Portugal's Three Big Mobile Networks Will Let Banks Ask Whether Your SIM Card Was Just Swapped: What the Check Does, and What You Can Do Now
MEO, NOS and Vodafone have joined the GSMA's Open Gateway, so banks and other firms can check whether a number matches the phone in use and whether its SIM changed recently. No bank or start date was named, and SMS codes stay. How to protect your line now.
Banks and other companies will be able to ask Portugal's three largest mobile networks two questions about a customer's phone number: does it belong to the phone being used, and has it just been moved to a new SIM card? MEO, NOS and Vodafone announced at a joint press conference in Lisbon on Tuesday, 20 October, that they have joined GSMA Open Gateway, the global operators' association's programme of standard network interfaces (APIs) for businesses, ECO and Dinheiro Vivo reported. Fraud prevention is the first use. Digi, the fourth operator, is not part of it, Público noted.
What the two checks do
The standards come from CAMARA, an open-source project hosted by the Linux Foundation, which describes them as follows.
- SIM Swap tells a business whether the SIM card linked to a number has changed recently, either as the date of the last change or as a yes or no answer for a set period, such as the last 24 hours. A bank might check before a suspicious transfer or a password reset.
- Number Verification confirms, without the customer typing anything, that the number entered in an app matches the number of the phone connected to the network, returning true or false. CAMARA presents it as a way to skip the SMS code in some logins and sign-ups.
A third check, Number Recycle, which flags a number that has been reassigned to a new user, is due early next year, ECO reported. Nokia's Network as Code platform links the three networks, so a company can run the checks whichever operator its customer uses.
What it does not do, yet
It is a tool for companies, not a customer service. No bank was named as a user and no date was given for any bank to start. Nor are SMS codes being withdrawn: MEO's Filipe Arnaut Mendonça called the checks a complement to two-step authentication and said they could, in time, replace it, ECO reported.
Why your SIM matters, and what to do now
For most residents, immigrants included, a Portuguese mobile number is the key to their bank account and MB WAY. In a SIM swap, a criminal who has gathered your personal details poses as you to get a duplicate SIM, then receives the codes your bank sends by text, as Público and the state bank Caixa Geral de Depósitos explain. Steps from the Bank of Portugal's customer portal and Caixa's own advice:
- If your phone suddenly loses signal for no clear reason while other devices work, contact your operator and your bank at once (Caixa).
- Ask your operator for extra protection on changes to your line, such as a PIN or in-person confirmation, and set a PIN on the SIM itself (Caixa).
- Where a service allows it, use an authenticator app rather than SMS codes (Caixa), and biometric login in your bank's app (Bank of Portugal).
- Turn on alerts for transfers and debits, and check the date and time of your last homebanking login (Bank of Portugal).
- Your bank will never ask for your homebanking or app login by phone, email or text, and a caller knowing your basic details proves nothing (Bank of Portugal).
- Report any movement you do not recognise to your bank immediately (Bank of Portugal).
See also the rules for keeping an MB WAY account safe and when a bank that skips the payee check must refund you.
