SIM Swap Fraud

How SIM Swap Fraud Works

A SIM swap attack follows a predictable sequence:

1. Reconnaissance — the attacker collects the victim's name, phone number, last four digits of SSN, or account PIN using phishing, data brokers, or prior breaches.
2. Social engineering — the attacker calls the victim's carrier, impersonates them, and claims they need their number transferred to a new SIM card.
3. Number transfer — the carrier moves the phone number from the victim's SIM to the attacker's SIM, typically within minutes.
4. Account takeover — with the number live on their device, the attacker triggers "forgot password" flows on email, banking, and crypto accounts, intercepts all SMS OTPs, and resets credentials.

The entire attack can complete in under 30 minutes.

Why SMS OTP Fails Against SIM Swap

SMS-based two-factor authentication assumes the SIM card is in the hands of its legitimate owner. A SIM swap breaks that assumption instantly:

• OTPs sent by your application land on the attacker's device, not the customer's
• Push-to-SMS fallback flows are equally compromised
• The victim has no SMS access to receive fraud alerts

NIST SP 800-63B explicitly recommends against SMS OTP for high-assurance authentication precisely because of SIM swap risk.

How VRI's LRN Activation Date Detects SIM Swaps

Every time a phone number's routing changes — including when a SIM swap moves it to a new carrier — the LRN (Local Routing Number) associated with that number is updated in the national SS7 routing database. VRI captures and timestamps that update as the LRN Activation Date.

A number that was on a carrier for six months but whose LRN activation date changed yesterday is a strong fraud signal. VRI is the only lookup provider that exposes LRN Activation Date at the API level. No carrier contract required.

Risk Thresholds

Activation Age	Risk Level	Recommended Action
Under 7 days	High	Block or require step-up verification
7–30 days	Elevated	Flag for manual review or challenge
30–90 days	Moderate	Log, monitor, apply friction for high-value transactions
Over 90 days	Low	Standard authentication flow

Python Code Example — VRI SIM Swap Check

import requests
from datetime import datetime

VRI_API_KEY = "your_api_key"
PHONE = "+15551234567"

resp = requests.get(
    f"https://api.verirouteintel.com/v1/lookup/{PHONE}",
    headers={"Authorization": f"Bearer {VRI_API_KEY}"}
)
data = resp.json()

activation_date = datetime.fromisoformat(data["lrn_activation_date"])
days_since_activation = (datetime.utcnow() - activation_date).days

if days_since_activation < 7:
    risk = "HIGH — block or require step-up auth"
elif days_since_activation < 30:
    risk = "ELEVATED — flag for manual review"
elif days_since_activation < 90:
    risk = "MODERATE — monitor and apply friction"
else:
    risk = "LOW — standard authentication flow"

print(f"Phone: {PHONE}")
print(f"LRN Activation Date: {activation_date.date()}")
print(f"Days since activation: {days_since_activation}")
print(f"Risk level: {risk}")

LRN Activation Date vs. Carrier-Level SIM Swap APIs

	VRI LRN Activation Date	Carrier SIM Swap API
Carrier contract required	No	Yes, per carrier
Multi-carrier coverage	All US carriers	Single carrier per API
Integration effort	Single REST endpoint	3–5 separate integrations
Cost	$0.0009/lookup	Varies, often undisclosed
Data freshness	Near real-time	Varies by carrier

Limitations and Complementary Signals

• Legitimate number porting also changes the LRN Activation Date — supplement with device fingerprinting, velocity checks, and behavioral signals.
• For high-value transactions, require TOTP or passkey step-up when activation age is under 30 days regardless of fraud signal.

Related Terms

• Short Code