The final rules spell out how phone companies must confirm who a user is before giving them a SIM card, updating details, or disconnecting the phone number