How to identify a SimSwap

[daniel-dierich]

Dear Community,

I am currently looking at SimSwap and am wondering what Information is required to identify a SimSwap.
The subscription request only provides the phoneNumber. How is this used to identify a SimSwap? Does the phoneNumber change in all cases? Is it a SimSwap Event if the Sim changes, but the number stays the same?

Thank you in advance!

[fernandopradocabrillo]

Hi @daniel-dierich,
I'm not sure I'm understanding your question. A swap event is registered every time there is a new pairing between the phone number (MSISDN) and a new SIM (IMSI). This means that the API only needs the client to provide the phone number to know if it has been associated with a new SIM and when was the last time that this happened.

In the subscriptions API you can create a subscription for a particular phone number and receive notifications every time there is a new swap.

Is it a SimSwap Event if the Sim changes, but the names stays the same?

what do you mean with: the names stays the same?

[daniel-dierich]

Hi, thank you for your reply.

To me the definition in the specification was a little bit unclear. So thank you for the clarification. Could you also answer these follow up questions?

Does this mean if the client changes the number and the sim there will no Swap Event as only the association between SIM and MSISDN matters?
Because in some of these cases it is not said that the Client keeps the MSISDN on a new SIM, right?

A SIM swap is a process in which a mobile phone user's current SIM card is deactivated or replaced with a new one. This is typically done by contacting the user's mobile service provider and requesting a new SIM card for various reasons, such as a lost or damaged SIM card, upgrading to a new phone, or changing phone numbers while keeping the same device.

And I apologize for the confusion in regards to the names. it was a typo, I was referring to the number. I will update the question. But you also already answered it.

[gregory1g]

Hi @daniel-dierich ,
SimSwap means new SIM for the same MSISDN. And this is an important information to prevent SimSwap attack (https://en.wikipedia.org/wiki/SIM_swap_scam).

When a client changes number and SIM it is not a SimSwap.

[daniel-dierich]

Hi, thank you for clarifying.

Personally, I think the description provided in the API specification can be a little misleading. I would suggest updating it from:

A SIM swap is a process in which a mobile phone user's current SIM card is deactivated or replaced with a new one. This is typically done by contacting the user's mobile service provider and requesting a new SIM card for various reasons, such as a lost or damaged SIM card, upgrading to a new phone, or changing phone numbers while keeping the same device.

to:

A SIM swap is a process in which a mobile phone user's current SIM card is deactivated or replaced with a new one while associating the same phone number. This is typically done by contacting the user's mobile service provider and requesting a new SIM card for various reasons, such as a lost or damaged SIM card or upgrading to a new phone. A similar example is if the phone number is changed while the SIM card is kept..

Do you agree?