Security · 2026-03-01

SIM-Swap Detection on Its Own

By J. W. Bouckaert

The detection gap

Most identity platforms today can surface a SIM-swap event within seconds of it occurring. The signal arrives via a carrier API—Vonage Number Insight, Twilio Lookup, Sinch Verification, or a direct mobile-network feed. The event is logged. An alert fires. A row appears in a SIEM dashboard.

Then nothing happens, fast enough.

The damaging gap sits between the alert and the orchestrated response that actually protects the account: revoked sessions, frozen credentials, suspended agent delegates, and a notified user. We went through the mechanics of that interval in You Detect SIM Swaps. But What Happens in the Next 50 Milliseconds?. The shorter that window, the lower the loss.

The relevant adversary benchmark is account-takeover speed. The FBI IC3 public service announcement on SIM swapping describes attacks that reach mobile-banking and crypto-exchange transfers in minutes, not hours. Coalition's published 2024 Cyber Claims Report attributes a substantial share of paid claims to compromised credentials, with severity rising sharply when MFA depends on a phone number. The detection window does not need to close in seconds for compliance. It needs to close in seconds for survival.

Response is harder than detection

Detection is a read operation. You receive a webhook, parse the payload, and compare it against a known pattern. It is stateless and deterministic.

Response is an orchestration problem. You need to:

1. Authenticate the signal—verify HMAC signatures, validate payload structure against the carrier's schema, reject replays.
2. Resolve the affected user—map the carrier identifier (which is a phone number) to your internal user model without persisting the raw identifier in plaintext.
3. Execute ordered actions—suspend sessions, revoke tokens, freeze passkeys, suspend agent delegates, notify the user, alert your security team.
4. Handle failures—retry failed callbacks with backoff, escalate when actions time out, never lose an in-flight playbook to a transient error.
5. Audit everything—append-only, tamper-evident, exportable for SOC 2 Type II evidence.

Every team that has ever built this rebuilds the same five layers. Every implementation hits the same race conditions, the same idempotency bugs, the same audit gaps. See Building an Identity Threat Playbook in Under 10 Minutes for the alternative.

The three-pillar solution

PasskeyBridge does not stop at orchestration. It composes the response into a complete identity threat response stack. The architecture is covered end-to-end in Introducing PasskeyBridge.

• Pillar I (Signal Ingest & Response)—Carrier signal to playbook completion inside one request. SIM-swap detection triggers immediate session revocation, credential freezing, and stakeholder notification. Resilient to single-carrier outages via pipeline circuit breakers.
• Pillar II (Verifiable Credentials)—Once a threat is contained, re-verification happens through cryptographic proofs rather than passwords or SMS. OpenID4VP and OIDC4VC let users prove identity without exposing PII.
• Pillar III (Biometric Binding)—WebAuthn passkeys bind identity to a hardware authenticator. Even if an attacker successfully ports a SIM, they cannot replicate a TPM-attested biometric.

Parametric revocation

When a SIM-swap signal arrives, PasskeyBridge does not just write a row. The parametric revocation engine fires in parallel:

1. Revokes all active passkey credentials for the affected user.
2. Suspends scoped agent delegates so no autonomous system continues acting on a compromised identity.
3. Triggers social recovery workflows when guardian thresholds are configured.
4. Writes every action to the append-only audit trail.
5. Emits CAEP events to downstream relying parties via SSE/CAEP so federated sessions die at the same instant.

The result is a contained blast radius across all three pillars in a single response window, with one set of audit artifacts that satisfy both incident-response and SOC 2 Type II evidence.

That is what identity threat response as a service looks like. Detection is the input. Response is the product.

Further reading

• FBI IC3 Public Service Announcement: SIM Swapping—Plain-language reference on attack mechanics and consumer impact.
• Coalition 2024 Cyber Claims Report—Empirical loss data tying credential compromise to claim severity.
• CISA Implementing Phishing-Resistant MFA—Why SMS-tied MFA is no longer treated as a baseline control.
• The SIM-Swap Detection Latency Blind Spot—The latency math behind why milliseconds matter.
• Account Takeover Prevention—How the same signal chain closes the credential-replay and SIM-swap-recovery gaps in one deployment.
• Insurance Underwriting Meets Identity Assurance—How carriers are now pricing the same controls discussed here.

Start free · Test the API