Mobile hijacking exposes holiday identity fraud gaps

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Zumigo's blog post: Mobile hijacking increases during holiday spikes in account activity, and SMS-based authentication remains a weak point when attackers intercept or reassign a phone number.

Why it matters: Identity and fraud teams need to treat the mobile number as an attack surface, because recovery, step-up authentication, and account-change controls can all be undermined when number control shifts hands.

Context

Holiday periods compress multiple identity-risk conditions at once: more account openings, more payment activity, more password resets, and more opportunities for fraudsters to exploit weak recovery paths. In that environment, the mobile number becomes more than a contact method. It becomes an authentication and account-control factor that can be diverted, impersonated, or reassigned.

The governance gap is not just user behaviour. It is the assumption that possession of a number or device still proves control of the identity behind it. Identity fraud prevention has to account for number takeover, account-change abuse, and OTP interception as linked risks, not separate ones.

Mobile hijacking sits at the intersection of fraud, identity verification, and account recovery. That makes it especially relevant to teams responsible for consumer IAM, KYC, and step-up authentication during seasonal traffic surges.

Key questions

Q: What are the first signs that a mobile number has been hijacked?

A: Early signs include sudden loss of service, inability to receive calls or SMS, unexpected SIM or eSIM activation messages, and account recovery alerts from banks or email providers. A hijacked number may also show calls being diverted, voicemail PIN changes, or password reset requests you did not make. Treat these as possible SIM swap or port-out fraud and escalate through your carrier.

Q: Why does SMS one-time passcode authentication fail when a number is ported or swapped?

A: SMS OTP fails because the code is delivered to the phone number, not to the person or device, so a ported or swapped number now routes messages to the attacker’s SIM or carrier profile. The login system still sees a valid number, but the legitimate user no longer receives the one-time code, breaking authentication and recovery flows. This is why SMS is weak for high-risk accounts.

Q: How should teams redesign mobile account recovery for phishing-resistant assurance?

A: They should remove any recovery path that depends on a code, password reset link, or caller verification that can be intercepted or spoofed. Recovery should rely on a stronger possession check or a separately governed trust path, so the attacker cannot use the recovery flow to create the account takeover.

Q: What should organisations do when mobile service changes unexpectedly?

A: They should treat the change as an identity compromise, lock down sensitive account recovery paths, and verify whether the number was ported, swapped, or diverted without authorisation. Then re-issue trusted contact methods, review MFA methods tied to the number, reset recovery factors, and place additional checks on banking, email, and admin accounts that use SMS or voice verification.

Technical breakdown

How mobile number hijacking intercepts authentication

Mobile hijacking works by redirecting a victim’s trusted communication path, not by cracking the password itself. Call forwarding, device additions, porting, intra-porting, SIM swapping, and eSIM transfers all let an attacker place themselves between the user and the one-time passcodes or alerts that confirm identity. Once the attacker controls the number or the messages reaching it, they can approve resets, receive OTPs, and impersonate the victim in recovery flows. The security failure is the collapse of possession-based assurance when the possession signal can be reassigned through carrier or account-layer changes. See the Identity Proofing and KYC Guide.

Practical implication: Treat phone-number control as an exposure that must be continuously verified, not assumed from enrollment history.

Why SMS one-time passcodes fail under number takeover

SMS-based 2FA depends on the assumption that the phone number remains under the legitimate user’s control and that the message path is private. That assumption breaks when attackers can port the number, add a device, or trigger call forwarding. SMS remains useful as a convenience channel, but it is a brittle second factor because it is tied to telecom controls outside the identity system. App-based authenticators and FIDO-based security keys reduce dependence on the number itself by binding the authentication event to a device or cryptographic key under stronger control.

Practical implication: Move high-value accounts away from SMS OTPs where takeover or recovery abuse would materially increase fraud loss.

How carrier account controls become an identity control plane

A mobile carrier account often functions as an upstream identity control plane because it can authorize number changes, SIM replacement, porting, and device re-binding. That makes the carrier PIN or passcode part of the wider identity assurance chain, even when the enterprise does not manage it directly. If an attacker convinces a carrier to alter the account, the enterprise may see only a normal-looking authentication failure later, after the damage is already done. The operational lesson is that identity risk extends into telco workflows whenever mobile numbers are used for authentication or recovery.

Practical implication: Map carrier-driven change events into fraud and identity monitoring so number reassignment is visible before account takeover succeeds.

Threat narrative

Attacker objective: The attacker’s objective is to seize control of the victim’s mobile identity long enough to intercept authentication, reset access, and take over financial or high-value accounts.

