The Outlier Lab

Phone Risk Signals

Phone number attributes and carrier events (line type, tenure, recent SIM swap or port, forwarding, ownership match) that show whether a number still belongs to the customer.

What it measures

FeatureWhat it capturesRead
Line typeMobile, landline, fixed or non-fixed VoIP, prepaid vs postpaid, toll-freeNon-fixed VoIP numbers are easy to obtain in bulk; prepaid is common and mostly benign
Carrier and tenureCurrent carrier, time since last port, time the number has been with the subscriberLong tenure is a strong good signal
SIM swap recencyTime since the number was last paired with a new SIMThe single most important feature before OTP-protected money movement
Device swap / call forwardingRecent change of handset tied to the number; unconditional forwarding enabledForwarding diverts voice OTPs and verification calls
Ownership matchWhether the carrier's subscriber name or address matches the customerAvailable in some markets via carrier data or network APIs
Number verificationWhether the device in session is actually using that number (network-based check)Stronger than SMS OTP because no code can be relayed
Recycling / reassignmentWhether the number was disconnected and reassigned to a new subscriberStale numbers on old accounts can belong to someone else

Why it matters

Phone numbers are still the de facto recovery and step-up factor at most consumer financial companies, which makes control of the number one of the most valuable things an attacker can get just before cash-out.

How to collect it

  • Buy phone intelligence (line type, carrier, porting history) from phone-data providers, and carrier event data (SIM swap, device swap, forwarding, number verification) through aggregators or carrier network APIs.
  • Network APIs are standardizing. CAMARA (a Linux Foundation project working with the GSMA Open Gateway initiative) defines common APIs including SIM Swap and Number Verification. The GSMA says Open Gateway includes more than 80 operator groups covering over 80% of mobile connections. US availability and pricing vary by carrier and aggregator; verify coverage for your customer base.
  • Build internal history: when the number was added, how often it changes, how many accounts share it.
  • Query at the right moment. Run the SIM-swap check when you are about to rely on the phone: before sending an OTP for a payout change, before recovery, before a high-value transfer. A check at login alone is too early.

How to use it

  • Pair recency with the action being taken. A SIM swap in the last few days plus OTP-gated recovery or payout change should trigger a hold or a non-phone step-up. A swap months ago means little.
  • Handle "unknown" explicitly. Ported-in numbers, MVNO lines and some carriers return no data, so decide in advance what happens.
  • Don't let the phone be the only key. When phone risk is high, step up with something the number can't intercept: passkeys, device-bound credentials, document plus selfie (Passkeys and Phishing-Resistant Authentication, Document Verification and Liveness).
  • In rewards and promo programs, use line type to decide incentive eligibility rather than as a hard sign-up block.

Strengths and limitations

Strengths: carrier-sourced data is hard for the attacker to change once a swap or port has happened; directly addresses the most common step-up bypass.

Limitations:

  • Coverage gaps by carrier, MVNO and country, and data latency on some events.
  • Attackers adapt timing and channels, and some OTP interception doesn't involve a SIM swap at all (social engineering the code, relay phishing). See MFA Bypass and OTP Interception and Phishing and Credential Harvesting.
  • Line-type classification can be wrong after ports.
  • Cost per query adds up; tier queries by risk.

False positives and fairness

  • New phones and carrier switches are common and legitimate. Upgrade season and promotions cause swap spikes.
  • Prepaid users, who skew lower-income and younger, shouldn't be penalized for line type alone.
  • Some customers rely only on VoIP numbers, including some small businesses, deaf and hard-of-hearing users of relay services, and people without stable mobile service.
  • Shared family plans where the subscriber name differs from the account holder (parents, spouses) produce ownership mismatches.
  • Immigrants and travelers often use foreign or newly issued numbers.

Privacy and compliance considerations

  • FCC SIM-swap and port-out rules. The FCC's 2023 order (FCC 23-95) requires wireless carriers to use secure authentication before SIM changes and port-outs, notify customers of those requests, and offer free account locks. In July 2024 the FCC waived compliance until OMB finished Paperwork Reduction Act review and a compliance date was published in the Federal Register. OMB approved on January 15, 2025, but as of October 2026 the codified rule (47 CFR 64.2010(h)(9)) still says compliance isn't required until a compliance date is added, and we found no notice setting one. Don't cite the rules as in force; assume carrier-side protections vary, and keep your own SIM-swap checks.
  • Carrier data about subscribers is subject to telecom privacy rules (CPNI) and to the consent terms of the network API program. Disclose phone verification and carrier checks in privacy notices.
  • TCPA and state rules apply to calls and texts you send; verification messages have their own consent considerations.

Mechanisms it helps detect

SIM Swap and Port-Out Fraud · MFA Bypass and OTP Interception · Account Takeover (ATO) · Account Recovery Abuse · Payout Redirection · Fake Account Creation (Bots) · Synthetic Identity Fraud · Multi-Accounting · Digital Wallet Provisioning Fraud

Sources and further reading