The short answer
The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Key takeaways
- Adopted November 15, 2023, and published in the Federal Register on December 8, 2023.
- Covers wireless carriers, not banks or app developers.
- Carriers must authenticate before a SIM change or port-out, and notify the customer.
What does the order require?
The Report and Order, adopted on November 15, 2023, amends the FCC’s customer proprietary network information (CPNI) and number-portability rules.[1][2] Wireless carriers must:
- Authenticate securely before redirecting a customer’s number to a new device or another carrier.
- Handle failed attempts: have procedures for responding to failed authentication.
- Notify customers promptly when a SIM change or port-out is requested.
- Offer account locks that customers can switch on to block number changes.
- Train staff and keep records of SIM change and port-out requests.
When did it take effect?
The rules were published in the Federal Register on December 8, 2023.[1] The FCC later waived the original July 2024 compliance date while the rules’ information-collection requirements went through federal review.[3] Check the FCC’s current notice before citing a compliance date.
What doesn’t it cover?
The order regulates carriers. It says nothing about whether a bank or app should keep using SMS codes. A carrier that follows the rules makes SIM swaps harder, but a bank that still treats an SMS code as proof of identity remains exposed to insiders, to account takeover at the carrier, and to phishing of the code itself.
Sources
- Federal Register. Protecting Consumers from SIM Swap and Port-Out Fraud, Dec 8, 2023.
- FCC. Report and Order FCC 23-95.
- FCC. Order on compliance date (DA 24-649).
- Clarified the compliance-date history.
- Published.