SIM swap fraud exposes the limits of SMS-based identity checks

At a glance

What this is: This is an analysis of SIM swap fraud and why SMS-based identity checks fail when attackers control the victim’s mobile number.

Why it matters: IAM and fraud teams need to treat phone-number ownership as an unstable signal, because SMS delivery and phone-based verification can be defeated before the authentication step even begins.

By the numbers:

• 25 million people in the UK are using mobile for banking activities, according to Prove Identity.
• The highest number of SIM swap cases were recorded in 2018, when 3,111 fraud cases caused a cumulative loss of £2.9 million, according to Prove Identity.
• In the first half of 2020, 483 SIM swap cases in the UK resulted in a loss of £839K, according to Prove Identity.

Context

SIM swap fraud is a mobile identity attack in which an adversary takes control of a phone number by porting or cloning the SIM, then uses that control to intercept verification flows and impersonate the user. For IAM teams, the core problem is that SMS-based assurance assumes the phone number remains bound to the rightful owner throughout the transaction.

The article focuses on the gap between what the organisation believes it is verifying and what the attacker can actually control at runtime. That gap matters in banking and other high-value consumer flows because a number that looks trustworthy can already be under adversary control before the one-time passcode is requested.

The operational lesson is broader than one fraud pattern. Any process that treats telephony as proof of identity, or relies on SMS as a second factor without independent risk checks, inherits the same weakness when the mobile identity boundary can be moved by social engineering.

Key questions

Q: What breaks when SIM swap fraud is used against SMS verification?

A: SMS verification breaks when the phone number itself is transferred to the attacker, because the code still reaches the new SIM. The organisation may believe it is confirming user possession, but it is actually confirming control of a mutable delivery path. That makes number ownership a weak factor for sensitive authentication and recovery flows.

Q: Why does SIM swapping create such a high account takeover risk for authentication and fraud teams?

A: SIM swapping works because attackers do not need the password if they can control the phone number. Once a carrier moves the number, the attacker can intercept SMS codes, reset credentials, and approve transactions. That breaks recovery flows, undermines trust in the second factor, and turns a compromised number into a direct path to account access.

Q: How should organisations reduce dependence on SMS for identity verification?

A: Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery. SMS can remain a contact route, but it should not be treated as proof of identity. The goal is to make account recovery independent of a single mutable channel.

Q: How do organisations tell legitimate number changes from SIM swap fraud?

A: They should compare number-change events with device continuity, behavioural consistency, and transaction context at the moment of use. A legitimate port or handset upgrade can look similar at enrollment time, so the decision must be made with current risk signals rather than static records. That is the difference between convenience and fraud control.

Technical breakdown

How SIM swapping transfers identity control

SIM swapping, also called SIM splitting or SIM jacking, works when a fraudster persuades a carrier or customer service representative to move a victim’s number onto a SIM the attacker controls. The attacker often starts with personal data, then uses that information to pass support checks and redirect calls and texts. Once the number is ported, the attacker can receive messages intended for the victim and impersonate them in downstream systems. The technical weakness is not the SMS channel itself, but the assumption that the phone number remains stable and exclusive to one user.

Practical implication: treat phone-number ownership as a mutable attribute, not a durable identity proof.

Why SMS one-time passcodes fail as a trust factor

SMS one-time passcodes depend on possession of the number at the moment the code is sent. That creates a fragile trust chain because the recipient is not authenticated by the channel, only by temporary access to the SIM route. If the number has been ported or cloned, the attacker receives the code and can complete login, reset, or transaction flows. The problem is structural: SMS validates delivery, not legitimacy, so it can become an attacker-controlled relay once the number is hijacked.

Practical implication: move high-risk flows away from SMS-only verification and add independent transaction risk signals.

Why real-time phone intelligence changes the decision point

Real-time phone intelligence shifts the control point from static enrollment checks to transaction-time risk evaluation. The article describes a model that scores the phone number using authoritative device and number attributes, then decides whether to send an SMS or apply a different policy. This matters because some SIM swaps are legitimate, so the organisation needs to distinguish normal number changes from suspicious ones without blocking every user. The key architectural idea is that assurance should be based on current risk, not just on historical account setup.

Practical implication: evaluate phone-number reputation at the moment of use, not only at onboarding.

