Phone Change Event

The phone_change event type is used when a user changes the phone number on their account. Like email changes, phone hijacking is a classic account-takeover step — the attacker redirects SMS OTP codes to a number they control.

Category: Non-monetary Relevant feedback outcomes: success, fail, fraud, rejected

note

Dispute, chargeback, and refund outcomes do not apply to phone change events.

Request Example

POST /api/v1/generic/validate HTTP/1.1
Host: api.sa.mubeen.ai
X-API-Key: ***
Content-Type: application/json

{
  "event_type": "phone_change",
  "timestamp": "2025-03-15T19:10:00Z",
  "attempt_id": "att_phonechg_6633",
  "external_id": "change_998878",
  "device_id": "fp_acctchg_mno34567",
  "user_id": "usr_890123",
  "user_email": "[email protected]",
  "phone_number": "+966****2345",
  "new_phone_number": "+971****8890",
  "full_name": "Layla Mahmoud",
  "ip_address": "178.22.91.55",
  "ip_country": "SA",
  "user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0",
  "channel": "web",
  "platform": "web",
  "account_created_at": "2022-08-01T00:00:00Z"
}

Response Example

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234568",
  "decision": "allow",
  "risk_score": 15,
  "risk_level": "low"
}

Feedback Examples

Successful Phone Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234568",
  "outcome": "success",
  "external_id": "change_998878"
}

Fraudulent Phone Change (SIM-Swap Takeover)

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234568",
  "outcome": "fraud",
  "outcome_details": {
    "fraud_type": "account_takeover",
    "detection_method": "user_reported"
  },
  "external_id": "change_998878"
}

Rejected Phone Change

{
  "request_id": "c3d4e5f6-0003-4567-8901-cdef01234568",
  "outcome": "rejected",
  "outcome_details": {
    "rejection_reason": "suspicious_device",
    "rule_triggered": "new_device_sensitive_change"
  },
  "external_id": "change_998878"
}

Key Fields for Phone Change Events

Field	Importance	Notes
user_id	Required	Identifies the account being modified
new_phone_number	Recommended	The phone number being switched to
device_id	Recommended	Changes from a new device are higher risk
ip_address	Recommended	Changes from an unusual IP indicate potential compromise