A SIM swap scam is a fraud where an attacker tricks a mobile carrier into moving a victim’s phone number to a new SIM card. This lets the attacker receive calls, texts, and one-time passcodes, often to reset passwords, bypass MFA, and take over financial or identity accounts.
What SIM swap scams are and why they work
sim swap scams abuse the trust built into mobile number ownership. If an attacker convinces a carrier to move a number to a new SIM, they can intercept calls and texts that many services still use for login, password resets, and account recovery.
The scam works because the phone number often functions as a recovery channel, not just a way to place calls. Once the attacker controls that channel, they can receive one-time passcodes, intercept password reset links, and impersonate the victim in other systems that still treat the number as proof of possession.
That is why sim swap fraud is rarely just a telecom problem. It sits at the intersection of fraud, identity recovery, and authentication design, especially where SMS-based MFA remains in use.
How SIM swap attacks succeed
Most SIM swaps do not rely on technical exploitation of the mobile network itself. They usually depend on social engineering, weak carrier verification, insider abuse, stolen personal data, or support processes that can be persuaded to override normal checks.
Attackers often gather enough personal information to answer carrier authentication questions or to pressure help desks into approving a transfer. In some cases, they combine SIM swap fraud with phishing, vishing, or account recovery abuse so the carrier, email provider, and financial platform are all targeted in sequence.
For that reason, SIM swap is best understood as an access path that converts a telecommunications fraud into broader account compromise. NHIMG’s SIM Swap Fraud Guide covers the carrier controls and detection patterns that reduce that abuse.
Business and identity impact
The main harm from a successful SIM swap is not the phone number itself, but the downstream control it gives over accounts that still trust SMS-based verification. That can include email, banking, crypto, social media, and any service that uses text messages for recovery or step-up authentication.
Once those accounts are taken over, the attacker may reset passwords, add new recovery methods, drain funds, or lock the victim out of their own digital identity. In organisations, the same pattern can expose employee mailboxes, internal tools, and privileged accounts when staff numbers are used for recovery or emergency verification.
Because the damage often spreads from one intercepted code to many connected accounts, SIM swap scams are a classic account takeover multiplier. They also create a post-compromise cleanup problem, since attackers may have already changed recovery details before the victim notices the number has been moved.
How to reduce exposure to SIM swap scams
The strongest reduction comes from removing SMS as a high-trust recovery factor wherever possible. Phishing-resistant MFA, passkeys, and secure account recovery reduce the chance that a stolen phone number becomes a universal reset key. NHIMG’s Passwordless and Passkeys Guide and MFA Guide explain why SMS is a weaker option than phishing-resistant methods.
Where SMS still exists, carriers and enterprises should treat number changes, porting events, and recovery requests as high-risk actions that deserve stronger verification and monitoring. Users should also secure email accounts, because email often becomes the fallback path for reset workflows after a number is swapped.
For individuals who are frequently targeted, extra controls such as carrier PINs, port-out protection, and device-level security hardening materially lower the odds of a successful swap. NHIMG’s Executive and VIP Device Protection Guide is useful where mobile compromise would have outsized personal or business impact.
Risk and Threat Considerations
SIM swap scams are dangerous because they turn a weak recovery channel into a direct path to account takeover. The threat is especially severe when organisations still rely on SMS for authentication or when support teams can override carrier and account safeguards under social pressure.
Failure mechanism: An attacker persuades a carrier or support workflow to reassign a number, then uses intercepted texts and calls to reset passwords, bypass MFA, and seize linked accounts.
Impact: Victims can lose access to email, banking, crypto, and enterprise systems, while the attacker may also alter recovery settings and create longer-lasting compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | SIM swap fraud exploits weak SMS-based authenticators and recovery paths. |
| Recommendation — Limit SMS reliance and manage authenticators so number changes do not enable account takeover. | ||
| NIST SP 800-63 | 3B — Authentication and Lifecycle Management | Phone-number-based recovery and phishing-resistant authentication are central to SIM swap risk. |
| Recommendation — Prefer phishing-resistant authenticators and tighten recovery so a swapped number cannot reset access. | ||
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SIM swap undermines authentication flows that trust a phone number as a factor. |
| Recommendation — Eliminate SMS as a strong authenticator where number hijacking could bypass access controls. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | Account recovery and login flows can fail when SMS possession is treated as sufficient proof. |
| Recommendation — Harden authentication and recovery flows so intercepted SMS codes cannot authenticate an attacker. | ||
| CIS Controls v8 | 5 — Account Management | Account recovery and lifecycle controls are directly affected when number ownership is abused. |
| Recommendation — Restrict recovery paths and review account lifecycles so a SIM swap cannot silently transfer access. | ||
Practitioner Guidance
Why practitioners should care: SIM swap is a control failure, not just a fraud event. If your authentication or recovery design still treats a phone number as strong proof of identity, one telecom abuse can cascade into multiple account compromises.
What to watch for: Unexpected loss of cellular service, failed login attempts followed by successful resets, new recovery methods being added, and account alerts that appear shortly after a number port or SIM change are all warning signs worth escalating quickly.
Practitioner takeaway: Reduce reliance on SMS for both sign-in and recovery, and treat number changes as a high-risk event that should trigger stronger verification and monitoring.