Account takeover attacks expose the limits of SMS-based identity

At a glance

What this is: This analysis breaks down how account takeover attacks move from credential stuffing to SIM swap abuse and session takeover, showing why SMS-based identity checks fail under active fraud pressure.

Why it matters: It matters because IAM, fraud, and customer-facing identity teams need controls that verify the user, the device, and the transaction, not just the login step.

Context

Account takeover is not a single event but a chain of abuse that starts before the login screen and often ends in fraud, account drainage, or further compromise. SMS-based identity checks are weak when attackers can reuse breached credentials, manipulate support channels, and redirect one-time passwords to a device they control. For IAM and fraud teams, the real issue is the gap between authentication at sign-in and trust decisions later in the session.

In practical terms, the article is about why possession of a phone number is not the same as verified identity or safe authorisation. The governance problem is especially clear in consumer banking and other high-risk digital services, where onboarding, authentication, device trust, and transaction monitoring are often run as separate controls. That separation is the attacker’s opening.

The attack pattern described here is typical, not exceptional, which is why it deserves defensive treatment as a repeatable fraud workflow rather than a one-off incident.

Key questions

Q: What breaks when SMS OTP is the main step-up control for account takeover defence?

A: SMS OTP breaks when the attacker can move the phone number, intercept the code, or socially engineer the carrier. In that case, the code confirms channel access, not user identity. High-risk actions need stronger out-of-band authentication, real-time phone risk checks, and transaction-specific step-up logic.

Q: Why does credential stuffing create such a high account takeover risk for reused credentials?

A: Credential stuffing works because attackers can reuse breached username and password pairs at scale and test them across many services. When people reuse passwords, one breach can unlock multiple accounts, especially where email addresses serve as usernames. Automated tools make this cheap, fast, and difficult to distinguish from legitimate login traffic without strong behavioral and device based controls.

Q: What are the signs that an authenticated session may already be compromised?

A: Look for abrupt device changes, new locations, first-time access to wires or profile settings, and fast movement from login to high-value actions. Those signals suggest the attacker has already passed the login gate and is operating inside a legitimate session, which is why post-authentication monitoring matters.

Q: How should organisations reduce account takeover risk without relying on SMS 2FA?

A: Move high-risk accounts to phishing-resistant factors such as security keys or authenticator apps, then harden recovery and support flows so they are not easier to abuse than login. The best programmes also reduce standing trust by reviewing enrolment, device change, and re-binding as privileged identity events.

Technical breakdown

How credential stuffing seeds account takeover

Credential stuffing is an automated abuse pattern in which attackers test large volumes of previously breached username and password pairs against live services. Botnets spread the traffic to avoid simple rate limits and IP blocking, while reconnaissance endpoints such as password reset flows help attackers validate which accounts exist. Once they know which combinations work, they can package the results, enrich them with account data, and hand off the highest-value targets to more capable fraud actors. The important technical point is that authentication success is not evidence of trust when credentials are recycled from unrelated breaches.

Practical implication: treat breached-credential reuse as a control failure, not a login event, and challenge it before session issuance.

Why SMS OTP fails against SIM swap attacks

SMS OTP depends on a phone number remaining under the legitimate user’s control, but SIM swap attacks break that assumption. After the attacker gathers personal data, they can impersonate the victim to a carrier or social engineer the victim directly, causing the number to be reassigned to a new SIM. From that point, the OTP is delivered to the attacker’s device, so the second factor confirms only that the attacker controls the redirected number. That makes the factor useful against some opportunistic abuse, but brittle against identity-driven fraud.

Practical implication: do not treat SMS delivery as proof of user authenticity when carrier-level takeover is plausible.

How session takeover turns a valid login into fraud

Once the attacker holds both the breached credentials and the redirected OTP channel, the session often looks legitimate to the application. That is why device binding, transaction context, and post-login behaviour matter so much. A session token tied to one device fingerprint can become suspect if the device changes midstream, and a user who jumps immediately to wires, account changes, or first-time sensitive actions creates a behavioural anomaly. The article also shows a deeper onboarding failure, where a fraudster can open or merge accounts in ways that inherit access to existing balances.

Practical implication: anchor high-risk actions to device and behavioural checks, not just successful authentication.

Threat narrative

Attacker objective: The attacker wants to convert legitimate identity evidence into financial theft or durable account control while avoiding obvious authentication alarms.

