/
/ 

The free carrier lock the FCC made mandatory, and how to switch it on

2026-10-01 · Web3 Security Since 2024 every US wireless provider, including every prepaid brand and reseller, has been required to offer customers a free lock that blocks SIM changes and number ports, the single control that addresses the attack itself. The rule text says the provider…

01 / 01 Sections Sections

2026-10-01 · Web3 Security

Since 2024 every US wireless provider, including every prepaid brand and reseller, has been required to offer customers a free lock that blocks SIM changes and number ports, the single control that addresses the attack itself. The rule text says the provider “shall not fulfill a SIM change request until the customer deactivates the lock”, and the setting is off by default at every carrier.

Key findings

  • 47 CFR 64.2010(h)(4) requires a provider to “offer customers, at no cost, the option to lock their accounts to prohibit the CMRS provider from processing requests to change the customer’s SIM.” An identical no-cost requirement for number ports sits at 47 CFR 52.37(d).
  • The rules apply to “all providers of commercial mobile radio service (CMRS) … including resellers of wireless service”, so prepaid brands and MVNOs are covered on the same terms as the national carriers.
  • The FCC expressly declined to require a delay after a failed authentication attempt, at paragraph 32 of FCC 23-95, on the basis that 24-hour delays “could be overly burdensome for customers that are engaged in legitimate SIM changes.”
  • Carriers must not authenticate SIM change requests using “readily available biographical information, account information, recent payment information, or call detail information.”
  • 47 CFR 64.2010(h)(6)(iii) gives a subscriber the right to written documentation of a fraudulent SIM change on their account, at no cost, on request. Almost no carrier advertises it.
  • Verizon states that its own representatives cannot disable SIM Protection for a customer, and that disabling it imposes a 15-minute delay before any SIM transaction can process. That is a stronger control than the rule requires.

Case file

Field Value
Rules 47 CFR 64.2010(h), SIM changes, under the CPNI rules; 47 CFR 52.37, number port-outs, under local number portability
Adopted in FCC 23-95, Report and Order and Further Notice of Proposed Rulemaking, WC Docket No. 21-341
Applies to All providers of commercial mobile radio service as defined in 47 CFR 20.3, expressly including resellers
Federal Register Published 8 December 2023; rules effective 8 January 2024 except provisions carrying information-collection requirements
Compliance date Original date 8 July 2024, waived in DA 24-649 pending OMB review, to be announced by a further Federal Register notice. Not located as at 4 August 2026
Statutory basis Section 222 of the Communications Act, customer proprietary network information
Cost to consumer Zero. Charging for either lock conflicts with the rule
What the FCC declined A mandatory cooling-off delay after failed authentication, at paragraph 32
Safe Connections carve-out Every requirement yields to a legitimate line separation under 47 U.S.C. 345
Posture as of 1 October 2026 Rules in force. Locks available at all three national carriers and most resellers, opt-in everywhere
Defensive action Enable both locks on every line, then verify by calling the carrier from another phone

What the record shows

What does the FCC actually require?

On 15 November 2023 the Federal Communications Commission adopted a Report and Order in WC Docket No. 21-341, “Protecting Consumers from SIM Swap and Port-Out Fraud”, amending two rule sets: 47 CFR 64.2010(h) for SIM changes, under the customer proprietary network information rules, and 47 CFR 52.37 for number port-outs, under local number portability.

The scope provision is broad. The port-out rule opens: “This section applies to all providers of commercial mobile radio service (CMRS), as defined in 47 CFR 20.3, including resellers of wireless service.” Prepaid brands and MVNOs carry the same duties as AT&T, T-Mobile and Verizon.

Eight obligations follow. Quoting the operative text:

Authentication, with an express prohibition. A provider “shall use secure methods to authenticate a customer that are reasonably designed to confirm the customer’s identity before executing a SIM change request.” Then the clause that matters: “Authentication methods shall not rely on readily available biographical information, account information, recent payment information, or call detail information.” Methods must be reviewed “regularly, but not less than annually.”

Notification of a failed attempt. A provider “shall immediately notify a customer of a failed authentication attempt associated with the customer’s account in connection with a SIM change request.”

Notification before execution. On receiving a SIM change or port-out request, “and before effectuating the request”, the provider shall immediately notify the customer that the request was made.

The account lock, at no cost. The provision consumers most need to know:

“A CMRS provider shall offer customers, at no cost, the option to lock their accounts to prohibit the CMRS provider from processing requests to change the customer’s SIM. A CMRS provider shall not fulfill a SIM change request until the customer deactivates the lock on the account.”

