SIM-swap exposure is often treated as a fraud-operations issue until an account-takeover event produces chargebacks, port-out losses, regulatory correspondence, and wholesale-credit claims. The commercial question is SIM-swap liability: which party controls the authentication step, owns the decision record, carries the immediate customer-remediation cost, and absorbs losses that emerge after settlement. MVNO–MNO agreements need an operating model that is evidentially complete, not merely a generic fraud clause.
Control of the subscriber record should determine first-line accountability
Primary accountability should follow the party with authority to execute or technically approve the credential change. Brand ownership is an unreliable proxy. An MVNO may receive the customer request and conduct an initial identity check, while the host controls the change to the IMSI, authentication material or eSIM profile. Where an MVNE sits between the parties, operational authority may be split again across workflow orchestration, subscriber data and network execution.
The operating schedule should allocate four responsibilities separately: request capture, identity verification, execution approval and post-event monitoring. Combining them under a broad statement that the retail party owns fraud risk obscures where a failed control occurred. It also leaves the host exposed when its own override path, privileged account or execution interface becomes the decisive point of compromise.
Evidence must span the complete transaction chain. Records from BSS/OSS, CRM, HLR or AuC, and the eSIM RSP workflow should carry a common transaction ID. Both parties need access to that identifier, the authentication result, the approving identity, execution timestamps and any manual intervention. A customer-care note without the corresponding network-side status is not sufficient evidence of authorised execution.
The contract should also state when the host may reject, delay or require step-up authentication for a tenant-initiated request without breaching customer-service commitments. Those rights should be tied to defined risk indicators rather than unrestricted discretion. The schedule must distinguish physical SIM replacement, eSIM download, device change, MNP-related credential reset and account-profile amendment. Each event presents a different combination of channel risk, system authority and potential downstream loss.
A Tier-2 MNO, Western Europe, ~18M subscribers found that its tenant agreement assigned fraud liability to the MVNO because the tenant owned the retail relationship. The host nevertheless retained exclusive authority over the network-side replacement workflow. During a disputed case, customer-care records showed that the request had been accepted, but neither party could produce a linked approval record for the execution step. The resulting chargeback and compensation dispute remained outside the normal settlement cycle for two months. A revised responsibility matrix assigned first-line accountability according to system authority, with separate recourse where defective identity evidence originated in the tenant channel.
Detection and escalation need a shared clock, not parallel fraud queues
Losses expand when the MVNO, MVNE and host detect parts of the same sequence but operate separate queues. A swap followed by a password reset, payee amendment, DCB activation, international voice use or an abrupt change in A2P receipt patterns should trigger a shared severity model. The relevant question is not which platform produced the first alert. It is whether the combined indicators justify immediate containment before further value leaves the account.
Delegated authority must be explicit. The agreement should identify which party may apply an outbound restriction, suspend DCB, block a port-out or freeze further credential changes. It should also state whether an MVNO instruction is self-executing, requires host approval or may be refused on network-integrity grounds. Without that allocation, operations teams lose time seeking commercial consent while the incident remains active.
Severity bands should set separate targets for acknowledgement, containment, evidence preservation and customer contact. A 24-hour investigation target may be acceptable for retrospective review, but it is not a credible containment standard for active account takeover. The containment SLA should start when a verified alert reaches the contracted incident channel, not when the receiving party creates an internal ticket. High-severity events may require restriction within minutes, followed by staged review and restoration controls.
Reciprocal evidence access should cover the timestamp, originating channel, authentication factors, agent or API identity, affected MSISDN and IMSI, and network-side execution status. Data minimisation does not justify withholding the fields needed to determine control failure. Retention periods must also match the timetable for customer complaints, regulatory correspondence and settlement challenge, which may extend well beyond the operational incident window.
The escalation route should name the MVNO fraud lead, MVNE service desk, MNO wholesale operations function and security response team, with tested out-of-hours coverage. Monthly incident reviews should then examine the portfolio rather than isolated cases. Clustering by acquisition channel, retailer, identity method, eSIM flow or operational team can reveal a repeatable weakness that individual ticket closure would conceal.
Settlement terms should price residual risk rather than hide it in service credits
A workable liability model separates fraud loss, remediation expense and commercial attrition. Direct loss should be defined through recoverable categories: unauthorised usage, DCB transactions, replacement-SIM costs, reversal fees, customer compensation, investigation expense and externally imposed penalties. Collapsing these items into a single fraud figure creates disputes over causation, timing and whether internal operating cost is recoverable.
