Using subscriber identity module (SIM) card as a security key for SIM swap fraud prevention

A communications system to provide subscriber identity module (SIM) swap fraud prevention without a two-factor authentication (2FA) re-registration upon a legitimate SIM change, the system comprising:

• a datastore to store a SIM indicator in association with a first international mobile subscriber identity (IMSI) recorded for a mobile station international subscriber directory number (MSISDN), wherein the first IMSI is associated with a first SIM card, wherein the SIM indicator and the MSISDN are associated with a 2FA registration with a service provider;
• a first network node comprising:
• at least one first processor;
• at least one first non-transitory memory;
• and
• a SIM management application comprising instructions stored at the at least one first non-transitory memory, which when executed by the at least one first processor, causes the SIM management application to:
• determine that a level of risk for a SIM change associated with the MSISDN satisfies a threshold, wherein the SIM change is further associated with a second IMSI of a second SIM card different than the first SIM card;
• and
• update, based on the determining, the datastore to associate the SIM indicator with the second IMSI,
• a second network node comprising:
• at least one second processor;
• at least one second non-transitory memory;
• and
• a SIM secure application comprising instructions stored at the at least one second non-transitory memory, which when executed by the at least one second processor, causes the SIM secure application to:
• receive, from the service provider after the datastore is updated, an OTP delivery request comprising an OTP message, the MSISDN destined to receive the OTP message, and the SIM indicator associated with the MSISDN, wherein the OTP delivery request is associated with the same 2FA registration with the service provider;
• determine, based on the OTP delivery request, a current IMSI associated with the MSISDN destined to receive the OTP message;
• obtain, from the updated datastore, based on the SIM indicator in the OTP delivery request, the second IMSI;
• and
• deliver, based on a match between the current IMSI associated with the MSISDN destined to receive the OTP message and the second IMSI obtained from the updated datastore, the OTP message to a user device associated with the MSISDN.

A method implemented in a communications system to utilize a subscriber identity module (SIM) card at a user device as a security key for SIM swap fraud prevention, the method comprising:

• receiving, by a SIM secure application at a computing system comprising a service delivery gateway (SDG) of the communications system, from a service provider, an initial one-time password (OTP) delivery request comprising an initial OTP message, a mobile station international subscriber directory number (MSISDN) destined to receive the initial OTP message, and a request for a SIM indicator associated with the MSISDN, wherein the initial OTP delivery request is based on a registration of the MSISDN for second factor authentication (2FA) with the service provider;
• delivering, by the SIM secure application, the initial OTP message to a user device associated with the MSISDN;
• determining, by the SIM secure application based on the delivering, an international mobile subscriber identity (IMSI) of a SIM card in the user device associated with the MSISDN;
• obtaining, by the SIM secure application, based on the determined IMSI, from a datastore comprising a plurality of SIM indicators, each in association with an IMSI of record for a respective MSISDN, a first SIM indicator of the plurality of SIM indicators;
• transmitting, by the SIM secure application to the service provider, a delivery report including the first SIM indicator and an indication of a successful delivery of the initial OTP message;
• receiving, by the SIM secure application from the service provider, a subsequent OTP delivery request comprising a subsequent OTP message, the MSISDN destined to receive the subsequent OTP message, and the first SIM indicator;
• determining, by the SIM secure application based on the subsequent OTP delivery request, a current IMSI associated with the MSISDN destined to receive the subsequent OTP message;
• obtaining, by the SIM secure application, from the datastore based on the first SIM indicator in the subsequent OTP delivery request, an IMSI of record for the MSISDN destined to receive the subsequent OTP message;
• comparing, by the SIM secure application, the current IMSI associated with the MSISDN destined to receive the subsequent OTP message and the IMSI of record for the MSISDN destined to receive the subsequent OTP message;
• and
• determining, by the SIM secure application, based on the comparing, whether to deliver the subsequent OTP message to the MSISDN or block delivery of the subsequent OTP message to the MSISDN.