While many foreign phone carriers are sharing real-time SIM swap data with banks to stop financial fraud, US carriers are dragging their feet
AROUND A YEAR ago, André Tenreiro was called into a meeting between the chief technology officer of the phone carrier he worked for … Tweets: @dinodaizovi and @jessysaurusrex Tweets: Dino A. Dai Zovi / @dinodaizovi : Brilliant: telcos provide an endpoint allowing queries of whether a number has been swapped within the last few days. Victims notice within minutes, so this prevents SIM swap fraudsters from winning the race. http://twitter.com/... Jessy Irwin / @jessysaurusrex : Given the prevalence of SIM theft and the inability of SMS 2FA to withstand targeted attack, y'all should be mad as hell about US carriers being meh about adopting solutions to this problem: The SIM Swap Fix That the US Isn't Using http://www.wired.com/...
Context & Ripple Effects
The story opens with André Tenreiro, a former carrier engineer, describing the endpoint his employer built so banks can query whether a number was swapped within days — the mechanism Dino A. Dai Zovi flagged as brilliant because victims notice within minutes and the fraudster loses the race. Foreign carriers run it; US carriers won't, and Jessy Irwin's point lands hard: SMS 2FA cannot withstand a targeted attack, so every US bank relying on it inherits the gap.
First-order effects
- US banks are left authenticating customers over a channel attackers control, since researchers found [[a:949612|AT&T, T-Mobile, Tracfone, US Mobile, and Verizon all use support procedures vulnerable to SIM swapping]].
Second-order effects
- The failure compounds through adjacent channels: a hacker showed Sakari would reroute a reporter's texts for $16, turning SMS 2FA into an open door and pushing pressure from carriers onto the messaging-tool ecosystem.
Third-order effects
- With CISA documenting Lapsus$'s techniques and calling on the FTC and FCC for stricter SIM swap rules and a passwordless future, and AT&T finally shipping Account Lock years after this story ran, the arc bends toward regulation replacing carrier discretion — and authentication migrating off SMS entirely.
The trend: Telecom authentication is shifting from carrier-by-carrier discretion toward regulated, standardized fraud-signal sharing between carriers and financial institutions.