eSIM activation on a new device
How do we activate an eSIM on a new device after the customer is authenticated, so the profile is provisioned and written to the line without a SIM swap risk?
Treat an eSIM activation as a SIM change with the FCC's protections built in. When a customer wants to activate an eSIM on a new device, Callvu authenticates them with the secure method the SIM swap rules require (never a readily available biographical fact), confirms the device by its identifier and its eSIM eligibility, checks the line for a recent SIM change, port-out request or account change that the rules treat as a risk signal, chases the customer for the step-up verification where a signal exists, sends the required notification to the account holder before the change, provisions the profile to the device through the carrier's eSIM platform with the activation code or the push, confirms the profile is active on the network, and writes the new eSIM and the activation to the line in the BSS, the system of record. Live at AT&T.
Live at AT&TSimpleCallvu moves: chase and verify, write back
Last updated November 7, 2026.
The problem today
The eSIM was activated for a caller who knew the account holder's address and birthday, and the account holder's bank codes went to the new phone.
An eSIM activation is a SIM swap by another name: the line's identity moves to a new device. Fraudsters know it, and the losses are in the account holder's bank and email, not the carrier's bill. The agent authenticated with a question the fraudster had answered from a breach; the old device went dark; the one-time codes arrived on the new one. The FCC wrote rules because this happened at scale.
The FCC's SIM swap and port-out rules require secure authentication before a SIM change, a notification to the account holder before the change takes effect, the option for the customer to lock their account against SIM changes, and records of the attempts; the CPNI rules govern the authentication methods. The activation itself is a provisioning step on the eSIM platform. The protections are checks the process runs before the step.
The activation that takes a minute should take a minute, and the one that is a fraud should not happen.
How it runs
From the requestto the system of record.
A customer requests an eSIM activation on a new device in the app, on the web, in a store or on a call. Callvu opens the activation on the line.
- Customer
- Authenticates with the secure method, confirms the device, completes the step-up verification where required, and installs the profile.
- Account holder
- Receives the pre-change notification and can stop a change they did not request.
- Fraud desk
- Decides activations with risk signals in the Decision Desk.
- Callvu
- Authenticates, checks the device and the signals, chases step-up, notifies, provisions and writes.
Authenticate and confirm the device
The customer is authenticated with a secure method the SIM swap rules permit (a one-time passcode to a verified channel other than the line being changed, the account PIN established at opening, an authenticated app session, or a government ID check in the store), never with readily available biographical information; the new device's identifier is captured and its eSIM eligibility and the carrier's device policy are confirmed.
Chase and verify against the risk signals
The line and the account are checked for the signals the rules and the fraud program treat as risk: a SIM change, a port-out PIN request, an account PIN reset, a contact change or an authorized user change within the recent window, an account lock set by the customer, or a device on a watch list; where a signal exists the customer is chased for step-up verification (a second channel, an identity document on a secure screen), and a line locked by the customer is not changed until they unlock it through their own authenticated channel.
Notify and decide
The account holder is notified of the pending eSIM change by the method the rules require before it takes effect, with a way to stop it; a change that passes the checks proceeds by rule after the notification period the policy sets; a change with an unresolved signal, a failed step-up or a stop request goes to the fraud desk in the Decision Desk with the record and only the allowed outcomes: proceed, require in-store verification, or refuse with the reason.
Provision and write back
The profile is provisioned through the eSIM platform (an activation code or a push to the device), the installation and the network attach are confirmed, the previous SIM or profile is deactivated per the policy, and the new eSIM, the device identifier, the authentication method, the notification and the activation are written to the line in the BSS, the system of record, with the customer told the activation is complete.
Where it ends: The eSIM moved to the new device only after secure authentication, the risk signals were checked and the account holder was told before the change, and the BSS holds the activation with the evidence the rules require. The Decision Trace shows the authentication method, the signals and any decision; the Audit Trace shows the attempt, the notification, the provisioning and the write with time.
Runtime enforcement
What is enforcedwhile the work runs.
The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.
The handoff
Between the front doorand the back office.
The front door
The app, the web, the store or a call; authentication and step-up on the customer's own verified channel.
The back office
The fraud desk sees only activations with unresolved signals; the eSIM platform and the BSS run from the checks.
The Decision Desk
- An activation with an unresolved risk signal, a failed step-up or a stop request from the account holder goes to the fraud desk in the Decision Desk with the record and only proceed, require in-store verification, or refuse with the reason.
Proof
Live at AT&T.Published results only.
Each result is a published claim, with its code on agents.callvu.com, where its status, source and last verified date are kept.
AT&T runs close to 100 processes on Callvu, including transfers of billing responsibility, port-outs, line separations, SIM changes, activations, payment arrangements, billing, prepaid and top-ups, collections, account takeover reports, authorized user changes, device financing agreements and business account onboarding.
TEL-02 · Self-asserted · verified 2026-11-05
At AT&T Business, Callvu worked inside the existing contact center platform with no changes to internal processes.
ATT-03 · Customer-attested · verified 2026-11-02
Every run produces a Decision Trace (why each AI action was allowed) and every workflow execution an Audit Trace (the chronological governance record).
ENF-03 · Self-asserted · verified 2026-11-02
Questions
What buyers ask next,answered plainly.
How is the customer authenticated?
With a secure method the SIM swap rules permit: a one-time passcode to a verified channel other than the line, the account PIN, an authenticated app session, or an ID check in the store; never with biographical questions.
Is the account holder told?
Yes, before the change takes effect, by the method the rules require, with a way to stop a change they did not request.
What stops an activation?
An account lock the customer set, an unresolved risk signal such as a recent PIN reset or port-out request, a failed step-up, or a stop request; the fraud desk decides those cases.
Related processes
Bring this process, or the one that costs you most.
We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.