SIM swap fraud exposes the limits of SMS-based identity checks

At a glance

What this is: This is an analysis of SIM swap fraud and how attackers use control of a mobile number to defeat SMS-based identity verification.

Why it matters: It matters because IAM and fraud teams still rely on phone-number checks and SMS OTPs that can be subverted when the number itself becomes the attack surface.

By the numbers:

• 25 million people in the UK, i.e., approximately half the country, are using mobile for banking activities.
• In the first half of 2020, 483 SIM swap cases were recorded in the UK, resulting in a loss of £839K; the average loss for a user amounted to £2,567.

👉 Read Prove Identity's analysis of SIM swap fraud and mobile identity risk

Context

SIM swap fraud is a mobile identity abuse problem, not just a payments problem. Attackers take over a phone number by socially engineering a carrier or service desk, then use that number to intercept one-time passcodes and reset account access.

For IAM and fraud teams, the weak point is the assumption that possession of a phone number still equals control of the user. That assumption breaks once the identity signal itself can be reassigned to an attacker in minutes, which is why phone intelligence and step-up policy have become operational controls, not optional extras.

Key questions

Q: How should security teams reduce SIM swap fraud in mobile authentication flows?

A: Treat the phone number as a risk signal rather than proof of identity. Use stronger factors for recovery and high-value actions, add real-time mobile intelligence before OTP delivery, and block or step up when the number recently changed or shows suspicious reputation. The goal is to make account access depend on factors that are harder to reassign than a SIM.

Q: Why do SIM swaps create such high account takeover risk?

A: Because the attacker gains control of the channel used to receive authentication codes and recovery messages. Once the number is ported or cloned, SMS-based verification no longer distinguishes the real user from the fraudster. That turns a telecom event into an identity event and gives the attacker a direct path into login and reset flows.

Q: How can teams tell whether mobile verification is working?

A: Look for reduced fraud loss, fewer successful account recovery abuse cases, and lower approval rates on high-risk transactions that follow recent SIM changes. If legitimate users are not being blocked while takeover attempts are falling, the policy is doing its job. If attacks still succeed after a number change, the trust model is too weak.

Q: Who is accountable when SMS-based authentication is bypassed through SIM swap fraud?

A: Accountability usually spans fraud, IAM, and customer support because the attacker exploits all three control points. Fraud teams own risk scoring, IAM owns authentication and recovery design, and support teams influence number-port and reset workflows. Regulators and auditors will typically ask whether the organisation assigned clear ownership for the full identity journey.

Technical breakdown

How SIM swap fraud defeats SMS-based authentication

SIM swapping, also called SIM splitting or SIM jacking, works when an attacker convinces a carrier or support representative to transfer a number to a SIM they control. The user usually sees only the aftermath. Once the number is moved, the attacker receives SMS messages, including one-time passcodes used for authentication and account recovery. This is not a password attack in the usual sense. It is an attack on the trust relationship between the phone number and the person who is supposed to own it. The result is that identity assurance collapses at the point where SMS is treated as proof of user presence.

Practical implication: treat phone-number control as a risk signal, not as proof of identity.

Why mobile intelligence matters in fraud decisioning

Mobile intelligence tries to answer a narrower question than standard identity verification: has the phone number changed hands or exhibited suspicious behaviour recently? That distinction matters because many SIM changes are legitimate, such as device upgrades or carrier transfers. A useful risk model has to evaluate the transaction in real time, combining phone-number reputation, device context, and authoritative signals. Without timing context, enterprises can know that a SIM swap happened but not whether it happened before or after the transaction being evaluated. That timing gap is what allows fraud checks to misclassify legitimate users or miss active attacks.

Practical implication: use real-time risk scoring at transaction time, not retrospective SIM swap detection alone.

Why step-up policy must be risk-based, not binary

A binary allow-or-block model creates avoidable friction because not every SIM swap is malicious. The more durable approach is to grade the transaction using multiple identity signals and then apply policy proportionate to the risk. That can mean blocking SMS delivery, forcing stronger verification, or routing the user into a manual review path. The key architectural point is that the phone number should not be the only binding factor for a user session when account takeover risk is elevated. Risk-based policy is what lets teams reduce fraud without treating every mobile customer as suspicious.

Practical implication: align authentication policy to risk level, not to a single yes or no phone check.

Threat narrative

Attacker objective: The attacker wants to seize account access by turning the victim’s phone number into an authentication asset under their control.

1. Entry occurs when the fraudster gathers personal information and socially engineers a carrier or support representative into changing SIM ownership.
2. Escalation follows when the attacker gains control of the victim’s phone number and begins receiving SMS-based authentication messages.
3. Impact occurs when the attacker uses that number control to bypass two-factor authentication, take over accounts, and drain funds or hijack services.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

SMS-based authentication is a brittle trust model when the phone number can be reassigned. SIM swap fraud works because the identity factor being verified is also the identity factor being stolen. That means the control is not merely weak, it is structurally exposed to delegation changes outside the user’s awareness. Practitioners should treat phone-number possession as an input to risk, not as a standalone authenticator.

