Port-out fraud

Port-out fraud is the unauthorized transfer of a phone number from the victim's carrier to a different carrier controlled by the attacker. It achieves the same result as a SIM swap, attacker control of the number, through the number-portability process rather than a SIM change, and it can be harder to reverse because the number has left the original carrier entirely.

Detection differs from SIM-swap detection in what the network exposes. A swap shows up as a new IMSI on the same operator; a port shows up as a change of operator for the number, which the losing carrier may report only after the transfer completes. That lag is the reason port signals are usually checked as a window rather than an instant.

Recovery is slower too. Reversing a port means a second port, negotiated between two carriers, while the attacker holds the number and receives every code sent to it.

The defensive consequence of the reporting lag is that port signals cannot be read as an instant. A rule that asks whether a port completed in the last N hours will miss one that is in flight, and a rule that asks whether a port is pending depends on the losing carrier exposing that state at all. Where both are available they answer different questions, and a system that treats them as one signal will behave inconsistently across operators.

Number portability is a consumer protection, which is why the process is designed to be easy and why hardening it is a regulatory conversation rather than a product one. The controls that do exist, port-out PINs and account-level freezes, sit with the carrier and are invisible to a relying party deciding whether to authorize a transfer right now.

For that relying party the practical posture is the same as for a SIM swap: treat a recent change of control over the number as a reason to require proof that does not travel over the number. Both are cases where the credential is valid and the channel behind it has moved.

Unlike a swap, the observable is a change of operator rather than a new SIM tenure on the same network.