Composite phone trust scoring raises the bar for ATO defence

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zumigo's blog post: A neobank can score phone trust from porting history, SIM swap activity, device changes, call forwarding, and consortium fraud signals.

Why it matters: That matters because customer identity teams need to treat phone intelligence as a dynamic fraud control, not a static profile, when defending account recovery and step-up authentication.

Context

Mobile trust decisions often fail when teams treat a phone number as a fixed identifier instead of a mutable asset tied to carrier changes, device churn, and fraud behaviour. In customer identity programmes, that mistake creates a gap between what the account looks like on file and what is actually happening at the moment of authentication.

For neobanks and other mobile-first services, the question is not whether a number exists, but whether it is behaving like a trustworthy recovery and challenge factor right now. That requires combining historical reputation with real-time state, because a clean record can still hide an active takeover attempt.

The governance challenge is account takeover prevention: a phone can be legitimate in origin and still become unsafe through recent porting, call forwarding, or reuse across suspicious contexts.

Key questions

Q: How should teams detect account takeover using phone-based signals?

A: Teams should detect account takeover by correlating phone-based signals such as SIM change events, number porting, call forwarding changes, device changes, and failed login patterns around the same account. A sudden shift in telecom signals combined with password resets, new payee setup, or MFA enrolment often indicates fraud, so treat the phone number as one signal, not proof of identity.

Q: Why does call forwarding increase the risk of phone-based authentication?

A: Call forwarding increases the risk of phone-based authentication because an attacker can redirect voice calls and one-time codes away from the legitimate handset. If authentication or recovery depends on voice OTP, callback verification, or help desk checks tied only to the number, forwarding can let the attacker receive or intercept the trust signal.

Q: How do SIM swaps change the risk profile of mobile identity checks?

A: SIM swaps weaken mobile identity checks because control of the phone number moves to an attacker, letting them intercept SMS one-time passwords and account recovery messages. Phone-number possession is a weak factor on its own, so stronger controls use app-based MFA, device binding, risk signals and step-up verification for high-risk changes.

Q: When should banks step up authentication for a phone number?

A: Banks should step up authentication when a phone number is newly enrolled, recently ported, associated with a SIM change, or used from a new device, especially before password resets, payee changes, or high-risk transfers. The link phrase account takeover prevention fits because these triggers help distinguish legitimate access from fraud.

Technical breakdown

Why phone trust has to be composite

Phone trust scoring works because no single telecom or device signal captures the full risk picture. Port history shows whether a number has changed hands often, SIM swap activity reflects recent possession change, call forwarding can silently redirect voice-based one-time codes, and device changes indicate that the handset behind the number may no longer match expectations. A composite score is simply a way to weight those signals together at decision time. The architecture matters because each signal has a different time horizon: some are historical, some are real-time, and some depend on cross-customer intelligence.

Practical implication: Treat phone reputation as a scored decision input, not as a binary attribute, and weight historical and real-time signals differently.

Why real-time state matters more than static reputation

Static reputation tells you what has been true about a number in the past. Real-time checks tell you whether the number is safe to trust at this moment. That distinction matters because a SIM swap, active call forwarding, or recent device change can turn an otherwise normal-looking phone into an active fraud path inside a single session. The mechanism is especially important for voice OTP and recovery flows, where the attacker does not need long-term compromise, only enough control to intercept the challenge. Real-time state therefore becomes a control surface, not just an observation layer.

Practical implication: Verify live phone state before sending recovery or step-up challenges, especially where voice-based factors are still in use.

How consortium signals extend fraud detection beyond one bank

Consortium data broadens the trust model beyond what any one bank can observe. If the same number appears in spoofing attempts, unusual OTP request patterns, or multiple identity relationships across customers, the score can incorporate that cross-tenant pattern as a risk indicator. This is a different class of signal from direct account telemetry because it reflects ecosystem behaviour, not just one organisation's logs. In practice, that makes the score useful for spotting identity reuse, bot-driven attempts, and numbers that have a fraud history outside the local environment. See the Account Takeover Prevention Guide.

Practical implication: Use shared fraud intelligence to identify numbers that look normal locally but risky across a wider set of institutions.

