How do I detect a SIM swap before sending an OTP?

Query a SIM swap detection API with the destination phone number before dispatching the OTP. If a recent swap is detected, block the OTP and route the user through an alternative verification channel. Telebase is launching a real-time SIM swap signal for this use case. Early access is available via telebase.io/contact-us.

What is a SIM swap attack?

A SIM swap attack convinces a mobile operator to transfer a victim's phone number to a SIM card controlled by an attacker. The attacker then receives any SMS messages sent to that number, including one-time passwords, giving them access to SMS-protected accounts.

Can I detect SIM swaps using Telebase today?

SIM swap detection is launching and not yet generally available. The current API response returns simSwap: UNKNOWN while carrier registration completes. Carrier, country, number type and active status are live today and provide partial signal. For early access to SIM swap detection, visit telebase.io/contact-us.

Is SMS OTP safe to use for 2FA?

SMS OTP is vulnerable to SIM swap attacks. A real-time SIM swap check before the OTP is sent reduces this risk. If a recent swap is detected, the authentication step should be blocked and the user redirected to an alternative verification channel.

Should I check for a SIM swap anywhere besides before sending an OTP?

Yes. Login and account recovery are secondary checkpoints. A SIM swap detected at login is a useful input alongside device and location signals, and a swap detected immediately before an account recovery request is a particularly strong indicator of an in-progress takeover attempt.

Fraud Prevention

How to detect a SIM swap before sending an OTP

A SIM swap transfers a victim's phone number to a SIM card controlled by an attacker. If your authentication flow sends a one-time password to that number, the attacker receives it. The correct defence is to check whether a recent SIM swap has occurred before the OTP is sent, not after. Telebase is launching a real-time SIM swap detection signal for this use case. Early access is available now.

How SIM swap fraud works

An attacker obtains enough personal information to convince a mobile operator, or a rogue employee at one, to transfer the victim's number to a new SIM. The transfer takes effect quickly. From that point, the attacker receives all SMS messages and calls destined for that number, including OTPs sent by banks, exchanges and payment apps.

The victim typically does not notice immediately. Their phone loses signal, which they may attribute to a network issue. By the time they report it, the attacker has already passed SMS 2FA and accessed the account.

SIM swap fraud is particularly common in account takeover attempts against fintech and crypto platforms, where the payout from a single successful attack is high relative to the effort required.

Why checking at the point of OTP dispatch matters

The OTP itself is the vulnerability. Sending it to a swapped number hands the attacker the credential they need. The check therefore needs to happen before the OTP is sent, not as a post-incident forensic step. A real-time SIM swap signal, queried at the moment the user requests a code, gives you the information at the point where it is still actionable.

If a recent swap is detected, the right response is to block the OTP and route the user through a different verification channel, such as a video call or document re-submission, rather than proceeding as normal.

What signals are available now

While SIM swap detection is launching, several live Telebase signals already reduce risk at authentication:

Active status: an inactive number cannot receive an OTP, flagging a potential port or abandonment
Number type: a VoIP number cannot be SIM-swapped in the traditional sense, but its presence at authentication is worth reviewing
Carrier: a sudden carrier change on an existing account is consistent with a port-out, which precedes some SIM swap patterns. See the carrier lookup API for the full field reference.
Country: a number now registering in a different country from the account's last known location is an anomaly signal

These signals are live today via the Telebase API at $0.05 per query, no annual commitment.

What a lookup returns today

A single call returns every signal above in one response. For a GB, DE, NL or FR number, the simSwap field returns UNKNOWN while carrier registration completes, so build the pre-OTP check around active status, carrier and number type until it goes live.

Response

{
  "phoneNumber": "+447700900000",
  "active": true,
  "carrier": "EE",
  "country": "GB",
  "numberType": "mobile",
  "simSwap": "UNKNOWN",  // launching for GB, DE, NL and FR
  "simSwapAt": null,
  "_meta": { "activeSource": "LINE_STATUS" }
}

Where else to check for a SIM swap

Pre-OTP is the highest-value checkpoint, but it is not the only one. A SIM swap detected at login, before session access is granted, is useful when combined with other risk signals such as a new device or an unusual location. A swap detected immediately before an account recovery or password reset request is a particularly strong signal, since recovery flows are the more common target once OTP defences are hardened. See account takeover prevention with telecom signals for the full breakdown of where each telecom signal fits across the authentication flow.

SIM swap detection: launching

Telebase is registering SIM swap feeds with mobile network operators carrier by carrier. The signal is in private early access. When live, it will return a timestamp of the most recent SIM swap event for the queried number, or a confirmation that no recent swap has been detected. The current API response returns simSwap: UNKNOWN while registration completes.

If you want to implement SIM swap checking before an OTP is sent and are evaluating data sources, get in touch to discuss early access.

Get early access