIM swap event elevates the risk score, triggering additional verification challenges.

• Inputs: Device reputation, geolocation, behavioral anomalies, and carrier event feeds
• Response to SIM swap: Forces step-up authentication such as hardware token, biometric verification, or out-of-band confirmation
• Implementation: Integrates with Mobile Network Operator APIs to receive real-time SIM change notifications

The identification of an attack where a valid user session is compromised through stolen session cookies or tokens. SIM swaps are frequently a precursor to session hijacking, as the attacker intercepts SMS-based two-factor authentication codes.

• Detection signals: Abrupt changes in device fingerprint, IP geolocation, or behavioral biometrics mid-session
• SIM swap linkage: An SMS 2FA code being used from a new device immediately after a carrier-level swap event
• Mitigation: Combine with SIM swap detection to invalidate active sessions upon confirmed carrier changes

A comprehensive security strategy combining multiple signals to identify unauthorized account access. SIM swap detection serves as a critical early warning component within the broader ATO detection framework.

• Signal fusion: Device fingerprinting + behavioral biometrics + impossible travel + carrier event feeds
• SIM swap as trigger: A confirmed SIM swap elevates the account to high-risk status, initiating enhanced monitoring
• Response automation: Automatic session termination, transaction blocking, and customer notification upon high-confidence SIM swap detection