SLC Digital Launches SIM-ple Platform to Deliver Fraud Protection
By Roy Urrico
SLC Digital recently launched a new platform, SLC Guardian, a new approach for preventing AI-powered identity fraud, account takeover, digital impersonation and other high-risk digital fraud through cryptographic, hardware-rooted transaction assurance. SLC introduced and demoed the technology at FinovateFall in September 2026.
Organizations, including credit unions and banks, are facing a new generation of AI-powered fraud that can bypass passwords, SMS codes, and traditional authentication workflows, according to New York City-based SLC Digital, an identity authentication company that uses the mobile device to protect accounts and high-risk digital transactions.
Rather than relying on passwords, SMS codes or approval prompts, SLC Guardian uses the SIM/eSIM already embedded in mobile devices to provide cryptographic proof that a trusted device is present and participating. Thereby a high-risk action — such as a large transfer, account change or sensitive login — can proceed confidently.
SLC Guardian, according to SLC:
Moves beyond identity verification to transaction-level authorization. It provides authorization for a specific high-risk action, rather than relying solely on signals that an action appears legitimate.
Is hardware-rooted and built for global scale. Cryptographic keys secured within the SIM Secure Element allow connectivity across 600-plus mobile networks in more than 180 countries.
Safely permits high-risk financial workflows. Credit unions can use this to strengthen transaction authorization and account security without requiring USB keys, smart cards or additional hardware.
“Financial institutions are entering a new era where verifying identity is only part of the equation," said SLC Digital CEO and Co-Founder Travis McGregor.
"The challenge organizations face today isn't simply knowing who a user is. It's proving that every high-risk transaction or action was intentionally authorized by the legitimate person on a trusted device," McGregor added. "SLC Guardian provides that cryptographic proof, creating a foundation for digital trust in an era where AI can convincingly impersonate almost anyone."
Getting to the Core of the Authentication Problem
“The core idea of SLC is everyone is essentially walking around with a hardware device, a hardware security module, like a YubiKey or a hardware token, that's already built into their phones,” explained Head of Product Numan Maloney in a post-FinovateFall conversation. “We're talking about billions of people with devices with a HSM (hardware security module) quality of security already in their pocket…what that is, is your SIM card, already at a standard of security as a secure execution environment, that can be extremely difficult to spoof for attackers.”
There are two things that are very important for identity security, maintained Maloney. The first is where account holders store their private key, their token that identifies them. “If you store that private key in the cloud, it is vulnerable to all sorts of attacks. If you store that private key in the mobile app or something like that, it's subject to all sorts of attacks that sit above the operating system layer.”
The second most important thing is how you communicate with that key, Maloney continued. How does that key communicate with the individual to verify their credential to prove they are the approved person trying to perform a transaction.
“Where it's stored and how you talk to it are the two most fundamental problems when it comes to identity security,” he said. “And right now, the current solutions that are on the market simply do not solve those problems adequately, otherwise we wouldn't have one of the biggest fraud problems we've ever seen, especially in the age of AI, right?”
SIMs to the Rescue
“We're seeing that phishing, social engineering, SIM swapping, man in the middle attacks, SS7 attacks (Signaling System 7 raids could intercept items such as mobile calls, text messages, user locations), the list goes on, but ultimately they end in one thing, which is account takeover fraud,” warned Maloney. “Someone is able to either steal your keys or convince you to cough them up, and pretend to be you.”
SLC deploys the API-based SLC Guardian through an applet onto a mobile device’s SIM card, explained Maloney. “That applet generates a private key that could only belong to you and can never leave your SIM card.” This, he added, allows SLC to communicate directly with the applet on the SIM card to verify it is the trusted device registered by the user and its “on a trusted network with a trusted connection connected to a cell tower, with the appropriate signals?”
SLC provides device and network trust, and proof of human contact within that API call. “And all of that data is signed by that key that lives on the SIM. And the word we use for this is deterministic, it's proof,” said Maloney. “We could say exactly at this time it was signed by this key that could only be proven on this device. And now we know that he is the right person on the right device. He can go ahead and do that action.”
SLC has manual authentication in which the SIM card itself triggers a step up. “What SLC does is we actually trigger the SIM card itself to override the operating system and provide you with a push notification, is this you trying to do this transaction? Yes, it's me. Maybe enter a pin, triggered by the SIM.”
Maloney further explained, “We capture all of that telemetry and sign it and return it. That's our manual step up. The last feature that we provide a secure communication channel between a (FI), for example, or an enterprise and an end customer directly to that SIM that's cryptographically signed.”
Two Solutions
SLC offers two different types of solutions, explained Maloney. “We have a secondary eSIM solution, which is we give an entire secondary eSIM profile to someone with their applet on it. We load it onto their device, and no matter where you go in the world, it'll automatically connect to the nearest network and you could authenticate yourself,” said Maloney. “Then we also have a primary solution where our applet is already pushed onto your primary phone number. right now, we actually have access to 120 million devices with AT&T where we could perform our APIs and then silently and manually authenticate the SIM.”
For example, a banking customer working with a financial institution typically goes through the Know Your Customer (KYC) process, noted Maloney, “We verify it's you. We push this applet to your phone, and now we're binding your human identity to your hardware identity. And now going forward, whenever you need to do a transaction or something like that, we can actually route that authentication to your SIM.”
The onboarding experience only ever has to happen once, explained Maloney. “And it only actually has to happen for that secondary eSIM solution when you're actually pushing the eSIM profile to their device. Going forward you never have to do that onboarding again unless you get a new device. From then on, it's all frictionless for the end user.”
In the case for the primary applet, all the credit union or bank would have to use is the accountholders’ phone number. “Then that would directly talk to the applet that's already sitting on your SIM card. That onboarding, we want to make it as low friction and single time as possible. And then going forward, it's just, direct communication with the applet to authenticate you.”
SLC Guardian works on “basically every single mobile device” explained Maloney. “We built our technology for its eSIM specifically which sits on mobile devices. And in fact, a lot of non-mobile devices, like laptops increasingly have eSIMs for cellular connectivity; as well as IOT devices like body cameras and cars, also have eSIMs. So, anything with an eSIM we can deploy our technology onto and it'll operate through the telco network.”
“The beauty of what we're doing is no AI can fabricate that genuine cryptographic signature that comes from the SIM that we provide,” said Maloney.
“We are a hardware solution to a largely AI problem. We believe that you need to anchor trust in something that's real. You need to anchor trust in hardware,” acknowledged Maloney. “If you leave it open to the cloud, then you are opening yourself up to all sorts of vulnerabilities. If you lock it down within the secure core silica of a SIM, then you're making it much more secure. And we built our entire technology off that premise. People are realizing that a hardware-rooted approach is the best way to authenticate people.
SLC Digital works with global partners including GSMA, IDEMIA, Ideco Biometrics, NVIDIA, and Monogoto to deliver secure, network-native digital trust at scale.