Liability should depend on a stated causal test. Typical triggers include failure of an agreed control, failure to meet an escalation SLA, execution outside the approved workflow or deficient record retention. This avoids strict liability for every event while preserving accountability where one party controlled the failed step. Where failures are concurrent, the agreement should permit proportionate allocation based on the evidence rather than forcing an all-or-nothing outcome.
The settlement mechanism matters as much as the liability language. Disputed cases should receive a provisional allocation each month, followed by an evidence-review window and a true-up in the next wholesale cycle. That approach keeps fraud claims visible without withholding an entire wholesale invoice. Finance teams can reserve against attributable exposure, while operations teams retain a defined period to complete the factual record.
- Provisional loss allocation
- Monthly, based on the party controlling the failed authentication or execution step; subject to evidence-based true-up.
- Evidence-review window
- 10–20 business days after the monthly incident file is issued, with a defined escalation route for unresolved cases.
- Containment SLA
- Measured from verified alert receipt to network restriction or credential suspension, with separate targets by severity.
- Routine liability cap
- Set against attributable direct loss or a defined share of monthly wholesale charges; exclude intentional or repeated material control failures.
- Churn and goodwill treatment
- Tracked as a commercial KPI and reviewed quarterly; recoverability should be expressly negotiated rather than assumed.
Routine exposure may be capped against attributable direct loss or a defined share of monthly wholesale charges. Broad caps should not protect deliberate misconduct, gross negligence, repeated control failure after notice or failure to preserve audit evidence. These exclusions are commercially important because missing records can prevent the counterparty from proving its case. A party should not benefit from an evidential gap caused by its own retention failure.
Churn requires separate treatment. It may be difficult to recover contractually, but it remains a real cost in the retail and wholesale model. Account-takeover remediation can depress lifetime value, increase contact-centre demand, weaken gross-add quality and create port-out risk among customers untouched by the original loss. The parties should track these effects as a commercial KPI and negotiate recoverability expressly rather than assuming that customer compensation captures the full impact.
Generic service credits are an inadequate sole remedy. They are usually calculated against recurring service charges, not the value or timing of the fraud loss. They can also create accounting friction when a tenant offsets credits against unrelated traffic, platform or access invoices. A distinct claims ledger, reconciled with the wholesale settlement file, gives both parties a clearer view of recurring exposure and disputed balances.
The agreement should convert accountability into an auditable operating schedule
The master wholesale agreement, fraud schedule, data-sharing terms and service-management process must use consistent definitions. A control described as mandatory in the fraud schedule should not become optional under an operational procedure. The attached control schedule should specify approved authentication methods, step-up conditions, delegated authorities, prohibited override paths and change-management obligations. It should also identify the system of record for each decision.
Downstream scope is critical. The schedule should bind subcontractors, retail agents, eSIM distributors and customer-care outsourcers. A weak retail or outsourced-care channel can invalidate an otherwise sound host control model, particularly where agents may replace credentials through privileged workflows. The contracting party should remain accountable for downstream compliance and provide audit evidence without requiring the host to pursue each subcontractor separately.
Control testing should include sample-based review of swap records, privileged-access checks, incident-tabletop exercises and reconciliation of HLR or AuC changes against customer requests. Testing frequency should reflect transaction volume and channel risk. A material increase in digital onboarding or eSIM replacement activity may justify quarterly sampling even where the wider control programme operates annually.
An MVNE servicing 12+ tenants in EMEA introduced a common incident file after finding that tenants submitted materially different evidence for comparable events. The revised process linked customer request, identity result, platform approval and host execution under one reference. It also separated containment performance from final liability. The MVNE could therefore apply restrictions without prejudging the settlement outcome, while tenants received a consistent evidence package for review.
Material incidents, repeat SLA breaches and inadequate evidence quality should escalate to the quarterly wholesale steering committee. That forum can direct remediation, approve control investment and determine whether commercial thresholds remain appropriate. Renewal and revenue-share discussions should revisit those thresholds as channel mix, eSIM adoption, DCB exposure and the proportion of high-value customers change. Static caps and response targets become mispriced when the underlying risk portfolio shifts.
A partnership review should test whether operational authority remains consistent with the host’s network controls and the MVNO’s customer-service model. The review should examine who can initiate, approve, execute, restrict and restore each credential-change event, then reconcile those authorities with evidence access and settlement treatment. Any gap between technical control and contractual accountability is a future wholesale dispute.
SIM-swap controls should be negotiated as a loss-allocation and evidence-governance framework, not appended as a generic security obligation. As eSIM adoption and digital onboarding increase the frequency of credential-change events, MNOs and MVNEs that can reconcile authority, records and settlement treatment will face fewer disputed wholesale balances and less avoidable churn.