Phone intelligence is the missing context layer in mobile identity decisioning. A carrier event alone is not enough to decide fraud, because many SIM changes are legitimate and many attacks are time-sensitive. The practical gap is the absence of authoritative timing and reputation data at the point of transaction. Security teams need decisioning that can distinguish normal device churn from adversarial takeover.

Identity assurance for mobile customers now spans fraud and IAM together. This is not only a fraud operations issue, because the same weak signal is often reused in login, recovery, and step-up flows. When one factor gates multiple account paths, an attacker who captures it can move laterally across the customer journey. Practitioners should align fraud policy, authentication policy, and recovery policy under one control model.

SIM swap fraud exposes the identity boundary problem in consumer IAM. The boundary between who owns a number and who can use it is no longer stable enough to support simple SMS trust. That means mobile identity programmes need governance around signal strength, not just around user convenience. Teams should be measuring whether their authentication design still assumes the number belongs to the person.

Carrier-mediated identity takeover is a governance issue, not just a detection issue. The attack succeeds when business processes trust the wrong assurance layer inside a support or porting workflow. That makes customer service, recovery, and telecom process design part of the identity control surface. Practitioners should review where account recovery still relies on easily transferable attributes.

From our research:

• 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
• 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
• For a broader control view, Ultimate Guide to NHIs , Standards maps the identity and access frameworks practitioners can use to tighten trust boundaries.

What this signals

Phone-number trust is now part of identity governance, not just fraud prevention. Teams that still use SMS as a recovery or step-up factor need to re-evaluate how much business logic depends on a transferable telecom asset. The practical shift is to treat recent SIM change signals as a control input that can downgrade trust before damage spreads across login, recovery, and payments.

With 96% of organisations storing secrets outside secrets managers in vulnerable locations including code, config files, and CI/CD tools, per the Ultimate Guide to NHIs, identity compromise is often downstream of poor secret discipline. Fraud teams and IAM teams should stop thinking in isolated channels. When one weak factor can open multiple pathways, the programme needs one decision policy across authentication, recovery, and transaction approval.

For practitioners

• Remove SMS OTP from high-risk recovery paths Use SMS only as a low-assurance signal. For password resets, number changes, and high-value transactions, require stronger factors that are not tied to the mobile number itself.
• Add mobile intelligence at decision time Score transactions with phone-number reputation, recent SIM change signals, and device context before you send an OTP or approve a recovery step.
• Tune step-up policy by risk tier Block, challenge, or manually review based on the confidence of the mobile signal and the value of the action. Do not use a single rule for all users.
• Review recovery flows for transferable factors Look for help desk or self-service steps that still accept phone-based verification as proof of control. Replace those steps where account takeover impact is material.

Key takeaways

• SIM swap fraud succeeds because the attacker steals control of the mobile identity factor itself, which makes SMS-based verification unreliable for recovery and login.
• The article cites 25 million UK mobile banking users and 483 SIM swap cases in H1 2020, showing that the risk is both broad and financially material.
• Practitioners should move high-risk journeys away from SMS dependence and use real-time mobile intelligence to drive step-up, blocking, and manual review.

Key terms

• SIM Swap Fraud: A fraud technique where an attacker takes control of a victim's mobile number by porting or cloning the SIM. The goal is usually to intercept one-time passcodes, reset accounts, and bypass identity checks that assume phone possession still means user control.
• Mobile Intelligence: Risk data about phone numbers, devices, and carrier events used at decision time. In practice, it helps security teams distinguish legitimate number changes from suspicious takeover attempts before they approve login, recovery, or transaction actions.
• Phone Number Reputation: A risk score built from historical and behavioural signals tied to a mobile number. It is most useful when treated as one input among several, because reputation can reveal recent abuse, but it cannot alone prove the caller or account holder's identity.
• Step-Up Authentication: A policy that asks for stronger verification when a transaction looks risky. For mobile identity flows, step-up should be based on event context, not on SMS trust alone, because the number itself may already be under attacker control.

What's in the full article

Prove Identity's full article covers the operational detail this post intentionally leaves for the source:

• How its Trust Score uses phone-intelligence signals and SIM swap checks in real time
• Why legitimate number changes are hard to separate from fraud without transaction context
• How low-risk and high-risk phone events can be routed into different policies
• The customer-experience trade-off between frictionless mobile access and stronger fraud controls

👉 The full Prove Identity article covers the Trust Score model and the fraud controls it enables.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.