The rule adds that activating and deactivating “must not be unduly burdensome for customers such that it effectively inhibits customers from implementing their choice.” Section 52.37(d) carries the identical requirement for ports.

Notice that the protection exists. Providers must tell customers what protections they offer, in clear language, “easily accessible through the CMRS provider’s website and application.”

Employee training, specifically on identifying fraudulent SIM change and port-out attempts and on recognising when a customer is a victim.

Employee access controls. Carriers “shall establish safeguards and processes so that employees who interact directly with customers are unable to access CPNI until after a customer has been properly authenticated.”

Remediation, at no cost. Providers must maintain “a clearly disclosed, transparent, and easy-to-use process for customers to report fraudulent SIM changes”, promptly investigate and remediate, and “promptly provide customers, upon request, with documentation of fraudulent SIM changes involving their accounts.”

That last one is a right almost nobody exercises. Documentation of the fraudulent change is the evidence a victim needs for an insurance claim, an arbitration or a police report, and the rule says it is free.

What the Commission decided not to require

At paragraph 32 of FCC 23-95 the Commission declined to require a delay following failed authentication:

“We decline to require that wireless providers delay SIM changes for 24 hours in the event of failed authentication attempts … The record reflects that strict requirements involving 24-hour delays or account locks could be overly burdensome for customers that are engaged in legitimate SIM changes.”

AT&T argued in comments that forcing a customer with a lost, stolen or damaged phone to wait 24 hours was unreasonable.

The consequence for a subscriber is direct: absent your own account lock, no federal rule imposes any waiting period between a failed attack attempt and a successful one. The lock is what creates the friction the rule declined to mandate.

The compliance date is not where most coverage says it is

The rules were published in the Federal Register on 8 December 2023 and took effect on 8 January 2024, except for provisions containing information-collection requirements. The compliance date for the balance was set at 8 July 2024.

In June 2024 industry associations petitioned for an extension to 10 March 2025. On 5 July 2024 the Wireline Competition Bureau granted the petition in part in DA 24-649: it refused the March 2025 date but waived compliance with all of the rules until the Office of Management and Budget completed Paperwork Reduction Act review, with the compliance date to be announced by a later Federal Register notice. The Bureau advised providers to plan around late November 2024 as the earliest realistic approval, according to the summary published by the firm Telecommunications Law Professionals.

As at 4 August 2026 no Federal Register notice announcing a final compliance date for all sections was located. The consumer-facing effect is nonetheless in place: all three national carriers and most large resellers offer the lock today. What is unresolved is the enforcement posture, not the availability of the feature.

One carve-out, and it is deliberate

Every requirement above yields to a legitimate line separation request under 47 U.S.C. 345, the Safe Connections Act of 2022, which allows a survivor of domestic abuse to separate a line from a shared plan without the abuser’s consent. An account lock cannot be used to hold somebody on a plan.

Where the setting lives, carrier by carrier

Feature names differ, and two of the three national carriers split the protection across two settings. Enabling one and not the other leaves the other route open.

Carrier SIM change Port-out Where
T-Mobile SIM Protection Account Takeover Protection T-Life app: Manage, gear icon, Security. Account Takeover Protection is added per line
Metro by T-Mobile Via the T-Mobile framework Account Takeover Protection myMetro app or Metro account
Verizon SIM Protection Number Lock My Verizon: Account, Account settings, Security settings
Visible Line Lock Line Lock App or web, Account settings
AT&T Wireless Account Lock Wireless Account Lock myAT&T app: Services, Mobile Security. One toggle covers both
Cricket Account Lock Account Lock myCricket app: Settings, Security, Account Lock
Google Fi Number Lock Number Lock fi.google.com: Phone settings, Privacy and security. Requires re-entering Google account credentials
Mint Mobile Number Lock Number Lock Mint app: Account, Security
US Mobile Port protection Port protection Account settings
Xfinity Mobile Transfer controls Transfer controls Account, Devices, line, transfer settings
Spectrum Mobile Port-out controls Port-out controls Billing tab, line, Port Out
Boost, Tracfone, Straight Talk, Consumer Cellular Varies by brand Varies by brand Carrier app or account; ask by name

Three carrier behaviours are documented on the carriers’ own pages and are worth knowing before you choose a provider.

Verizon publishes the strongest pair of properties. Its SIM swapping page states that SIM Protection is offered at no cost, that it is available to postpaid and prepaid customers through My Verizon, that Verizon representatives cannot disable SIM Protection for a customer and only the customer can through the app or website, and that when SIM Protection is disabled there is a 15-minute delay before transactions requiring a new SIM can be completed. Neither is required by the rule. The first removes the call-centre route for that specific control; the second is the cooling-off period the Commission declined to mandate.

