How to Detect SIM Swaps in Rust With Twilio's Lookup API

Summary

SIM swap attacks let attackers take over a phone number by convincing the carrier to link it to a new SIM, enabling them to receive all calls and SMS, including OTP codes for two-factor authentication. Twilio’s Lookup API provides real-time SIM swap data from mobile network operators, indicating if the SIM linked to a number has recently changed. This tutorial shows how to integrate SIM swap detection into Rust using the rustlio crate, with dependencies dotenvy, serde, serde_json, and tokio. The code loads environment variables from a .env file for Twilio Account SID and Auth Token, calls lookup_phone_data with DataPackage::SimSwap, and prints the last_sim_swap date (e.g., 2020-04-27T10:18:50Z), swapped_period (e.g., PT48H), and swapped_in_period boolean. The post notes legitimate SIM swaps happen for reasons like lost phones or porting numbers, so the data should always be used as part of a larger, more holistic determination rather than alone.

Takeaways

1. 1

   SIM swap attacks allow attackers to receive OTP codes sent via SMS by taking over the victim’s phone number through the carrier.

2. 2

   Twilio’s Lookup API provides real-time SIM swap data directly from mobile network operators, indicating if the SIM has recently changed.

3. 3

   SIM swap data should be used as part of a larger risk assessment because legitimate swaps occur for reasons like lost phones, porting numbers, or new phones.

FAQ