Identity verification for SIM change and eSIM transfer

What SIM change asks of identity checks

Activating a new line and changing the SIM on an existing line are different problems. At activation, nobody has the number yet. At a SIM change, a real subscriber is already using it, and the request asks the operator to move that number to a SIM or an eSIM profile the requester holds. If the operator accepts a date of birth, an address or the last payment as proof, anyone who has read a leaked database can pass. The job of the identity check here is to answer one question: is the person asking the same person who holds the line?

• Re-verify the existing subscriber before the change, whether the new SIM is a card or an eSIM profile.
• Do it where the request arrives: at the counter, in the app or on a call.
• Catch the same face behind requests against many numbers.
• Fall back to a full verification for a subscriber who has no stored face.

The flow

1. Request. The subscriber asks for a new SIM or for an eSIM transfer. This step is in your channel, whether a shop, an app or a call centre.
2. Hand-off. Your backend creates a session. A subscriber at a desktop or at a counter terminal scans a QR code to continue on a phone, or follows a one-time link.
3. Reference comparison. The returning user is compared with a stored reference face, and active liveness confirms a live person.
4. Full verification when there is nothing to compare. If no face is stored, the subscriber photographs a document, the document is read and checked for fraud, and the selfie is matched to the document portrait. Your own rule compares the result with the subscriber on file.
5. Many numbers, one face. Repeat-user search looks for the same face among earlier verified users, and your own person lists and blocklists are checked in the same flow.
6. Decision. Your system reads the session status or receives a webhook. It carries out the swap, asks for another attempt or sends the case to a person, who can decide manually in the dashboard.
7. Notice. Telling the subscriber that a change was made is your step, through the channels you already hold for that subscriber.

Where this differs from the telecom pages

The telecom page and the prepaid registration page are about a person who does not yet hold a line. This page starts after that: the line exists, a real subscriber depends on it, and the request is a change. The evidence that matters is not a fresh registration but a comparison with what the operator already holds, and the decision point is whether the swap goes ahead.

Modules used

• Face verification, with the comparison of a returning user against a stored reference face, and liveness.
• Document verification for the subscriber without a stored face.
• Repeat-user search and blocklists, described on the face verification page.
• QR hand-off and one-time links for a counter or desktop.
• Dashboard for manual decisions.
• REST API and webhooks.

Regulatory frame

One primary text: section 64.2010 of Title 47 of the Code of Federal Regulations, safeguards on the disclosure of customer proprietary network information, in the electronic Code of Federal Regulations. It applies to providers regulated in the United States. Paragraph (h) concerns SIM changes.

• Paragraph (h) applies to a provider of commercial mobile radio service, including resellers of wireless service, and defines a SIM as a physical or virtual card associated with a device that stores unique information that can be identified to a specific mobile network.
• Paragraph (h)(1) requires the provider to use secure methods to authenticate a customer that are reasonably designed to confirm the customer's identity before executing a SIM change request.
• It adds that those methods shall not rely on readily available biographical information, account information, recent payment information or call detail information, unless otherwise permitted by the exceptions it names.
• It requires the provider to review its authentication methods regularly, but not less than annually, and to update them as necessary.
• Paragraph (d) allows a telecommunications carrier to disclose customer proprietary network information to a customer who, at a retail location, first presents a valid photo ID matching the customer's account information.
• Paragraph (h)(9) states that compliance with paragraph (h) is not required until that paragraph is removed or contains a compliance date.

This block describes the text, not our service. For information; not legal advice.

Sources

• Title 47 of the US Code of Federal Regulations, section 64.2010, electronic Code of Federal Regulations, fetched 27 October 2026.

Next

Try the interactive tour, read the account recovery use case or talk to us.