Voice Fraud Detection for Telecom Account Recovery: Stopping Deepfake-Driven SIM Swaps

How Do Telecoms Stop Deepfake-Driven SIM Swap Fraud?

They stop it by making sure no single phone call can move a number. A SIM swap moves a customer's number to a SIM the attacker controls; a port-out moves it to another carrier. Either way the attacker starts receiving the victim's calls and one-time passcodes, and can reset bank, email and crypto accounts within minutes. The FBI's IC3 described the method in a February 2022 announcement: criminals impersonate the victim to the carrier, bribe an insider, or phish employees. It recorded 1,611 SIM swapping complaints in 2021 with adjusted losses of more than $68 million.

Voice cloning sharpens the impersonation route. An attacker who already holds the victim's breached personal data can now also sound like the victim, which matters where agents or voice biometric systems treat a familiar voice as reassurance. The FBI's December 2024 PSA on generative AI fraud warns that criminals use AI-generated audio to impersonate people and gain access to accounts.

The defence therefore has three layers: detect synthetic speech where possible, authenticate through something other than voice and knowledge, and give the real customer a chance to stop the move before it completes.

What the FCC's 2023 SIM Swap Rules Require

The Federal Communications Commission adopted its Protecting Consumers from SIM Swap and Port-Out Fraud order on 15 November 2023 and released it the next day. Its cornerstone is that wireless providers must use secure methods, reasonably designed to confirm a customer's identity, before performing SIM changes and number ports. The FCC deliberately did not name specific methods, saying a fixed list could become a roadmap for fraudsters or go stale, and instead required providers to review and update their authentication methods at least annually.

The order also requires procedures for failed authentication attempts, immediate notice to customers of SIM change and port-out requests, an option to lock accounts against SIM changes and ports, employee training, and limits on what agents can see before a customer is authenticated. Providers must track how well their SIM change protections work. The rules apply to prepaid and postpaid customers alike.

Why Knowledge Questions and Voiceprints Fail Against Cloned Callers

Knowledge-based checks ask for facts an attacker can buy: date of birth, address, last bill amount, account PIN reused elsewhere. NIST no longer accepts knowledge-based verification for identity proofing at all. Voice biometric matching measures similarity to an enrolled voiceprint, and a clone trained on the customer's own recordings is built to be similar. Put together, a caller with breached data and a cloned voice can pass both.

The Princeton finding cited by the FCC shows a process weakness that compounds this. If an agent will grant the change after one correct answer, regardless of earlier misses, the attacker can simply keep trying.

Controls for SIM Changes, Ports and Account Recovery

Build the controls around the request, not the caller's confidence. Requests that move a number or reset account access are high risk every time.

• Screen the call audio for synthetic speech and show the agent a clear flag, without exposing raw scores to the caller.
• Require approval in the carrier's authenticated app, or a fresh selfie or video check, before any SIM change, eSIM transfer or port-out requested by phone.
• Send immediate notice of the request to the existing device and email, and hold the change long enough for the real customer to object.
• Count failed authentication attempts across calls and channels; after a threshold, move the request to a store visit with ID.
• Let customers lock their number against SIM changes and ports, and require strong authentication to remove the lock.
• Hide account details from agents until authentication succeeds, so a caller cannot harvest data on a first failed call.

Where Voice Fraud Detection Helps and Where It Does Not

Synthetic speech detection gives the agent information that neither knowledge questions nor voiceprints provide: a sign that the voice itself may be generated. That is most valuable on exactly the calls that matter, number moves and resets. It is still a signal with error rates. Telephony codecs, background noise and poor lines degrade audio, and genuine customers sometimes sound unusual.

Detection also does not stop insider-assisted swaps or phishing of carrier employees, both methods the FBI describes, and it does not help when a real person reads a script for a fraudster. Those threats need access controls, employee monitoring and the notification and lock features the FCC requires.

How Neural Defend Fits Carrier Account Recovery

NeuroCall, currently in Beta, is Neural Defend's voice and call deepfake detection product. It screens call audio for signs of synthetic speech so the agent knows when to move a request out of the voice channel. Because it is in Beta, performance on a carrier's own telephony, codecs and caller population should be measured in a pilot before it drives routing.

For the step-up itself, NeuroVerify checks a selfie, video or audio sample for deepfakes and manipulation beyond liveness, returning six signals and a unified risk score in under 200 ms at p95 on eligible image requests under defined test conditions. A carrier app can request a face check before releasing an eSIM profile or confirming a port-out PIN. Both products can be deployed as a managed cloud API or in a private cloud, secure container, on premises or air-gapped, and Neural Defend holds ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 42001 and SOC 2 Type II certifications. The carrier's policy, not a score, decides whether a number moves.