According to a proposed rulemaking issued Thursday, the amendments aim to stem the tide of “subscriber identity module fraud.” The 45-page Federal Communications Commission (FCC) document explains that the move to implement stricter rules on wireless carriers follows a bevy of consumer complaints and also, a congressional prompt in January.
The agency explains that SIM-swapping occurs when a fraudster convinces a victim’s wireless carrier to transfer service from the victim’s cell phone to a device the fraudster possesses. By contrast, port-out fraud occurs when the fraudster, pretending to be the victim, opens an account with a different carrier then arranges for the victim’s phone number to be transferred to the new carrier and corresponding fraudster-controlled account. The FCC noted that data breaches exposing consumer information have possibly made these crimes easier to carry out.
According to the agency, these schemes “wreak havoc on people’s financial and digital lives.” In particular, victims with large cryptocurrency holdings, sometimes in the millions, have seen their accounts drained after attacks. Some have filed lawsuits against the wireless carriers alleging breach of contract, negligent hiring, and state law deceptive trade practices act violations, among other claims.
In its proposed rulemaking, the agency seeks to amend its Local Number Portability (LNP) rules, which govern the porting of telephone numbers from one carrier to another, and its Customer Proprietary Network Information (CPNI) rules, which govern telecommunications carriers’ use, disclosure, and protection of sensitive customer information. Specifically, the agency seeks to “require carriers to adopt secure methods of authenticating a customer before redirecting a customer’s phone number to a new device or carrier.” In addition, the FCC proposes requiring providers to notify customers as soon as a SIM change or port request is made on customers’ accounts.
The agency seeks comment on its proposals and on other ways to protect consumers for 30 days after the proposed rulemaking’s publication in the federal register.
