T-Mobile's finally taking SIM-swap fraud seriously with new transfer PINs

AT&T and Verizon already using PINs

T-Mobile is reportedly working to join AT&T, Verizon, and other carriers in offering a security measure that will prevent scammers from stealing your phone number and gaining access to numerous other online accounts.

The T-Mo Report has obtained an internal bulletin which says the company will be implementing a Number Transfer PIN as part of the customer port-out process, though a start date has yet to be determined.

AT&T and Verizon, the nation's two other major wireless carriers, implemented NTPs in 2020. A number of prepaid carriers also use NTPs for porting. The FCC proposed rules regarding NTPs late last year.

Customers can generate an NTP when they want to transfer their phone number to another carrier either by logging into their account through their current carrier's website or app. In T-Mobile's case, these PINs will be six digits and would be valid for 7 days once requested. Only consumer postpaid accounts (excluding those on a Lifeline plan) will be eligible for NTPs to start.

Scammers have conducted SIM swap attacks by convincing customer service staff to transfer phone numbers without their owners noticing — passing through security questions with "close enough" guesses — which can then be turned around to access other accounts where telephony is used as a second factor for authentication.

The T-Mo Report also notes that T-Mobile started letting customers turn on a port-out block setting previously only used internally called "NOPORT" after a data breach last August.