T-Mobile’s port-out control is free across every tier and is restricted on removal. Its support page states that Account Takeover Protection is complimentary, is available to T-Mobile Postpaid, T-Mobile for Business, T-Mobile Prepaid and Metro by T-Mobile customers, must be added to each line individually, and that on postpaid accounts only the Billing Responsible Party can remove it, with prepaid removal requiring additional security verification.

Google Fi binds the setting to a Google account. Its help page states that Number Lock is available at no extra cost, that with it enabled the number cannot be transferred to another phone or ported to another carrier, and that managing it requires re-entering Google account credentials. Where that Google account is protected with a FIDO security key, the portability of the number sits behind a phishing-resistant credential. The corresponding exposure is concentration: if the same account is also the recovery path for email, one credential governs both.

Verizon’s SIM Protection blocks legitimate transactions too, including device upgrades and bring-your-own-device activations. That is the intended trade and it is the reason the 15-minute delay exists rather than a longer one.

What I think is going on

The rule solved availability and left adoption untouched. Every carrier now offers the lock. It is off by default at every one of them. A protection that requires the subscriber to know it exists, find it, and switch it on will be used by the small minority who read articles like this one, and the rule’s own notice requirement, that protections be “easily accessible through the CMRS provider’s website and application”, is the provision most obviously honoured in form rather than substance. Default-on with an easy opt-out would end most consumer exposure in a quarter. No US carrier does it.

Paragraph 32 is the most consequential paragraph in the order and it went the wrong way. The Commission accepted the industry’s convenience argument and declined any mandatory delay. Verizon then implemented a 15-minute delay voluntarily and its customers do not appear to be in revolt. When a single carrier demonstrates that the burden argument is survivable, that argument has been tested and it failed.

The split naming is a real defect, not a cosmetic one. A subscriber who turns on T-Mobile’s SIM Protection and stops has left the port-out route open, and has every reason to believe they are finished. AT&T’s single toggle is the better design and it arrived last.

The documentation right at 64.2010(h)(6)(iii) is the most useful sentence in the rule and it is effectively unadvertised. A victim who does not know it exists cannot ask for it, and without it an arbitration or an insurance claim starts from the victim’s own account of events. I would expect that provision to matter far more in the next five years of SIM swap litigation than it has in the first two.

The unresolved compliance date is a strange loose end. More than two years after adoption I could not locate the notice that starts the clock. Carriers have shipped the feature regardless, which suggests the market moved ahead of the deadline, but a rule whose compliance date is unlocatable is a rule with an ambiguous enforcement posture.

What reduces your exposure

Switch on both locks, on every line. The SIM-change lock and the port-out lock defend different routes and most carriers keep them separate. Where a carrier offers a single toggle, one is enough. This blocks the request at the carrier; it does nothing about interception at the network signalling layer, and nothing if an attacker reaches your carrier portal login.

Include the lines you do not think about. A family plan is one account. Enabling the lock on your own line and not on a spouse’s or a child’s leaves a route into the shared account, and T-Mobile’s control in particular is applied per line rather than per account.

Verify by calling, not by looking. This is the same test the carrier audit runs, and it is the one measurement no published source currently supplies. Ring your carrier from a different phone and ask to move your number to a new SIM. If the request proceeds, the setting has not reached the systems the staff use, whatever the app displays. The limit of this test is real: a refusal proves the control held once, with one agent, on one day.

Set a distinct carrier PIN and put non-SMS multi-factor on the carrier account. This closes the route where breached credentials let somebody log in and lift the lock. It does not help against a carrier employee with legitimate system access, which is precisely the route a hard lock is for.

Add an email address to the carrier account and confirm alerts reach it. The rule requires the carrier to notify you before executing a SIM change. If the only channel is a text to the line being stolen, the warning arrives on the attacker’s handset. An out-of-band channel is not required by the rule, so you have to ask for it.

If it happens anyway, ask for the documentation in writing and cite the rule. 47 CFR 64.2010(h)(6)(iii) requires the carrier to provide documentation of a fraudulent SIM change, at no cost, on request. Get it early, in writing. It will not recover funds, and it is the record everything downstream is built on.

If a representative tells you no such feature exists, cite 47 CFR 64.2010(h)(4) and 47 CFR 52.37(d) and ask for a supervisor. Both require the lock at no cost from every commercial mobile radio service provider including resellers. If that fails, a complaint at consumercomplaints.fcc.gov creates a record the carrier must answer.

Sources

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.