Moving to clamp down on the growing scourge of SIM-swapping and port-out fraud, the Federal Communications Commission (FCC) has unveiled new rules mandating telcos to give consumers greater control of their mobile phone accounts.
Under the new rules, wireless carriers are required to notify customers of any SIM transfer requests, a measure designed to thwart fraudulent attempts by cybercriminals.
The FCC has also revised its customer proprietary network information and local number portability rules, making it more challenging for scammers to access sensitive subscriber information.
The new protective measures are meant to address SIM-swapping and port-out attacks widely documented in cybercriminal attacks against businesses and consumers. The attack technique is used to hijack mobile accounts, change and steal passwords, bypass MFA roadblocks and raid bank accounts.
Studies have found that major mobile carriers in the US are vulnerable to SIM-swapping with the Federal Bureau of Investigation (FBI) receiving thousands of consumer complaints every year.
In a statement announcing the crackdown, FCC chairwoman Jessica Rosenworcel said the commission has also noted the work of the Cyber Safety Review Board (CSRB) that called attention to SIM-swapping in cyber attacks against big businesses.
“We require wireless carriers to give subscribers more control over their accounts and provide notice to consumers whenever there is a SIM transfer request, in order to protect against fraudulent requests made by bad actors,” Rosenworcel said.
“We also revise our customer proprietary network information and local number portability rules to make it harder for scam artists to make requests that get them access to your sensitive subscriber information,” she added, arguing that the new rules will improve consumer privacy and put an end to SIM scams.
Related: Major U.S. Mobile Carriers Vulnerable to SIM Swapping Attacks
Related: The Chaos (and Cost) of the Lapsus$ Hacking Carnage
Related: Hacker Pleads Guilty to SIM Swapping Attacks, Cryptocurrency Theft
