Telecom & Communications
SIM Swap Risk API
If a one-time code to a phone number is part of your authentication, then a SIM reassignment you cannot see is a hole in it.
- Banks and payment providers
- Crypto exchanges
- Fintech platforms
- Identity and authentication vendors
- High-value marketplaces
What your customers would see
example interfaceMockupIllustrative mockup of the interface we would build. Figures shown are examples, not results from a live deployment.
The problem this solves
SIM swap attacks are simple and effective. An attacker persuades or bribes a carrier representative into porting a victim's number onto a SIM they control, then uses it to receive one-time codes and reset credentials. The victim notices when their phone loses service, which is usually after the account has been drained. For a bank or an exchange, the loss is real and the dispute is uncomfortable because the authentication worked exactly as designed.
The defence is straightforward in principle: before trusting a one-time code, check whether the number was recently reassigned to a different SIM. If it changed four hours ago, require something else. That single check removes most of the attack, and it is why several markets now have regulated or commercially available network signals for exactly this purpose.
The catch is access. This information lives inside carrier systems. It cannot be scraped, inferred from a web page, or derived from calling the number. Obtaining it means a commercial and regulatory arrangement with each carrier or with an authorised aggregator, in each country, and the coverage you end up with is whatever those agreements cover — which is never everywhere.
Who buys this
Banks and payment providers, Crypto exchanges, Fintech platforms, Identity and authentication vendors, High-value marketplaces
What the API returns
What comes back
- Last SIM or device change indicator for a number, where the carrier provides it
- Time-bucketed recency rather than exact dates where the carrier restricts precision
- Porting activity indicators where the market exposes them
- Risk banding tuned to your authentication step-up thresholds
- Per-country and per-carrier coverage reporting, exposed as an endpoint
- Source attribution on every answer: which carrier or aggregator, and by what method
- Explicit unavailable outcomes where no authorised source covers the number
- Audit records suitable for dispute and regulatory review
Endpoints
| Method | Path | Returns |
|---|---|---|
| GET | /v1/numbers/{number}/sim-risk | SIM change risk for one number |
| POST | /v1/numbers/batch | Check several numbers in one authorised call |
| POST | /v1/monitoring | Register numbers for change notification where supported |
| GET | /v1/coverage | Country and carrier coverage with method and limitations |
| POST | /v1/outcome | Report confirmed fraud or a confirmed false positive |
| GET | /v1/checks/{id} | Audit record for a previous check |
Request and response
illustrativeRequest
{
"number": "+447946011222",
"purpose": "authentication_step_up",
"max_age_s": 60,
"consent_reference": "cons_aa1920"
}Response
{
"number": "+447946011222",
"checked_at": "2026-10-22T15:31:02Z",
"available": true,
"source": { "type": "carrier_via_authorised_aggregator",
"carrier": "Example Mobile UK", "method": "network_api" },
"sim_change": {
"recency_bucket": "within_24h",
"exact_date_available": false,
"note": "This carrier returns bucketed recency only; exact change dates are not released"
},
"porting": { "recent_port": false, "lookback_days": 30 },
"risk": { "band": "high", "recommendation": "require_additional_factor" },
"coverage_note": "Available for 4 of 4 UK mobile carriers. Of 19 configured countries, 11 have full coverage, 5 partial, 3 none — see /v1/coverage.",
"audit_reference": "sim_2026102215310200447"
}Where the data comes from
| Carrier network APIs | Direct agreements with mobile operators — the authoritative source, and the one that determines whether this product exists in a given market at all |
| Authorised aggregators | Providers holding carrier agreements across multiple operators, which is the practical route for most buyers |
| Regulated identity and authentication frameworks | Where a market operates a sanctioned scheme for this signal, with defined permitted purposes |
| Your authentication outcomes | Confirmed account takeovers and confirmed false positives, which is the only way to tune your step-up thresholds sensibly |
| Numbering reference data | To identify the serving carrier before a query is routed to the right source |
| Consent and permitted-purpose records | Your own evidence of lawful basis per check, which the carrier agreements generally require you to hold |
The intelligence layer
The difference between a demo and a service is mostly in this section. These are the parts that keep the answer trustworthy once real traffic is hitting it.
- Source routing per number: identify the serving carrier, then query whichever authorised source covers it, with the method recorded
- Normalisation across carriers that return different things — some an exact timestamp, some a bucket, some only a boolean
- Risk banding calibrated against your own confirmed takeover and false-positive history rather than a vendor default
- Latency budgeting for a synchronous authentication path, with a defined behaviour when a source does not answer in time
- Fail-closed or fail-open policy made explicit and configurable, because the right answer differs between a login and a large transfer
- Permitted-purpose enforcement in the request path, so a check cannot be made for a use the carrier agreement does not cover
- Coverage matrix maintained continuously and exposed as an endpoint, since carrier agreements and market rules change
- Audit records for every check with inputs, source and version retained, which is what a dispute or regulator asks for
What it changes for the business
Closed authentication gap
The main SIM swap attack path against one-time codes is detectable before the code is trusted.
