Buyer’s guide

SIM swap detection: a buyer’s guide

Tools that tell you a phone number has recently moved to a new SIM, before you trust it. How they work, what they can’t see, and what to ask.

By [AUTHOR NAME]Reviewed by [REVIEWER NAME]Published September 24, 20263 min read

For Fraud & risk Security engineers Product & payments

Commercial-intent guideEditorial, not sponsoredNo scores, ratings or rankingsOwner interest disclosedMethodology

The short answer

How can a bank detect a SIM swap?

The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.

If you read nothing else

Carrier SIM-change checks are the most direct signal, where the carrier supports them.
They are risk signals: they tell you about the SIM, not who holds the phone.
Ask about coverage by carrier and country, and what happens when the carrier doesn’t answer.
We describe approaches; we don’t rank vendors.

What you are trying to detect

In a SIM swap, a criminal gets a carrier to move a customer’s number to a SIM they control. The number still looks the same to you, so the only way to know it moved is to ask the network, or to notice what the attacker does next. The best time to ask is just before you trust the number: for recovery, a new payee or a high-risk payment.

The approaches

Tradecraft summary of CAMARA [1] and GSMA Open Gateway [2] documentation.
Approach	What it tells you	Limits
Carrier SIM swap check	Whether the SIM tied to the number changed recently	Depends on carrier support; says nothing about the person
Number verification	Whether the request comes from the SIM tied to the number	Needs the request over mobile data; says nothing about the person
Device and session signals	New device, location or contact details around the request	Your own data only; attackers can look normal

Carrier SIM swap checks

The CAMARA project, hosted by the Linux Foundation, defines a common SIM Swap API so developers can call the same interface across operators, and GSMA Open Gateway packages these APIs commercially.^[1]^[2] Operators can report whether a number’s SIM changed within a period you specify.

Number verification

Number verification confirms that the device making a request is using the SIM registered to a given number, without sending a code.^[1] In July 2026, Aduna, a network-API joint venture, announced number verification with AT&T, T-Mobile and Verizon.^[4]

Device and session signals

Your own signals complement the carrier’s: a sign-in from a new device, a changed email or phone number, or a new payee straight after a password reset. None of them proves a SIM swap, but together with a carrier check they tell you when to slow down.

How to evaluate

Tradecraft’s evaluation criteria. See the methodology.
Criterion	Why it matters	How to test it
Carrier and country coverage	A check only helps where the carrier answers	Ask for coverage by carrier and country, in writing
Freshness	A stale SIM-change date misses the attack window	Ask how current the SIM-change information is
No-answer behavior	Carriers won’t always respond	Ask what the API returns when the carrier doesn’t answer
Consent and privacy	Carrier data use has legal conditions	Ask what consent is required and who records it
Latency	Checks sit inside sign-in and payment flows	Test response times from your own infrastructure
Integration	One API across carriers saves work	Ask whether the product follows CAMARA definitions
Commercial model	Per-query pricing adds up in high-volume flows	Ask for pricing in writing [YOUR PROCUREMENT PROCESS]

Questions to ask every vendor

Which carriers and countries do you cover today, and how do you get the data?
Do you follow the CAMARA SIM Swap and Number Verification definitions?
What do you return when a carrier doesn’t respond?
How fresh is the SIM-change information?
What customer consent is needed, and who is responsible for collecting it?
What data do you keep about the queries we make, and for how long?

Vendor landscape

Vendors are listed by approach in alphabetical order. We don’t publish scores, ratings or rankings.

Landscape not yet populated. [EDITORIAL: populate from the inclusion criteria.]
Approach	Vendors (alphabetical)
Network API aggregators	[VENDOR], [VENDOR], [VENDOR]
Carriers selling direct	[VENDOR], [VENDOR]
Fraud platforms that include SIM-change signals	[VENDOR], [VENDOR], [VENDOR]

Questions readers ask

Can a bank see whether a customer’s SIM was swapped?

Often, yes, where the customer’s carrier exposes a SIM swap check through its own API or an aggregator. Coverage varies by carrier and country.

Does a SIM swap check stop account takeover on its own?

No. It is a risk signal. It tells you the SIM changed recently, not whether the person holding the phone is your customer.

Don’t the FCC rules already stop SIM swaps?

They make SIM swaps harder by requiring US carriers to authenticate customers and notify them, but they apply only to US wireless carriers, can’t rule out an insider at the carrier, and don’t change how a bank uses SMS codes.

Sources

Linux Foundation CAMARA project
GSMA GSMA Open Gateway
Federal Register Protecting Consumers from SIM Swap and Port-Out Fraud (2023-12-08)
ID Tech Aduna and major U.S. carriers push network-based authentication as SMS code alternative

Changelog

September 24, 2026: First edition. Vendor landscape not yet populated. Awaiting editorial verification.

Cite this

Tradecraft. “SIM swap detection: a buyer’s guide.” Tradecraft, September 24, 2026. https://glide-tradecraft.pages.dev/buyers-guides/sim-swap-detection/

Take the checklist

Checklist

SIM swap: the first hour

Containment and verification steps when a customer’s number may have been hijacked.