1. Entry begins with credential stuffing or social engineering that identifies usable accounts and, in some cases, carrier or support-channel weaknesses.
2. Credential access is extended when the attacker uses SIM swap tactics to redirect SMS OTPs to a device they control.
3. Escalation occurs when the attacker logs in, passes the OTP challenge, and takes over the session with apparently valid credentials.
4. Impact follows when the attacker drains funds, changes account details, or uses the compromised account as a launchpad for further fraud.

Breaches seen in the wild

• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS OTP is a possession check, not an identity check. That distinction matters because fraud actors do not need to defeat authentication in the abstract, only the narrow trust assumption that a phone number remains bound to the legitimate user. Once carrier control can be redirected through social engineering, the authentication factor becomes an exfiltration channel for the attacker. Practitioners should treat SMS OTP as one signal inside a broader identity and transaction risk model, not as a sufficient trust decision.

Account takeover is really a lifecycle problem. The article shows that attackers can begin with credential stuffing, continue through support-channel manipulation, and finish inside an authenticated session. That means security teams that isolate login risk from onboarding risk and transaction risk leave a governance gap attackers can traverse. The named concept here is authentication fragmentation: controls exist, but they are not connected into one decision surface. Teams should close that gap with linked verification, device trust, and behavioural policy.

The decisive failure mode is trusted-channel overreliance. When teams assume SMS, carrier workflows, or help-desk identity checks are inherently trustworthy, they create a path for pretexting and session hijack. This is not just a consumer fraud problem; it is a reminder that identity proofing, authentication, and step-up controls have to be evaluated as a chain. For practitioners, the lesson is to remove single-channel dependency from any high-risk identity flow.

Continuous risk evaluation should replace binary login thinking. The article’s strongest signal is that valid credentials can still be malicious when the device, number, or behaviour changes in ways that fit fraud patterns. That aligns with identity governance models that move from one-time authentication to ongoing trust assessment. The practical conclusion is simple: if a session can be hijacked after it has passed login, then login was never the control boundary that mattered.

What this signals

Authentication fragmentation is the governance gap this article exposes. Many teams still treat login, device trust, and transaction approval as separate checkpoints, but attackers only need one weak bridge between them. The programme response is to make risk decisions continuous across the full customer journey, not just at sign-in.

SMS-based step-up controls should be viewed as legacy-compatible, not fraud-resilient. Once a carrier or help-desk can be persuaded to move a number, the OTP channel becomes attacker-controlled, which means the real control question is whether the session is still bound to the right person and device.

For IAM and fraud teams, the most useful change is to shift trust from channel possession to contextual verification. Device consistency, behavioural anomalies, and transaction sensitivity provide a stronger picture of legitimacy than an SMS code alone.

For practitioners

• Map SMS OTP dependence to fraud scenarios Identify every workflow that still treats SMS one-time passwords as a primary step-up factor for account recovery, payments, or high-value changes. Reclassify those flows as high risk where SIM swap or carrier impersonation is plausible.
• Add real-time SIM swap checks Insert a live phone-risk lookup before sending an OTP for sensitive actions, and block or step up when recent carrier changes indicate takeover risk. This is most valuable where the OTP protects money movement or profile recovery.
• Bind sessions to device context Tie session tokens to a stable device fingerprint and invalidate the session when the device changes unexpectedly during a high-risk journey. Use that signal alongside velocity, geo-location, and new-payee behaviour.
• Rate-limit and normalise enumeration responses Make forgot-password, username lookup, and account recovery endpoints return consistent responses and enforce strict velocity controls. That reduces the credential-stuffing reconnaissance described in the attack lifecycle.
• Separate onboarding trust from payment trust Do not let a successful account-opening or profile-merge event automatically grant access to linked balances or payment privileges. Require independent verification before inherited access is activated.

Key takeaways

• Account takeover becomes durable when attackers can combine breached credentials, social engineering, and redirected OTP delivery into one fraud chain.
• The article shows that authentication can succeed even when trust has already failed, especially if the attacker controls the phone number or session context.
• Teams should respond by connecting identity proofing, device trust, and transaction risk so that one compromised factor does not authorise the whole journey.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Session Hijacking: Session hijacking is the takeover of an authenticated session after the original login has completed. The attacker does not need to know the password if they can use the active session token, which is why session monitoring and revocation are essential controls in SaaS identity governance.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security and identity practitioners build stronger control models for modern authentication and access governance.