Targeted friction
Step-up authentication applies when the signal warrants it rather than to every customer every time.
Dispute position
A retained audit record per check gives you evidence of what was known at the moment of authentication.
Honest coverage picture
You know which countries and carriers are actually protected rather than assuming global cover.
How it fits into your product
How it embeds
- Synchronous check in the authentication path, with a strict latency budget and a defined timeout behaviour
- Step-up hooks into your existing authentication flow rather than a separate decision system
- Coverage endpoint your flow can query, so unprotected markets fall back to a policy you chose deliberately
- Monitoring registration for high-value accounts where the carrier supports change notification
- Deployment inside your own infrastructure, with the carrier or aggregator relationship held by you
- Audit retention configured to match your dispute and regulatory requirements
Included in every build
- Authentication, scoped API keys and per-customer rate limiting
- Input validation with predictable, documented error responses
- Versioned endpoints so your integration never breaks without notice
- Request and response logging for audit and dispute resolution
- Latency, error-rate and usage monitoring with alerting
- OpenAPI specification, sandbox environment and client examples
- Backups, failover design and a documented recovery procedure
- An agreed support arrangement once the service is live
How we would build it
about 20 weeksDiscovery and feasibility
Weeks 1–3
This one depends heavily on data access, so we start by proving the sources exist, can be licensed for your use, and actually carry the signal the model needs. If they do not, you find out here.
Architecture and baseline model
Weeks 4–6
A written architecture and a baseline model measured against a holdout period, so you know what accuracy you are buying before the full build starts.
Production build
Weeks 7–16
Data pipelines, model training and serving, historical archive, validation harness, API, security, monitoring and documentation.
Validation and integration
Weeks 17–20
Backtesting against held-out history, accuracy reporting your team can audit, integration support and an agreed retraining cadence.
Commercial models
There is no fixed price list, because the cost is driven by data complexity, integration count, model requirements, request volume and the support level you need. Scope is agreed in writing before development starts.
Fixed-scope prototype
A defined slice of the service, built and priced as one piece of work. The usual first step when the business case needs proving internally.
Fixed-price build
An agreed scope against a written architecture, delivered for an agreed price. Best when the requirements are already clear.
Build then retainer
We build the service, then operate and improve it under a monthly agreement covering monitoring, updates and model maintenance.
White-label product
The service runs under your brand, your domain and your pricing, with MLPivot invisible to your customers.
Questions buyers ask
Can this be built without carrier agreements?
No. This is the central constraint and it is worth being blunt about it. SIM assignment data exists only inside carrier systems. It cannot be scraped, inferred from a web lookup, derived from calling the number, or guessed from delivery behaviour. Anyone offering global SIM swap data without carrier or authorised aggregator relationships is either reselling something they should not be or selling you a proxy signal that does not do the job. The engineering here is the easy part; the access arrangement is the project.
What coverage should we expect?
Carrier by carrier and country by country, and it will be uneven. Some markets have mature regulated or commercial access across all major operators. Some have partial coverage where two of four carriers participate. Some have none. We would map your actual customer footprint against available sources during discovery and tell you what percentage of your users this can genuinely protect — then design the fallback policy for the rest, because that gap is where the remaining risk sits.
How precise is the change information?
It depends on the carrier. Some return an exact change timestamp. Many return a bucketed recency — within 24 hours, within 7 days — because releasing exact dates raises its own privacy concerns. A few return only a boolean against a fixed window. The API normalises these into comparable bands and states what the underlying source actually gave, rather than presenting a bucket as a date.
Is checking this lawful?
It is processing personal data about a subscriber, so you need a lawful basis, and the carrier agreements themselves define permitted purposes — typically fraud prevention and authentication, and typically not marketing, profiling or general screening. Several markets add specific requirements. We build permitted-purpose enforcement into the request path so a check cannot be made for a use your agreement does not allow, but the lawful basis is yours to establish.
Does a recent SIM change mean fraud?
No. People replace lost phones, upgrade devices, switch to eSIM and port between carriers legitimately every day. This is a risk signal for applying additional authentication, not evidence of an attack. Treating it as proof would lock out a steady stream of customers who simply bought a new phone, and we would design the thresholds around that cost rather than ignoring it.
Related blueprints
Phone Number Intelligence API
Validity, line type, carrier and permitted portability data for phone numbers, returned as a lookup your signup and messaging flows can call.
Call Fraud Detection API
Suspicious calling pattern detection and abuse signals for carriers, CPaaS providers and platforms exposed to telephony fraud.
SMS Delivery Optimisation API
Route quality analytics, delivery prediction and fallback recommendations for platforms sending high volumes of messaging traffic.
Want this built for your platform?
Tell us what your product does today and what you want another system to be able to ask it. We will come back with an approach, a scope and a price.