SIM swap scams are all the rage among criminals these days. Just over a week ago, we reported how employees across the country were receiving an influx of texts offering cash for illegal SIM swaps. Criminals manage to move a victim’s number to a SIM they control, and from there are able to access two-factor authentication for things like bank accounts and crypto. Other carriers are also impacted by the crime as well.
For a customer to legitimately move their number to a different SIM (physical or eSIM), T-Mobile’s current system requires contacting a support representative and requesting the SIM change. The self-serve method was available via online accounts but was disabled way back in 2022 for security “upgrades”.
We also wrote back in late 2023 how it’s a shame that system never returned, as it’s quite inconvenient for some customers to have to contact support every time, especially if they change phones frequently.
While self-service doesn’t yet appear to be coming back, it looks like the overall security is improving. According to a document obtained by us here at The Mobile Report, T-Mobile will soon make big changes to how SIM swaps are approved, increasing security.
There are two big changes here. First, T-Mobile will now use a system called “Account Change Engine”, or “ACE”, which will seemingly determine if a requested SIM change is likely to be legitimate. The Second change is, if the ACE system says no, the customer must confirm a text response via SMS that they are who they say they are and actually do want to move the line to a new SIM.
This is a big shift from how the system worked previously. Before this change, a SIM change request would be sent via SMS to a line on the account for approval or denial. However, if that text was ignored (or not read) within 10 minutes, the system would automatically approve the swap. This never made sense to most people, but that’s how it was done.
Now, that text must be affirmatively answered by the customer for the swap to go through. After 10 minutes, the swap will be denied. Makes a lot more sense this way.
If a customer needs to get a new SIM for a line that they’ve lost, like a damaged, misplaced, or stolen phone, they’ll have the option to send the verification text to a different line on the account. Customers with only one line will need to visit a store with ID to confirm the swap.
It’s unclear exactly how the new “ACE” system will work, but presumably it will check for obvious signs a customer needs a SIM changed (like if they just bought a new phone). Though, for all we know, this could be some sort of new AI system.
Regardless, the change is definitely a good one. Actual approval from a known trusted source (an existing active line) means it’ll be much harder to pretend to be someone else and forge a SIM swap.
The new process will begin April 25th. Hopefully we’ll also soon see the return of self-service SIM changes online, too.
