Every bill you pay on your phone is an identity decision
If you have ever logged in to a telecom app to pay a bill or check your account, you have used the kind of system we build. Here is why that sign-in screen has become one of the most attacked doors in consumer technology.
A mobile account is more than a phone plan. It receives the one-time codes that unlock bank accounts, email and government services. Take over the phone account and you inherit much of a person's digital life. That is why telecom customer identity has become a front line.
The numbers behind the sign-in screen
In the UK, fraud prevention service Cifas recorded a 1,055% rise in unauthorised SIM swaps in 2024, to nearly 3,000 cases, and found that 48% of all account takeover cases that year involved mobile phone accounts.1 The trend did not slow: Cifas reported a further 402% uplift in SIM swap cases in the first half of 2026.2
Source: FBI IC3, 2025 Internet Crime Report. Reported losses fell while UK cases surged (Cifas), a reminder that reported figures trail real activity.
In the United States, the FBI's Internet Crime Complaint Center logged 971 SIM swap complaints and USD 17.4 million in losses in 2025.3 Regulators have responded. In November 2023 the FCC adopted rules requiring carriers to use secure methods of authenticating customers before redirecting a phone number to a new device or provider.4
Social engineering goes mobile
Verizon's 2026 DBIR found that mobile-centric social engineering, by voice and text, earns a median click rate 40% higher than email.6 The customer's phone is both the target and the channel of attack.
What good looks like
Carriers that moved early on phishing-resistant sign-in are seeing results. KDDI reported more than 13 million au ID customers using FIDO authentication, with support center calls down nearly 35%. Passkeys account for about half of NTT DOCOMO's authentications.5
Security and convenience stop competing once the strongest method is also the easiest one.
For telecom providers, the pattern we apply is consistent: a single customer identity across app, web and store; step-up authentication before high-risk actions like SIM changes and number ports; risk signals from device and network; and passkeys as the default path, with recovery flows designed as carefully as the login itself.
So if you have paid a phone bill or checked your data usage from an app, there is a good chance our work was on the other side of that screen.
Related insights
Passkeys passed the tipping point. Now comes the hard part.
Billions of passkeys exist and most consumers know what they are. The remaining work sits inside enterprises still relying on phishable sign-in.
NIST SP 800-63-4 in five changes
The updated US digital identity guidelines rewrite long-held password rules and raise the bar on phishing resistance. A short guide for architects.
Machine identities outnumber people 109 to 1
Service accounts, workloads, API keys and now AI agents vastly outnumber the people in your directory. Most governance programs were built for the minority.