2026-10-01 · Web3 Security
Federal rules have required every US wireless provider to offer a free SIM-change and port-out lock since 2024, and nobody publishes whether they comply, whether the locks hold, or how it changes. This is the first edition of a quarterly audit that does, with the rubric, the raw observations and the scoring code published so any figure can be checked or contested.
Key findings
- Three carriers were assessed from their own published documentation in the 2026-Q3 baseline: Verizon at 50.0 verified on 50 per cent coverage, Google Fi at 32.1 on 35 per cent, T-Mobile at 25.0 on 25 per cent. All three are marked provisional. Fifteen carriers are queued and published as not assessed rather than assumed.
- No carrier can score above 87.5 out of 100 on documentation alone, because the four criteria that measure whether a control actually works are capped at half credit unless verified by an account observation or a live test.
- No live enforcement test has been published by anyone, including this audit. Whether a support agent will lift a customer’s lock on request is the single largest open question in consumer SIM swap protection, and it is scheduled for the 2026-Q4 edition.
- AT&T and Cricket are unscored because att.com and cricketwireless.com both returned HTTP 403 to the audit’s fetcher on 4 August 2026. That is a coverage gap in the audit, not a finding against either carrier.
- Verizon publishes two properties no other national carrier does: that its representatives cannot disable SIM Protection on a customer’s behalf, and that disabling it triggers a 15-minute delay before any SIM transaction can process.
Case file
| Field | Value |
|---|---|
| What is measured | Whether the account-lock protections required by 47 CFR 64.2010(h) and 47 CFR 52.37 exist, are free, are discoverable, are enforced, and notify the customer |
| Scope | 18 US providers: 3 facilities-based national carriers, 13 resellers and prepaid brands, 2 security-focused MVNOs |
| Rubric | 100 points over 5 categories; weights derived from documented SIM swap cases rather than feature completeness |
| Heaviest single criterion | Live enforcement test, 15 points, the only criterion that measures the control rather than the claim |
| Verification methods | live > account > doc > support. Each criterion declares a floor; a claim verified below its floor is capped at half credit in code |
| Metrics published | Score (of assessed points), Coverage (of applicable points), Verified (score weighted by coverage, the ranking metric) |
| Decisive flag | NO_ENFORCEMENT, fired when a live test shows an advertised lock did not hold, caps the total at 49 regardless of documentation |
| Baseline edition | 2026-Q3, documentation tier. 3 carriers assessed, 15 queued |
| Ethical boundary | Testing is performed only on lines the audit owns. No impersonation, no false identification, no false statement to an agent |
| Posture as of 1 October 2026 | Baseline published. Live enforcement testing begins 2026-Q4 |
| Defensive action | Run the same test on your own carrier: call from another phone with the lock on and ask for a SIM change |
What the record shows
Why an audit rather than a comparison table
Since 2024, 47 CFR 64.2010(h)(4) has required every US wireless provider to “offer customers, at no cost, the option to lock their accounts to prohibit the CMRS provider from processing requests to change the customer’s SIM”, with an identical no-cost requirement for number ports at 47 CFR 52.37(d), and both rules apply expressly to resellers as well as the national carriers.
Comparison tables of these features exist, including the one in the companion piece on the carrier lock. They record what carriers say. Nobody maintains a record of what carriers do, whether it changes, or what evidence sits behind each claim. That gap is the reason for the audit, and it is why the unit of publication is a dated observation with a source attached rather than a tick in a cell.
How the rubric was built
The rubric allocates 100 points over five categories. The allocation is the argumentative part, so it is published with a stated justification for every weight rather than asserted.
| Category | Points | Question |
|---|---|---|
| Core controls | 30 | Does the legally required protection exist at all, free, on every plan tier? |
| Enforcement strength | 30 | When the lock is on, does it hold? |
| Detection and notification | 20 | Will the customer find out in time to act? |
| Account hardening | 10 | Can the lock be defeated by taking over the carrier account itself? |
| Transparency and remediation | 10 | Can a customer find the control, and get help after a failure? |
Enforcement carries the same weight as the existence of the controls, and the single live-test criterion carries 15 points, the largest in the rubric. The justification is the case record rather than a preference: in the documented thefts, what failed was not a missing feature but a person. A forged identity document at FTX and at the SEC. A plausible telephone story in the Princeton study, which succeeded four times in five. A $3,500 payment to a carrier employee named in the 2019 “The Community” indictment. Weighting enforcement below existence would score a carrier on its feature list rather than on the thing that broke. Those cases are set out in the piece on the attack and the case record.
