Forest Global Training Partners

Cyber Risks · Krebs on Security

FCC Proposal Targets SIM Swapping, Port-Out Fraud

Summary: The FCC issued a notice on September 30 asking for feedback on proposed rules requiring wireless carriers to use more secure authentication before redirecting a customer's phone number to a new device or carrier, citing complaints to the FCC and FTC about SIM swapping and port-out fraud. The proposal would require carriers to verify a pre-established password before any account changes, and the commission is also considering rules on handling failed authentication attempts and notifying customers of SIM change requests.

What's compelling: Carriers have relied on static data like date of birth and Social Security number to authenticate customers, and the FCC pointed to the T-Mobile breach that exposed that data on 40 million current, past and prospective customers. Victims are often the last to know, and the commission says some complaints allege store employees were involved in the fraud or that carriers completed SIM swaps despite a PIN or password already set on the account.

Read the original at Krebs on Security ↗

Topics
Identity & Access Management
Related