Telecom number porting between carrier agents

Number porting already runs on machine-to-machine interfaces. Carriers exchange port requests electronically and update the Number Portability Administration Center (NPAC) database. The slow, manual part is everything around a failed request: a reject code, a mismatched account number, a port-out lock, a business account with numbers spread across sub-accounts. An agent-to-agent version gives the gaining and losing carriers’ agents a way to validate a port before it is submitted and to settle exceptions in minutes, while the subscriber’s authorization stays with the subscriber.

How it works today

United States. The FCC’s number portability rules are in 47 CFR Part 52, Subpart C. Section 52.35 requires simple wireline-to-wireline and simple intermodal ports to complete within one business day, a rule adopted in FCC 09-41 in May 2009. For the port to activate at midnight the same day, an accurate local service request (LSR) must arrive between 8 a.m. and 1 p.m. local time. Non-simple ports, such as many business accounts, get four business days. Section 52.36 fixes the standard data fields for a simple port, following FCC 10-85.

Wireline carriers exchange LSRs using the ATIS Ordering and Billing Forum’s Local Service Ordering Guidelines (LSOG). Wireless carriers use WICIS, the ATIS wireless inter-carrier specification. FCC rules do not set the wireless interval. An industry document does: the NANC wireless requirements allow 30 minutes for the carrier-to-carrier exchange and two hours for the NPAC steps. iconectiv has been the Local Number Portability Administrator for all seven US NPAC regions since May 2018.

Canada. The CRTC set up wireless number portability in Telecom Decision CRTC 2005-72, starting 14 March 2007, with 2.5 business hours for a simple wireless-to-wireless port. The Canadian LNP Consortium, formed in 1997 at the CRTC’s direction, manages the contracts under which its wireline and wireless members use the Canadian NPAC.

Port-out fraud. A criminal who ports a victim’s number receives their one-time passcodes. In November 2023 the FCC adopted FCC 23-95, adding 47 CFR 52.37: secure authentication before a port-out, immediate notice to the customer, a free port-out lock, notice of the protections on offer, staff training, and a free process to report fraudulent ports. The compliance date is still open. An FCC order in July 2024 (DA 24-649) tied compliance to the parts awaiting paperwork review, and as of September 2026 the eCFR shows several paragraphs as reserved. The FCC’s 2026 regulatory agenda lists the next action as undetermined.

In Canada, the CRTC has handled port-out fraud through letters under file 8665-C12-202000280. In October 2020 it asked carriers to implement the industry’s “Enhanced Process”, which carrier filings describe as two-way SMS validation, and required monthly reporting. A January 2024 staff letter narrowed reporting to months with six or more unauthorized ports or SIM swaps. ATIS reassigned a WICIS response code in 2020 to flag suspected fraud that needs customer action.

When a port fails, the gaining carrier gets a reject code. Someone then calls the losing carrier’s port desk, or tells the customer to call the old carrier for the right account number or PIN, and resubmits.

The agent-to-agent version

Illustrative. A business is moving 40 numbers to a new carrier, a non-simple port. Before any LSR is sent:

1. The gaining carrier’s agent sends the losing carrier’s agent a pre-check: the numbers, account number, service address and the reference for the subscriber’s authorization.
2. The losing carrier’s agent validates each number against its records.
3. Two numbers sit on a different sub-account, and the account has a port-out lock. The losing carrier’s agent reports both and moves the task to TASK_STATE_AUTH_REQUIRED:

{
  "id": "task-port-7731",
  "contextId": "ctx-port-acme-40",
  "status": {
    "state": "TASK_STATE_AUTH_REQUIRED",
    "message": {
      "messageId": "msg-port-7731-3",
      "taskId": "task-port-7731",
      "contextId": "ctx-port-acme-40",
      "role": "ROLE_AGENT",
      "parts": [
        { "text": "Account 55-10293 has a port-out lock. The account holder must remove it through our own channels before we can accept a port request. Two numbers are billed on sub-account 55-10293-02." },
        {
          "data": {
            "numbersValidated": 38,
            "numbersOnOtherAccount": ["+15555550143", "+15555550144"],
            "portOutLock": true
          },
          "mediaType": "application/json"
        }
      ]
    }
  }
}

4. The subscriber lifts the lock directly with the losing carrier, which authenticates them its own way. The gaining carrier’s agent never sees those credentials.
5. The gaining carrier’s agent corrects the sub-account detail and submits the LSR or WICIS request through the normal interface. The NPAC steps are unchanged.
6. The losing carrier sends the customer the port notice it would send anyway.

What has to be true

Identity. Carriers already know each other through the NPAC and their interconnection arrangements. Each carrier’s agent endpoint must be tied to that same identity, so a port desk cannot be impersonated by an agent claiming to be a carrier. Subscriber identity is harder, and it is where the fraud lives. Knowing an account number and PIN is exactly what a fraudster has, so an agent relaying them proves little. The losing carrier’s authentication of its own customer should stay in its own channel. See when to keep a human on strong identity proofing.

Authority. The gaining carrier acts on the subscriber’s authorization to request the port. That authorization should name the numbers, the gaining carrier and a validity window, and the losing carrier should be able to check it. Lifting a port-out lock is the subscriber’s decision alone.

Record. The one-business-day and 2.5-hour intervals run from specific timestamps, and fraud investigations need to show who asked for what and when. The FCC rules include documenting fraud reports; the CRTC collects counts of unauthorized ports. Both sides need the same record of the pre-check, the rejects and the final request.

Standards involved: 47 CFR 52.35 to 52.37, ATIS LSOG and WICIS, the NPAC interface specifications, Telecom Decision CRTC 2005-72, and A2A tasks for the pre-validation exchange.

Where Emissar fits

• Resolve (in development) maps phone numbers to verified agent endpoints. Porting is its hardest case: when a number moves carriers or owners, any claim tied to the old holder has to end.
• Verify (in development) checks that an agent claiming to be a gaining carrier is who it says.
• Mandate (spec in progress) is a proposal for a scoped, revocable authorization: port these numbers to this carrier before this date.
• Ledger (spec in progress) keeps a signed record of the exchange for disputes and fraud reports.
• Handoff (in development) routes suspected fraud to a person with the full exchange attached.

Open questions

• Will carriers accept agent pre-validation beside LSOG and WICIS, or only inside their existing interfaces?
• How can a port-out lock be lifted quickly without recreating the path fraudsters use?
• The US port-out rules are adopted without a compliance date. Their final form will shape what agents must check.
• Canada’s fraud controls rest on CRTC letters and an industry process. Would the CRTC want agent-initiated ports reported separately?
• Who may request a port for a business whose numbers belong to a reseller or a parent company?