Engineering · 2026-03-11

The Invisible SIM-Swap: Carrier-Signal Variance as a Detector

By J. W. Bouckaert

The alert that never fires

Every SIM-swap detection system on the market operates on the same fundamental assumption: the carrier will tell you.

Vonage sends a sim_swap webhook. Twilio flags a number_porting event. Sinch returns a fraud_indicator in its verification response. The detection model is reactive: wait for the carrier to surface a discrete event, then respond.

This model works when the carrier knows a swap happened. It fails completely when the carrier does not.

There is a class of SIM-swap attack that produces no carrier alert. The swap occurs through social engineering of a carrier retail employee, through exploitation of internal provisioning tools, or through compromise of the carrier's own infrastructure. The subscriber identity module changes hands. The network re-authenticates. No webhook fires. No flag is set. The attacker now controls the phone number, and every system downstream of that number, including yours, has no indication that anything changed.

This is the invisible SIM-swap. And it is far more common than the industry acknowledges.

Carrier alerts and their ceiling

Carrier alerts are a critical first line of defense. PasskeyBridge's Pillar I ingests these signals and executes automated playbook responses inside the request. That capability is the expected baseline.

But relying exclusively on carrier alerts creates a single point of failure in the detection chain. If the alert does not fire, the entire response pipeline is inert.

The problem is architectural. Carrier alert systems are event-driven: they report known events. They cannot report events that bypass their own detection logic. An insider at a carrier retail location who processes a SIM swap through a legitimate provisioning interface generates a valid, authorized transaction. The carrier's fraud engine sees a routine subscriber update.

This is the gap. Not a gap in response time. A gap in observability.

A signal from the physical layer

When a SIM card moves from one physical device to another, the network path between the subscriber and the carrier's core infrastructure changes. Even when the swap is "invisible" to the carrier's event system, the physical layer tells a different story.

Every cellular connection exhibits measurable variance in its signal characteristics:

• Round-trip time (RTT) jitter: The statistical distribution of packet round-trip times between the device and the nearest cell tower. This distribution is a function of physical distance, atmospheric conditions, antenna characteristics, and the specific radio hardware in the device.
• Handover frequency: How often the device transitions between cell towers as part of normal mobility management. A device that has been stationary for months and suddenly exhibits rapid handover patterns has changed its physical relationship to the network.
• Signal strength variance: The standard deviation of RSSI (Received Signal Strength Indicator) measurements over a sampling window. Different physical devices, even with the same SIM, produce different variance profiles due to antenna design, case geometry, and radio firmware.
• Timing advance delta: The timing advance value assigned by the base station to compensate for propagation delay. A SIM swap to a device at a different physical distance from the tower produces a measurable shift.

None of these signals are binary. They are continuous, analog, and physically determined. They cannot be spoofed by software because they originate from the interaction between electromagnetic waves and physical hardware.

Carrier-signal variance as an entropy source

This is where NF-08 enters the picture.

PasskeyBridge's Spatially-Bound Identity Attestation system was designed to capture physical-layer entropy from device hardware: EMI spectral energy, on-die thermal variance, and accelerometer motion vectors. The sensor-capture SDK hashes these measurements on-device within a 100ms temporal window and transmits only the composite hash, never raw data.

The network jitter channel extends this architecture to the carrier signal layer. The sensor-capture SDK now samples RTT variance via the Resource Timing API, connection metadata via navigator.connection, and OS scheduler jitter via high-resolution timer deltas. These measurements are SHA-256 hashed on-device and included in the Atomic Fingerprint composite.

The critical insight is this: network jitter is signal, not noise.

When the same SIM is in the same device, connected to the same tower, the jitter profile exhibits a characteristic statistical distribution. When the SIM moves to a different device, even one in the same physical location, the jitter profile shifts because the radio hardware, antenna characteristics, and baseband firmware are different.

Jitter Profile A (original device):
  RTT mean: 12.3ms | RTT σ: 2.1ms | p95: 16.8ms | p99: 21.4ms

Jitter Profile B (swapped device, same location):
  RTT mean: 14.7ms | RTT σ: 3.8ms | p95: 22.1ms | p99: 31.2ms

SHA-256(Profile A) ≠ SHA-256(Profile B)
→ Spatial binding anomaly detected

The hash divergence is deterministic. It does not require a carrier alert. It does not require the carrier to know anything happened. The physics of the radio link has changed, and the Atomic Fingerprint captures that change.

