How do I detect a SIM swap before sending an OTP?

Query a SIM swap detection API with the destination phone number before dispatching the OTP. If a recent swap is detected, block the OTP and route the user through an alternative verification channel. Telebase is launching a real-time SIM swap signal for this use case. Early access is available via telebase.io/contact-us.

What is a SIM swap attack?

A SIM swap attack convinces a mobile operator to transfer a victim's phone number to a SIM card controlled by an attacker. The attacker then receives any SMS messages sent to that number, including one-time passwords, giving them access to SMS-protected accounts.

Can I detect SIM swaps using Telebase today?

SIM swap detection is live in the UK and Germany, with more markets on the way. Outside those two markets, simSwap currently returns UNKNOWN. Carrier, country, number type and active status are live globally today. For early access to SIM swap detection, visit telebase.io/contact-us.

Is SMS OTP safe to use for 2FA?

SMS OTP is vulnerable to SIM swap attacks. A real-time SIM swap check before the OTP is sent reduces this risk. If a recent swap is detected, the authentication step should be blocked and the user redirected to an alternative verification channel.

Fraud Prevention

How to detect a SIM swap before sending an OTP

A SIM swap transfers a victim's phone number to a SIM card controlled by an attacker. If your authentication flow sends a one-time password to that number, the attacker receives it. The correct defence is to check whether a recent SIM swap has occurred before the OTP is sent, not after. Telebase is launching a real-time SIM swap detection signal for this use case. Early access is available now.

How SIM swap fraud works

An attacker obtains enough personal information to convince a mobile operator, or a rogue employee at one, to transfer the victim's number to a new SIM. The transfer takes effect quickly. From that point, the attacker receives all SMS messages and calls destined for that number, including OTPs sent by banks, exchanges and payment apps.

The victim typically does not notice immediately. Their phone loses signal, which they may attribute to a network issue. By the time they report it, the attacker has already passed SMS 2FA and accessed the account.

SIM swap fraud is particularly common in account takeover attempts against fintech and crypto platforms, where the payout from a single successful attack is high relative to the effort required.

Why checking at the point of OTP dispatch matters

The OTP itself is the vulnerability. Sending it to a swapped number hands the attacker the credential they need. The check therefore needs to happen before the OTP is sent, not as a post-incident forensic step. A real-time SIM swap signal, queried at the moment the user requests a code, gives you the information at the point where it is still actionable.

If a recent swap is detected, the right response is to block the OTP and route the user through a different verification channel, such as a video call or document re-submission, rather than proceeding as normal.

What signals are available now

While SIM swap detection is launching, several live signals from a single carrier lookup already reduce risk at authentication:

Active status: an inactive number cannot receive an OTP, flagging a potential port or abandonment
Number type: a VoIP number cannot be SIM-swapped in the traditional sense, but its presence at authentication is worth reviewing
Carrier: a sudden carrier change on an existing account is consistent with a port-out, which precedes some SIM swap patterns
Country: a number now registering in a different country from the account's last known location is an anomaly signal

These signals are live today via the Telebase API at $0.20 per SIM swap check, carrier data included, no annual commitment.

What a lookup returns today

A single call returns every signal above in one response. The field returns live data for UK and German numbers. For any other number it currently returns UNKNOWN, so build the pre-OTP check around active status, carrier and number type until that market goes live.

Response

{
  "phoneNumber": "+447700900000",
  "active": true,
  "carrier": "EE",
  "country": "GB",
  "numberType": "mobile",
  "simSwap": "UNKNOWN",  // live in the UK and Germany, more markets to follow
  "simSwapAt": null,
  "_meta": { "activeSource": "LINE_STATUS" }
}

How to detect a SIM swap before the OTP is sent

Call the Telebase lookup endpoint with the user's phone number at the moment they request a code. Read the simSwap field in the response: NO_SWAP means no recent swap was detected and the OTP can proceed. SWAPPED means a recent swap was detected and the OTP should be blocked, routing the user to an alternative verification channel instead. UNKNOWN means SIM swap data is not yet available for that number's market; fall back to the other signals in the same response.

Even when simSwap returns UNKNOWN, the other fields in the same call help reduce risk at the point of OTP dispatch. An inactive number cannot receive the code. A VoIP number at authentication is unusual for most consumer accounts. A carrier or country change since the last known state is consistent with a port-out. These signals come with every $0.20 SIM swap check and run in a single call.

SIM swap detection: live in the UK and Germany

Telebase is live with SIM swap feeds from mobile network operators in the UK and Germany, with more markets on the way. It returns a timestamp of the most recent SIM swap event for the queried number, or a confirmation that no recent swap has been detected. The current API response returns a live signal for UK and German numbers, and simSwap: UNKNOWN elsewhere while coverage expands.

If you want to implement SIM swap checking before an OTP is sent and are evaluating data sources, get in touch to discuss early access.

Get early access