FCC robocall rule could make phone accounts a richer target for crypto attackers

The FCC’s proposed robocall rule, published May 26 under CG Docket Nos. 17-59 and 02-278, asks whether originating voice service providers should collect and retain customer names, physical addresses, government-issued identification numbers, alternate telephone numbers, and supporting verification records before granting service.

The agency proposes a four-year retention window once the customer relationship ends, a $2,500 per-call base forfeiture for KYC violations, and comments close on June 25.

The FCC frames the proposal around the problem that illegal robocalls cost Americans billions of dollars in fraud and wasted time, and the agency argues that originating providers are best positioned to stop illegal calls before they enter the network.

For crypto holders, the proposal raises a second-order security consequence the agency’s robocall framework leaves unaddressed.

Phone numbers already sit at the center of exchange onboarding, email and crypto account recovery, SMS two-factor authentication, fintech apps, and customer-support verification.

The more identity data telecom carriers bundle with phone accounts, the more valuable those accounts become to attackers, and the more damaging a carrier breach or successful impersonation attempt becomes for anyone holding assets that move instantly and irreversibly.

The phone number as a security liability

The DOJ’s September 2025 civil forfeiture action against over $5 million in Bitcoin illustrates how the phone layer already converts into crypto loss.

Prosecutors described SIM-swap attacks as an account takeover method in which attackers gain control of a victim’s phone number, intercept authentication codes, and use them to authenticate as the victim across email, exchange, and fintech accounts.

Five US victims lost Bitcoin through that sequence. The FBI’s IC3 recorded 1,611 SIM-swap complaints in 2021 alone, with adjusted losses exceeding $68 million, up from 320 complaints and roughly $12 million in losses across the preceding three years combined.

The FCC proposal would raise the value of the phone account at its center.

The SEC’s own X account demonstrated that phone-number compromise can reach beyond individual wallets.

In January 2024, an unauthorized party gained control of the phone number associated with the SEC’s X account in an apparent SIM swap, reset the account password, and posted a false announcement claiming approval of a spot Bitcoin ETF before the SEC corrected it.

Expanded carrier-side KYC records create richer impersonation material for anyone attempting the same attack against higher-value targets.

What the FCC is building

Carriers would collect names, physical addresses, government-issued ID numbers, alternate phone numbers, and potentially copies of government-issued identification.

For high-volume customers, the FCC also asks about the intended use of service and IP addresses. That data bundle would remain in the carrier’s systems for 4 years after a customer’s cancellation date.

The FCC itself asks in the proposal what privacy risks may arise from expanded personally identifiable information collection and whether existing industry protections would suffice, or whether the agency would need to mandate heightened security measures, an acknowledgment that the collected data creates its own exposure.

A carrier record that links a phone number to a physical address, a government ID number, an alternate contact, and a service history becomes a target for attackers who want to social-engineer a carrier’s support desk, file a fraudulent port request, or cross-reference telecom data against exchange KYC records.