Jitter replay detection

An attacker who understands this system might attempt to replay a previously captured jitter profile to maintain the illusion of continuity. The PasskeyBridge Spatial Binding Controller defends against this with a specific mechanism: jitter replay detection.

When the shield-spatial-bind edge function receives an Atomic Fingerprint submission, it compares the network_jitter_hash against all previous jitter hashes for the same user hash within the tenant. If an identical hash is found across distinct capture sessions, the system flags it as a replay anomaly and increments the anomaly score by +0.4.

This works because legitimate jitter measurements are inherently non-deterministic. The probability of two independent 80ms capture windows producing identical RTT variance distributions, scheduler delta sequences, and connection metadata is vanishingly small. Identical hashes across distinct sessions are, with near certainty, evidence of replay.

Capture T1: network_jitter_hash = "a3f7...c912"
Capture T2: network_jitter_hash = "8b21...d4e7"  ← Expected: different
Capture T3: network_jitter_hash = "a3f7...c912"  ← Matches T1: replay anomaly

Anomaly score += 0.4
→ Triggers graduated response via Trust Engine

The +0.4 anomaly increment is calibrated to be significant without being terminal. A single replay anomaly narrows the agent or user's trust state but does not auto-revoke. Persistent replay attempts, however, compound: two replay anomalies push the score past the threshold for automatic scope narrowing, and three trigger full revocation.

The four-channel composite

Network jitter is one of four channels in the Atomic Fingerprint composite. The full capture includes:

The two live channels (network jitter and accelerometer) are available today in any modern browser. They provide meaningful entropy for carrier-signal variance detection without requiring native app deployment or hardware partnerships.

The two pending channels (EMI spectral and thermal variance) require access to restricted hardware sensors via enterprise entitlements or firmware integration. These are the focus of ongoing hardware security partnerships with Apple Secure Enclave and Google Titan teams.

The composite hash is computed as:

fingerprint = SHA-256(
  emi_spectral_hash +
  thermal_variance_hash +
  accelerometer_hash +
  network_jitter_hash
)

Each channel contributes independent entropy. The composite is stronger than any individual channel. And critically, the on-device hashing ensures that no raw sensor data ever leaves the device. The server receives only hashes. This is the zero-PII architecture applied to physical-layer attestation.

Consequences for your threat model

If your identity security model depends exclusively on carrier alerts, you have a blind spot. The invisible SIM-swap, the one that produces no carrier event, bypasses your entire detection chain.

Carrier-signal variance analysis closes this gap by observing the physical layer directly. It does not replace carrier alerts. It augments them with a detection channel that operates independently of the carrier's own event system.

The practical implications:

1. Defense in depth: Carrier alerts (Pillar I) detect known swaps. Signal variance (NF-08) detects unknown swaps. Running both channels in parallel eliminates the single-point-of-failure in carrier-only detection.

1. Pre-authentication detection: Signal variance can be captured before authentication, during authentication, and continuously post-authentication. The jitter profile shifts the moment a swap occurs, regardless of whether the attacker has successfully authenticated.

1. Compliance posture: For regulated industries (SEC Reg S-ID, MiFID II, NERC CIP), demonstrating multi-channel identity verification with zero-PII storage satisfies audit requirements that single-channel detection cannot.

1. Quantum resilience: All Atomic Fingerprint hashes can carry hybrid PQC signatures (ML-DSA-65 + classical HMAC-SHA-256) on Enterprise plans, ensuring the detection mechanism survives the post-quantum transition.

Designing for the invisible swap

Security engineering is the discipline of assuming everything will fail and building systems that function when it does.

Carrier alerts will fail. They will fail because carriers are large, complex organizations with human employees, legacy systems, and imperfect fraud detection. They will fail because attackers are motivated, adaptive, and patient.

The question worth asking is what happens when your carrier alert system misses a swap.

PasskeyBridge's answer is to observe the physics. The electromagnetic relationship between a SIM card, a device, and a cell tower is a physical reality rather than a software abstraction, and it produces measurable, hashable, verifiable entropy. That entropy does not depend on the carrier's willingness or ability to report an event. It exists independent of any reporting system.

This is what we mean when we say identity is a physics problem. Cryptography secures the channel. Physics verifies the endpoint.

The invisible SIM-swap is invisible only to software. The signal is always there, if you know where to look.

Explore the Sensor Capture SDK → | SIM Swap Detection Overview → | Read the Hardware Brief → | Start building →

Start free · Test the API