The method floor, which is the part that stops marketing scoring as fact
Each criterion declares a minimum verification method. A finding verified more weakly than the criterion requires has a yesautomatically capped at half credit, enforced in the scoring code rather than by editorial judgement.
| Method | Meaning |
|---|---|
live |
Tested against the running service |
account |
Directly observed inside an active account |
doc |
Read in the carrier’s own published documentation |
support |
Stated by an agent, not otherwise confirmed |
Third-party reporting is not a verification method at any level. It can prompt an investigation; it cannot produce a score.
The practical effect is a ceiling. Because the live-test criterion requires live, and three further criteria require account, the highest score obtainable from documentation alone is 87.5, which is a B. No carrier can earn an A on the strength of its own support pages.
The three numbers, and why one alone is misleading
Each carrier carries three figures.
- Score is the percentage of assessed points earned. It measures the quality of what was checked.
- Coverage is the percentage of applicable points that were assessed at all.
- Verified is the score weighted by coverage, treating every unassessed criterion as zero.
Verified is the ranking metric. The reason is a flaw the first run exposed: ranking by score alone put a carrier assessed on a quarter of the rubric above one assessed on half, both at full marks. Ranking on the conservative figure means no carrier places highly on thin coverage, and the only way for the audit to improve a carrier’s rank is to verify more of it. Anything under 60 per cent coverage is labelled provisional.
The 2026-Q3 baseline
The first edition is documentation tier. Only findings read directly from a carrier’s own pages were scored; anything known solely from third-party reporting was left unverified and queued.
| Carrier | Verified | Score | Coverage | Grade |
|---|---|---|---|---|
| Verizon | 50.0 | 100.0 | 50% | A, provisional |
| Google Fi | 32.1 | 92.4 | 35% | A, provisional |
| T-Mobile | 25.0 | 100.0 | 25% | A, provisional |
| 15 others | not assessed | 0% |
What was confirmed, in each case from the carrier’s own page and read on 4 August 2026:
Verizon. SIM Protection and Number Lock both exist and are free, on postpaid and prepaid. Representatives cannot disable SIM Protection for a customer; only the customer can, through the app or website. Disabling it imposes a 15-minute delay before any SIM transaction can process. Enabling and disabling is restricted to account owners and managers.
Google Fi. Number Lock covers both transfer to another phone and port to another carrier, at no extra cost, and managing it requires re-entering Google account credentials. Prepaid parity is recorded as not applicable, because Fi operates a single postpaid tier. Its account-hardening criterion was capped at half credit because it was verified from documentation where the rubric requires an account observation.
T-Mobile. Account Takeover Protection is complimentary and available to T-Mobile Postpaid, T-Mobile for Business, T-Mobile Prepaid and Metro by T-Mobile. It must be added per line. On postpaid, only the Billing Responsible Party can remove it. T-Mobile’s SIM Protection was left unverified because no carrier-owned page for it was located during the pass, which is why its coverage is the lowest of the three.
AT&T and Cricket are unscored. Both att.com and cricketwireless.com returned HTTP 403 to the audit’s fetcher on 4 August 2026. That is a limitation of the audit, not a finding about either carrier, and it is recorded that way in the raw data. On the published evidence AT&T’s single-toggle Wireless Account Lock is very likely the most usable design among the three national carriers, because one control removes the possibility of enabling half the protection and believing you are done.
What is deliberately not measured
Network-layer interception through SS7 and Diameter signalling is outside any single carrier’s account controls, and the FCC opened a separate inquiry into it in DA 24-308 on 27 March 2024. Internal security practice, employee vetting and fraud analytics are invisible from outside. Past breaches inform the rubric’s weights but are not scored against a carrier, because a carrier that was breached and then fixed the cause should not be permanently penalised for it.
The boundary that shapes the live test
The audit does not test whether a stranger can convince a carrier to swap a locked line. Doing so requires impersonating a customer or presenting false identification, both of which are crimes, and Eric Council Jr. received 14 months for precisely that conduct in the SEC case.