1. Entry begins when fraudsters collect enough personal data to impersonate the victim in a carrier or account workflow, or when they compromise a mobile account directly.
2. Credential or channel access follows when they trigger call forwarding, add a device, port the number, or obtain a replacement SIM, which diverts OTPs and account messages.
3. Escalation occurs when the attacker uses the intercepted channel to reset passwords, approve recovery steps, or satisfy callback checks that were meant to verify the legitimate user.
4. Impact is account takeover of financial and high-value services, with the victim locked out while the attacker receives messages, resets credentials, and abuses the identity for fraud.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• Meta Muse agent hijack 2026: An undocumented Muse setting let local malware hijack Meta's personal AI agent, steal its authentication material and abuse user access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Mobile hijacking is an identity governance problem, not just a fraud tactic. The attack succeeds because organisations and carriers still treat the phone number as a stable possession factor when it is actually a transferable control point. That makes the issue relevant to identity proofing, recovery, and step-up authentication at the same time. The practical conclusion is that teams must stop treating mobile possession as a durable trust anchor.

SMS-based authentication creates a brittle trust chain. Once a number can be forwarded, ported, or reassigned, SMS OTP becomes a channel that can be redirected without altering the underlying account credentials. That is not a minor weakness. It is a structural dependency on telecom controls that the enterprise does not own. Practitioners should read this as a sign to re-evaluate which recovery and authentication flows still depend on a number as the deciding factor.

Carrier workflow abuse is the real control boundary here. Call centre procedures, SIM replacement requests, port-out handling, and device re-binding are part of the identity system whether security teams model them that way or not. The governance gap is identity proofing and recovery that stops at the application boundary and ignores the carrier-side decision. Organisations that use phone-based recovery need to treat telco change events as identity events, not operational noise.

Identity fraud prevention now requires cross-domain signal fusion. Device reputation, account-change monitoring, call-forwarding anomalies, and unusual service-loss complaints all point to the same class of abuse. The named concept here is mobile identity takeover window: the short period in which an attacker can redirect a number, intercept messages, and complete account recovery before the victim notices. Teams that miss that window lose both visibility and control.

What this signals

Mobile identity takeover window: defenders need to think in minutes, not days, when number control shifts. Once an attacker can redirect messages or calls, the recovery workflow itself becomes the compromise path, so the monitoring problem moves from password events to service-change events.

Fraud and identity teams should align around the same trigger set for mobile compromise: number-port requests, SIM replacement, call-forwarding changes, and unexpected loss of service. Those signals belong in the same escalation path because they often precede credential reset abuse and account takeover.

For practitioners

• Replace SMS as the default second factor Move high-value accounts to app-based authenticators or FIDO-based security keys wherever recovery and step-up risk justify it.
• Harden carrier account recovery Set a unique account PIN or passcode with the mobile provider and require it for number changes, SIM replacement, and porting requests.
• Monitor for number-control anomalies Treat unexpected service loss, forwarding changes, new-device additions, and unusual OTP requests as indicators of possible mobile hijacking.
• Reduce public identity exposure Limit the personal details that fraudsters can use to impersonate users during carrier calls, recovery flows, and callback checks.
• Escalate suspicious account-change events immediately When a phone loses service unexpectedly or a user reports OTP interception, involve the mobile provider and account-security team at once.

Key takeaways

• Mobile hijacking turns the phone number into a takeover point when organisations rely on SMS and carrier workflows as if they were stable identity proof.
• The article’s examples show how forwarding, device additions, porting, SIM swaps, and malware can all divert authentication messages to an attacker.
• Stronger recovery controls, carrier-side PINs, and phish-resistant authentication are the controls that reduce the attack window most directly.

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Identity Fraud Prevention Guide · Fraud and Cyber Convergence Guide

Key terms

• Mobile Hijacking: Mobile hijacking is unauthorised control of a victim’s phone number or mobile service. It usually happens through SIM swap, port-out fraud, or carrier account takeover, which lets an attacker intercept calls, SMS messages, and recovery codes tied to that number.
• Sim Swapping: An attack in which a fraudster convinces a carrier to move a victim's phone number to a SIM card or device they control. Once successful, the attacker can receive calls and texts intended for the victim, including OTPs used in account access or recovery.
• Call Forwarding Fraud: Call forwarding fraud is the unauthorised redirection of telephone calls from a legitimate number to another destination. Attackers usually change forwarding settings through a compromised carrier account, phone system, or voicemail control, so calls and verification codes can be intercepted without the owner noticing immediately.
• One Time Passcode: A one time passcode is a temporary code used to verify a user or system during authentication. In identity security, it is a short lived secret, usually delivered by text, email, app, or device, that expires after use or time out and reduces the value of stolen credentials.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.