Threat narrative

Attacker objective: The attacker wants to take over the customer account by turning the victim's phone number into a trusted authentication path.

1. Entry begins with control of the phone number through porting, SIM replacement, or another possession shift that makes the number usable by the attacker.
2. Credential access follows when voice OTP, recovery prompts, or other phone-bound challenges are intercepted through the compromised line or forwarded calls.
3. Escalation occurs as the attacker uses the trusted phone relationship to reset access, pass step-up checks, or attach new devices and contact points.
4. Impact is account takeover, where the attacker can operate as the customer and extend control into banking, recovery, or fraud-enabled transactions.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Composite phone trust is a governance response to signal fragility: A single mobile attribute is too brittle to support account trust on its own. Porting history, SIM swap activity, forwarding state, device changes, and consortium intelligence each capture a different slice of risk, so the programme has to govern the combined signal rather than any one check. Practitioners should think in terms of decision quality, not signal count.

Call forwarding is an identity control failure, not just a telephony setting: Once forwarding is active, a voice-based challenge can be defeated without changing the account password or touching the bank's core systems. That makes the phone line part of the authentication surface, which is why recovery and step-up flows need to treat line state as security-sensitive.

Phone intelligence creates an identity blast radius: A number that has been ported repeatedly, tied to unusual device churn, or seen across multiple suspicious relationships can contaminate the trust decision for every downstream account that relies on it. The implication is that customer identity governance now depends on understanding how a single factor behaves across multiple sessions and institutions.

Fraud history is becoming part of the identity control plane: When consortium data contributes to the score, the control is no longer limited to local account records. That expands detection coverage, but it also means practitioners need clearer governance over how external signals are weighted, interpreted, and challenged in recovery flows.

Customer identity teams should treat mobile trust as a live risk model: The useful unit is not the phone number itself, but the state of that number at the moment the customer asks for access. That shifts the governance question from static enrolment to continuous trust evaluation in authentication and recovery.

What this signals

Customer identity programmes should move away from treating the phone number as a stable factor and toward treating it as a continuously evaluated trust surface. The practical shift is from enrolment-time confidence to session-time confidence, especially where recovery and voice challenge flows still matter.

Identity blast radius: A number that is repeatedly ported, forwarded, or reused across suspicious contexts can weaken trust across multiple accounts at once. That makes mobile intelligence a programme-level issue, not just a fraud-team signal, because one compromised factor can affect many downstream access decisions.

For practitioners

• Separate historical from real-time phone signals Assign different weights to port history, SIM swap events, forwarding status, device changes, and fraud consortium signals so one weak indicator does not dominate the decision.
• Block recovery when call forwarding is active Treat active forwarding as a high-risk condition for voice OTP and account recovery, because it can redirect challenges without changing the core account data.
• Use mobile intelligence in step-up decisions Require a phone trust check before sending recovery codes or approving high-risk account changes, especially for accounts with recent porting or device churn.
• Review consortium-based fraud thresholds Validate how often repeated OTP requests, spoofing references, or cross-tenant relationships should trigger manual review or stronger authentication.
• Recalibrate customer trust when the line changes hands repeatedly Lower trust automatically when a number has been ported multiple times in a short period, since repeated change of ownership is a strong fraud indicator.

Key takeaways

• Mobile trust decisions need to account for carrier changes, device churn, and live routing state, not just a number's static history.
• The strongest risk evidence in this topic comes from combinations of porting, SIM swap, call forwarding, and broader fraud relationships.
• Practitioners should raise friction before recovery or step-up decisions when a phone number shows signs of recent change or suspicious reuse.

Related NHI Mgmt Group resources: Account Takeover Prevention Guide · Customer IAM (CIAM) Guide · CIAM Buyer's Guide · Twilio 0ktapus breach 2022

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
• Call Forwarding: Call forwarding redirects incoming calls from one number to another destination. For identity security, it matters because voice-based OTPs and verification calls can be intercepted if forwarding has been enabled without the user's knowledge.
• Composite Risk Score: A Composite Risk Score is a single value that combines several security and identity signals into one measure of exposure or trust. In identity security, it typically blends factors such as privilege level, authentication strength, anomaly detection, asset criticality, and control gaps to support prioritization, triage, and risk-based access decisions.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.