Analysis · Published 23 Aug 2026

A SIM Swap Attack Doesn't Pick Your Locks. It Asks the Locksmith.

Bob Boole

AI editorial persona, Abyshire News Desk · About the desk

Businesses are bolting the front door with passkeys and MFA while account recovery still runs through a phone number that one persuaded call-centre worker can reassign. The most expensive lock in the world doesn't help if the key cutter works for someone else.

Listen8 min

The most valuable credential you own is one you never chose, can't rotate, and don't control. It's your mobile number. A SIM swap attack never touches your password or your authenticator app. It works on an employee at your carrier, who is persuaded to move your number onto a SIM the attacker holds. From that moment, every service that treats "can receive a text at this number" as proof of identity believes the attacker is you, and as far as the recovery systems are concerned, that is now simply true.

Follow the mechanism and the uncomfortable part becomes obvious. Your bank, your email provider and your cloud console all assume the attacker arrives through the front door, where the passwords and MFA prompts live. But every one of those services also maintains a back door called account recovery, built for the customer who has forgotten everything. Recovery has to bypass your security by design; that is its job. And in a remarkable number of systems, the recovery path terminates at an SMS message.

So the real root of trust in your account architecture turns out to be a call-centre worker you've never met, authenticating a stranger under time pressure. This isn't a rhetorical flourish; it has been tested. Princeton researchers ran fifty fraudulent SIM-swap attempts against five US prepaid carriers and found that every one of the five relied on at least one authentication procedure an attacker could defeat, sometimes with information as trivial as recently dialled numbers. Your threat model stops at the login screen. The attacker's starts behind it.

How does a SIM swap attack actually work?

The playbook is unsophisticated, which is precisely the problem. An attacker gathers enough personal detail to impersonate you: name, address, the sort of answers that years of data breaches have already put into circulation. They contact your carrier claiming a lost or damaged phone and ask for the number to be moved to a new SIM. If the person on the other end is persuaded, your handset goes dead and the attacker's lights up.

Then comes the chain reaction. "Forgot password" on your email, with the reset code arriving by text. Once the email falls, everything anchored to that email falls with it, because email is the second master key and the phone number opens it. At no point has the attacker broken a security control. The recovery system is doing exactly what it was designed to do, just not what it was intended for.

Notice what never got a vote: your password strength, your authenticator app, your shiny new passkey. Organisations have spent years hardening authentication while leaving the recovery layer intact underneath, which means the strongest control in the stack is rarely the one an attacker actually has to beat.

The convenience trade nobody prices

There's a reason we got here, and it isn't stupidity. Centralised, biometric-backed identity won because it's what people actually buy. Self-sovereign identity, where you hold your own credentials and no company can hand them to someone else, has been technically viable for years and keeps failing at the same point: adoption. Given the choice between custody of their own identity and a face scan that just works, users choose the face scan. Convenience and hackability are the same design decision viewed from two sides.

The phone number is the purest expression of that trade. It's short, it's universal, and someone else has already verified it, which makes it irresistible as an identifier. So it quietly accreted roles nobody assigned deliberately: contact detail, then username, then second factor, then recovery anchor. Each step made sense on its own. The sum is a master key held in trust by a telecoms company whose retail staff were never meant to be the guardians of your corporate access.

What are regulators doing about SIM swap fraud?

Ask the US Securities and Exchange Commission. On 9 January 2024 its official X account announced approval of spot bitcoin ETFs a day before the real decision, and the price of bitcoin moved on a post the SEC never made. The SEC's own account of the incident confirmed that an unauthorised party had taken control of the phone number associated with the account through a SIM swap at the carrier, and that multi-factor authentication on the account had been switched off months earlier and was only restored after the breach. One of the most heavily scrutinised regulators on earth lost a market-moving communications channel to the same attack that empties retirement accounts, and the entry point was a phone number.

The rulebook is starting to catch up, at least in America. In November 2023 the FCC adopted rules on SIM swap and port-out fraud requiring US wireless carriers to securely authenticate a customer before moving a number to a new SIM or a new provider, and to notify the customer immediately whenever such a request is made. Sit with what that implies: a federal regulator had to order phone companies to check who they were talking to before handing over a number. That is how weak the default was.

The UK has no direct equivalent yet. Ofcom polices number porting as a competition matter, to make switching easy, and easy switching is exactly the property a SIM-swap attacker exploits. Until that changes, how hard your number is to steal depends on which network you're with and which protections you have explicitly asked for, which makes it your problem to manage rather than a safety net you can assume.

How do you sever the phone number as an identity anchor?

Treat this as an audit problem, because it is one. Somewhere in your organisation there is a list, currently unwritten, of every system where a phone number can reset access. Write it down. Include the accounts that matter most and get audited least: domain registrars, DNS, cloud billing, the founder's personal email that is still the recovery address for the company's admin accounts. Nobody has written this list because the work is unglamorous; forcing it into the open is half the point of a technical strategy review.

Then sever, in order of blast radius. Replace SMS second factors with app-based or hardware-backed ones, and remove the SMS fallback rather than merely adding the stronger option on top; a back door doesn't stop being a back door because you fitted a better front one. Ask your carrier what port-out protection it offers, by name. Verizon's free Number Lock setting, for instance, blocks port-outs and SIM transfers until the account owner switches it off; most networks have an equivalent, and a carrier that can't name one has just told you something useful about your risk. Move recovery for high-value accounts onto channels that don't route through a number at all.

Apply the same thinking anywhere credentials concentrate. As organisations wire AI agents into production systems, they're minting new identity anchors at speed, and the lesson of the phone number is what happens when an identifier drifts into being a credential. The discipline is the same one we describe in securing agentic systems: know what can act, know what it can reach, and know how access gets recovered when something goes wrong.

None of this is exotic work, which is exactly why it doesn't get done. Your security is only as strong as the cheapest way back into your accounts, and today that's a phone call you'll never hear.

Questions people ask

Is SMS two-factor authentication better than nothing?

Yes, against opportunistic attacks like credential stuffing it raises the bar. But it also makes your mobile carrier part of your security perimeter, and attackers always take the weakest permitted path. If SMS remains available as a fallback, treat the account as SMS-protected regardless of what stronger factors you've added, because that's how an attacker will treat it.

What should I do if my phone suddenly loses service for no reason?

Treat it as a live incident, not a network blip. From another device, contact your carrier about a possible unauthorised SIM change, then secure your primary email first: change the password and revoke active sessions before touching anything else. Email is the hub the rest of your accounts hang off, and an attacker holding your number will be working through password resets while your handset is dark, so every minute you spend on hold with the carrier before securing email is a minute spent guarding the wrong door.

Can a business remove phone numbers from account recovery entirely?

For admin and high-value accounts, largely yes: hardware security keys, offline backup codes and documented break-glass procedures can replace number-based recovery. Some consumer-grade services still insist on a number; for those, use a dedicated number that is never published or used for calls, and keep a written register of exactly which services still anchor to it.

Written by an AI editorial persona of Abyshire's proprietary editorial system and reviewed by our team.