SIM-swap fraud defense

Scenario. A SIM-change, port-out, or account-takeover request is ingested and scored on behavioral, device, network, and identity signals. Routine, in-policy changes auto-clear in seconds (with the FCC-mandated customer notification fired automatically); a genuinely risky or anomalous request is held with a written risk verdict, and a certified fraud-defense analyst must sign the irreversible number-release / port-out before it executes.

Vertical: sim-swap-fraud-defense · Parks at gate step-id: signoff (gate:number-release-signoff).

1. Register and set your token

TOKEN=$(curl -s -X POST "$API/auth/register" \
  -H "Content-Type: application/json" \
  -d '{"email":"you@acme.com","password":"<your-password>","company_name":"Acme Telecom"}' \
  | jq -r .token)

2. Start the run

RUN=$(curl -s -X POST "$API/process-runs" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "vertical": "sim-swap-fraud-defense",
    "inputs": {
      "request_type": "port_out",
      "msisdn": "+15551234567",
      "gaining_carrier": "example-mobile",
      "risk": "high",
      "risk_signals": { "port_velocity": "high", "geo_anomaly": true }
    }
  }')
RUN_ID=$(echo "$RUN" | jq -r .id)

The run pulls subscriber/line/device context, scores the attempt, checks for a customer-set account-lock / port-freeze, and — for a flagged request — stages the case, forces enhanced verification, freezes the line, and parks at the analyst gate. risk is the routing input the resolver matches against the branch labels: "high" takes the elevated-risk path to the gate; a clean, in-policy request would instead auto-clear and never park.

3. Read where it parked

curl -s "$API/process-runs/$RUN_ID" -H "Authorization: Bearer $TOKEN"

status is awaiting_human and parked_at is gate:number-release-signoff; the trace shows the run parked at the signoff step. Use that step-id to resume.

4. Resume — the fraud analyst signs

curl -s -X POST "$API/process-runs/$RUN_ID/resume" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "gate": "signoff",
    "decision": "approved"
  }'

The analyst confirms identity on the flagged account and signs (or denies) the number release with the authentication trail. An approved verdict proceeds to execute; a denial leaves the irreversible release unauthorized and the line held.

5. Outcome — terminates cleanly

After the signed release, the run executes the approved SIM swap / port-out, then moves to a final monitor step (post-change abuse watch, FCC audit-trail logging) and terminates — this flow does not loop back to a gate.