NHI Mgmt Group analysis

Phone-number trust is a fragile identity assumption, not a durable control. SMS verification assumes the telecom binding remains stable long enough for the user to prove possession. SIM swap fraud breaks that premise by moving the number itself, so the identity check is compromised before the factor is evaluated. Practitioners should stop treating a phone number as evidence of user legitimacy without an independent confidence layer.

SIM swap fraud exposes a control gap between telecom ownership and identity assurance. The attack succeeds because carrier-side number transfer is not the same thing as account-holder identity. That gap is exactly where fraudsters operate, using social engineering to change the recovery channel and then consuming it as if it were proof. Identity programmes need to recognise that channel control and identity control are different governance problems.

SMS one-time passcodes are weak when the delivery path is attacker-controllable. A one-time passcode only helps if the message reaches the intended user. Once the number is ported or cloned, the code becomes an access token delivered to the adversary, which means the factor no longer distinguishes legitimate from fraudulent use. Security teams should view SMS as a convenience mechanism, not a primary trust anchor for high-risk transactions.

Real-time risk scoring is the right control concept for mutable phone identities. The article points toward transaction-time assessment of number reputation, device signals, and suspicious activity rather than static enrolment trust. That approach better matches a world where phone numbers can change hands during the identity session. Practitioners should align verification decisions to current signal confidence, not to the assumption that earlier enrollment still holds.

Identity confidence decay is the right mental model for SIM swap risk. Confidence in a phone-number based identity should decline as soon as number ownership becomes uncertain. That deterioration can happen outside the organisation’s direct control, which is why downstream authentication must be resilient to sudden changes in the mobile trust layer. The practical conclusion is to re-score identity every time the number is used for a sensitive action.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

SIM swap fraud is a channel-integrity problem, not just an authentication problem. The security issue begins before login, because the attacker can seize the delivery channel that SMS relies on. That means identity teams need controls that evaluate whether the communication path itself is still trustworthy before a factor is accepted.

Identity assurance must be recalculated at the point of use. A phone number can look stable at enrollment and still become attacker-controlled later, which is why static verification is not enough for high-risk flows. Transaction-time assessment is the right model when the identity attribute can change outside the application’s control.

For practitioners

• Replace SMS as a primary factor Use stronger authentication for high-risk consumer journeys and reserve SMS for low-risk notifications or step-up contexts where the number is not the sole proof of identity.
• Add transaction-time phone risk checks Score the phone number and device at the moment of login, reset, or payout so a recent SIM swap can change the decision before the code is sent.
• Treat number porting as a fraud signal Feed carrier-port events, SIM swap indicators, and anomalous number-change patterns into fraud policy rather than allowing them to pass as routine telecom maintenance.
• Separate identity confidence from delivery success Do not equate successful SMS delivery with user legitimacy. Require independent signals such as device continuity, session history, and behavioural consistency before approving sensitive actions.
• Tighten recovery and support flows Review help-desk and carrier-facing recovery paths so attackers cannot use personal data and service scripts to seize a phone number or reset access.

Key takeaways

• SIM swap fraud works because the attacker can take control of the phone number that SMS verification assumes belongs to the user.
• The article cites 3,111 UK SIM swap cases in 2018 and 483 cases in the first half of 2020, showing that the attack pattern remained material and costly.
• The control that matters most is not better SMS confidence, but stronger authentication and transaction-time risk checks that do not trust a mutable mobile number.

Key terms

• SIM-Swap Fraud: SIM-swap fraud happens when an attacker takes control of a victim’s mobile number by moving it to a different SIM card. That takeover can bypass phone-based verification and redirect alerts, one-time codes, and account recovery flows. In financial services, it often enables account compromise and unauthorized transfers.
• One-Time Passcode Check: A one-time passcode check is a verification step that proves control of a phone number or other registered channel by requiring a short-lived code. It is a common authentication signal in onboarding and step-up flows. By itself it does not prove identity, but it strengthens confidence that the applicant controls the claimed contact point.
• Phone Intelligence: Phone intelligence is the use of carrier, routing, and number-quality data to assess whether a phone number is likely to represent a legitimate user. In practice, it helps teams decide whether to send, challenge, or block an OTP before the message becomes a fraud event.
• Identity Confidence: Identity confidence is the ability to trust that a credential, token, account, or delegated identity is still valid and safe after exposure. In ransomware and recovery scenarios, it becomes a resilience measure because restored systems are only trustworthy if their access paths are clean as well.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.