SIM swap scam protection via passive monitoring

1. A method comprising steps of:

receiving wireless network data based on passive monitoring of a wireless network, wherein the passive monitoring includes capturing data packets from the wireless network at specific points;

identifying a subscriber identity module (SIM) card change in user equipment (UE) based on changes in identifiers in the captured data packets, wherein the SIM card change is identified based on i) international mobile subscriber identity (IMSI) or subscription permanent identifier (SUPI) and ii) Mobile Subscriber Integrated Services Digital Network (ISDN) Number (MSISDN) changes detected in the wireless network data, wherein the i) IMSI or SUPI and ii) in the MSISDN are stored as a pair in a database, and wherein the SIM card change is identified based on comparing extracted IMSI or SUPI and MSISDN contents to IMSI or SUPI and MSISDN pairs in the database;

identifying a commercial user communication with the UE after the SIM card change, wherein the commercial user communication is determined to be commercial based on any of i) a short message service, SMS, communication including any of a short code number and an alphanumeric sender identifier and ii) detection of an identifier of the commercial user in packet data to the UE, in the captured data packets, wherein the specific points are located separate from the UE and the commercial user such that the UE and the commercial user are unaware of the passive monitoring; and

detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and the length of a time period between the SIM card change and the commercial user communication.

2. The method of claim 1 , wherein the steps further include

providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

3. The method of claim 2 , wherein the alert includes international mobile subscriber identity (IMSI) contents.

4. The method of claim 2 , wherein the alert is to the commercial user for remediation of an affected account associated with a user of the UE.

5. The method of claim 1 , wherein stored pairs in the database are deleted after a predetermined storage duration and deleted thereafter based on a time of last activity.

6. The method of claim 1 , wherein the time period is adjusted based on feedback including false positives and false negatives.

7. The method of claim 1 , wherein the wireless network data includes historical data to avoid false alarms.

8. A non-transitory computer-readable medium including instructions executable by one or more processors that, in response to such execution, cause the one or more processors to perform steps of:

receiving wireless network data based on passive monitoring of a wireless network, wherein the passive monitoring includes capturing data packets from the wireless network at specific points;

identifying a subscriber identity module (SIM) card change in user equipment (UE) based on changes in identifiers in the captured data packets, wherein the SIM card change is identified based on i) international mobile subscriber identity (IMSI) or subscription permanent identifier (SUPI) and ii) Mobile Subscriber Integrated Services Digital Network (ISDN) Number (MSISDN) changes detected in the wireless network data, wherein the i) IMSI or SUPI and ii) in the MSISDN are stored as a pair in a database, and wherein the SIM card change is identified based on comparing extracted IMSI or SUPI and MSISDN contents to IMSI or SUPI and MSISDN pairs in the database;

identifying a commercial user communication with the UE after the SIM card change, wherein the commercial user communication is determined to be commercial based on any of i) a short message service, SMS, communication including any of a short code number and an alphanumeric sender identifier and ii) detection of an identifier of the commercial user in packet data to the UE, in the captured data packets, wherein the specific points are located separate from the UE and the commercial user such that the UE and the commercial user are unaware of the passive monitoring; and

detecting potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and the length of a time period between the SIM card change and the commercial user communication.

9. The method of claim 1 , wherein the method is performed by a network operator of the wireless network.

10. The method of claim 1 , wherein the steps further include

responsive to the detecting potentially fraudulent activity for the UE, blocking any subsequent messages to the UE via the wireless network.

11. The method of claim 1 , wherein the steps further include:

responsive to a new IMSI/SUPI and MSISDN pair being published to the database, presuming the SIM card change to be legitimate.

12. A processing device comprising:

one or more processors; and

memory storing instructions that, when executed, cause the one or more processors to

receive wireless network data based on passive monitoring of a wireless network, wherein the passive monitoring includes capturing data packets from the wireless network at specific points,

identify a subscriber identity module (SIM) card change in user equipment (UE) based on changes in identifiers in the captured data packets, wherein the SIM card change is identified based on i) international mobile subscriber identity (IMSI) or subscription permanent identifier (SUPI) and ii) Mobile Subscriber Integrated Services Digital Network (ISDN) Number (MSISDN) changes detected in the wireless network data, wherein the i) IMSI or SUPI and ii) in the MSISDN are stored as a pair in a database, and wherein the SIM card change is identified based on comparing extracted IMSI or SUPI and MSISDN contents to IMSI or SUPI and MSISDN pairs in the database;

identify a commercial user communication with the UE after the SIM card change, wherein the commercial user communication is identified to be commercial based on any of i) a short message service, SMS, communication including any of a short code number and an alphanumeric sender identifier and ii) detection of an identifier of the commercial user in packet data to the UE, in the captured data packets, wherein the specific points are located separate from the UE and the commercial user such that the UE and the commercial user are unaware of the passive monitoring, and

detect potentially fraudulent activity for the UE based on a combination of the SIM card change, the commercial user communication, and the length of a time period between the SIM card change and the commercial user communication.

13. The processing device of claim 12 , wherein the instructions that, when executed, cause the one or more processors to

provide an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.

14. The processing device of claim 12 , wherein the commercial user communication includes a short message service (SMS) communication.

15. The processing device of claim 12 , wherein the commercial user communication is detected based on detection of an identifier of a commercial user in packet data to the UE.

16. The processing device of claim 12 , wherein the time period is adjusted based on feedback including false positives and false negatives.

17. The non-transitory computer-readable medium of claim 8 , wherein the steps further include

responsive to the detecting potentially fraudulent activity for the UE, blocking any subsequent messages to the UE via the wireless network.

18. The non-transitory computer-readable medium of claim 8 , wherein the steps further include

providing an alert of the potentially fraudulent activity identifying the commercial user communication as a possible SIM swap scam.