What the audit tests instead is the adjacent question: with the lock enabled on a line the audit owns, will the carrier perform a SIM change when the verified account holder asks?
That is not a weaker substitute. The rule says the provider “shall not fulfill a SIM change request until the customer deactivates the lock”, with no exception for a request from the customer. A carrier that performs the change anyway has not implemented a lock; it has implemented a preference an agent can override. And once an agent can override it, the only remaining barrier is that agent’s judgement about who is calling, which is exactly the judgement the case record shows being defeated by a forged licence, a plausible story or a bribe. Both tests measure the same property: whether the control is enforced by the system or by a person.
What I think is going on
A first edition that publishes its own thin coverage is worth more than one that pads. Three carriers at 25 to 50 per cent coverage is not an impressive table. It is an honest one, and the alternative was to score fifteen carriers from press coverage and call it research. Coverage is published next to every score for the same reason: a provisional A quoted on its own is a misleading number, and the format is designed to make quoting it that way awkward.
The interesting result is not the ranking, it is what the ranking cannot yet contain. Every score in this edition rests on what carriers publish. The rubric is built so that documentation alone cannot produce an A, which means the current table is measuring disclosure quality more than security. That is a real finding about the state of public evidence: on the question a subscriber most needs answered, whether the lock holds, there is currently no public evidence at all.
Verizon’s two published properties are the most substantive difference between the national carriers. A control the carrier’s own staff cannot lift removes the call-centre route, which is the route most of the case record runs through. A 15-minute delay is the cooling-off period the FCC declined to mandate at paragraph 32 of FCC 23-95. Both are voluntary, and the fact that one carrier implemented them undercuts the industry argument that such requirements are unworkably burdensome.
I expect the diff to be more valuable than any single edition. A static table is a reference. A carrier removing a delay, renaming a setting, or moving it behind a paid tier is news, and it is not currently detectable by anyone because nobody is holding a dated baseline. That is the actual product here, and it does not exist until there are two editions.
What reduces your exposure
Run the enforcement test on your own carrier. Enable the lock, then call from a different phone and ask to move your number to a new SIM. If the agent offers to lift the lock for you and proceed, you have learned something the published documentation will not tell you. Decline to complete the change. This tells you about your own account; it does not generalise to every queue at that carrier, and a refusal proves the control held once.
Read the score with the coverage attached. A provisional grade on a quarter of the rubric is a statement about how much has been checked, not a recommendation. Where this audit says not assessed, it means not assessed, and no inference in the carrier’s favour is intended.
Prefer the carrier behaviours over the carrier brands. The properties worth choosing on are whether staff can override the lock, whether a delay follows unlocking, whether alerts can reach a channel other than the line being stolen, and whether the carrier account itself takes non-SMS multi-factor. Those reduce specific routes. None of them addresses signalling-layer interception, and none of them helps if an exchange will still reset your account from a phone number.
Treat a single toggle as a usability advantage. Where a carrier splits protection across two differently named settings, the failure mode is a subscriber who enables one and believes the job is finished. That is not a scoring difference in this rubric, because both configurations block both routes when fully enabled, and it is a real difference in how often they end up fully enabled.
Contest a finding if you have the document. The raw observations, the rubric and the scoring code are published. A correction supported by a primary source is applied with a dated changelog entry, and prior editions are not rewritten to match.
Sources
- Federal Communications Commission, Report and Order and Further Notice of Proposed Rulemaking, WC Docket No. 21-341 (FCC 23-95)
- FCC, fact sheet and draft rule text, 25 October 2023
- FCC, Public Notice DA 24-308, SS7 and Diameter security inquiry, 27 March 2024
- Verizon, What is a SIM Swapping Scam?
- T-Mobile, Account Takeover Protection
- Google Fi Wireless, Protect your Google Fi number against SIM swaps
- Kevin Lee, Ben Kaiser, Jonathan Mayer and Arvind Narayanan, An Empirical Study of Wireless Carrier Authentication for SIM Swaps, USENIX SOUPS 2020
- Brian Krebs, Nine Charged in Alleged SIM Swapping Ring, Krebs on Security, May 2019
- CNBC, SEC bitcoin hack case gets Alabama man sentenced to 14 months in prison, 16 May 2025
Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.