An example of SIM swap fraud prevention as a governed process: agents do the 7 steps, and a person signs the gate before anything irreversible happens. Download it, import it into your workspace, and adapt it to your systems.
minctrl.process/v1 · hash 1c10ec104667…0e37
SIM-swap, port-out and account-takeover triage is manual, slow and fragmented across OSS/BSS, IDV and case tools while a single mistaken auto-approval hands a victim's phone number and every OTP-protected account to an attacker. The FCC 2024 mandate adds hard notification and authentication obligations on top of a fraud-loss exposure of $5-25M a year. Routine, low-risk SIM-changes and port-outs are scored and auto-cleared in seconds with FCC-mandated customer notifications fired automatically, while genuinely risky or anomalous requests are held with a written risk verdict. Only those reach a certified fraud analyst, who signs the irreversible number-release or port-out authorization with a complete authentication trail.
Releasing a number to a new SIM is effectively irreversible during the attack window — it hands over the victim's 2FA — so high-risk port-out/SIM-change requests require a stepped-up human verification before the number is released.
| Rule | What it requires |
|---|---|
| FCC SIM-swap & port-out protection rules | The FCC requires carriers to use secure customer-authentication methods before a SIM change or number port-out and to notify the customer of SIM-change and port-out requests on the account. |
| Port-out / number-release controls | A number should not be released or re-provisioned to a new SIM without passing step-up authentication, because a successful swap hands over the victim's calls, texts and 2FA codes. |
| CPNI safeguards | Customer Proprietary Network Information must be protected, so identity checks around account changes can't leak account data to a social engineer. |
A summary for orientation, not legal advice.
A minctrl.process/v1 document: the graph and the hash of the process it becomes.
Import into Minctrl opens this example in your workspace; one click stores it as your first version. Import JSON does the same with the file, and a file changed after download is refused.
Every connector starts in shadow: steps run, nothing leaves Minctrl until you configure a connector and switch it live.
Change signers, time limits and steps on the canvas. Each save is a new version; a running case stays on the version it started with.
The flow enforces secure customer authentication before any SIM change or number port-out and notifies the customer of the request, in line with the FCC's SIM-swap and port-out protection rules. Every request and check is logged with a tamper-evident audit hash.
Because releasing a number to a new SIM is effectively irreversible during the attack window — it hands the victim's calls, texts and 2FA codes to the attacker. High-risk port-out and SIM-change requests park for a stepped-up human verification before the number is released; the AI clears the clearly-legitimate, low-risk volume.
The AI agent scores each request against account signals — recent password or SIM changes, device and location anomalies, failed authentication — and applies step-up authentication. Requests that clear low-risk proceed; anything elevated routes to a human, and the rationale is recorded.