SIM swapping exposes the limits of MFA-first identity security

At a glance

What this is: This is an explainer on SIM swapping as an MFA bypass technique, with Lapsus$ incidents showing how phone-number compromise can redirect authentication codes to an attacker.

Why it matters: It matters because IAM teams cannot treat MFA as a complete control when recovery paths, telecom trust, and support processes can undermine the authentication layer.

By the numbers:

• NVIDIA was hit by an attack that exposed 20 GB of sensitive data, including hardware schematics and employee credentials.
• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected.

👉 Read Unixi's explanation of SIM swapping and MFA bypass risk

Context

SIM swapping is a telecom-enabled account takeover method, not a flaw in cryptography. The attacker persuades or compromises a mobile provider so a victim’s phone number is moved to a SIM controlled by the attacker, which lets SMS-based MFA codes arrive at the wrong device.

For IAM teams, the problem is bigger than one-factor weakness. When recovery channels, phone numbers, and help desk escalation paths sit outside the identity programme’s control, MFA can create confidence without real assurance. That is why phone-based second factors are increasingly treated as a transitional control rather than a final state.

This is a classic human identity problem first, but it also exposes governance gaps that affect privileged accounts and support workflows. The article’s starting point is typical of a broader pattern: adversaries do not need to break MFA if they can reassign the delivery channel for the challenge response.

Key questions

Q: What breaks when organisations rely on SMS or email MFA for sensitive access?

A: The control breaks when the second factor can be intercepted, relayed, or socially engineered. SMS, email, and OTP-based MFA improve security over passwords, but they still leave room for SIM swapping and man-in-the-middle phishing. For sensitive access, that means the organisation is still authenticating through a phishable channel rather than using a proof method that resists interception.

Q: Should organisations prioritise phishing-resistant MFA over other identity projects?

A: For most enterprises, yes, when the goal is to reduce the most common account takeover path. It should be prioritised ahead of lower-value convenience changes because authentication weakness often becomes the first step in broader identity compromise and later governance failures.

Q: What do security teams get wrong about SNA and SIM swap fraud?

A: They often assume a binary SNA check is enough to solve the whole fraud problem. It is not. SNA verifies the SIM-to-number binding at the moment of the request, but it does not tell you whether a swap occurred recently, whether the user’s number was discovered automatically, or whether stronger identity checks are needed for a given journey.

Q: Who is accountable when an attacker bypasses MFA through SIM swapping?

A: Accountability usually spans the IAM team, telecom provider, service desk, and application owners because each controls part of the trust chain. NIST SP 800-63 is the right reference for authentication assurance, but operational ownership must also cover recovery workflows and privileged access decisions. The gap is usually governance, not just technology.

Technical breakdown

How SIM swapping hijacks SMS-based MFA

SIM swapping works by transferring a victim’s phone number to a SIM or eSIM under the attacker’s control. Because SMS-based MFA depends on the network delivering a one-time code to that number, the authentication factor is no longer bound to the legitimate user’s device. The underlying weakness is channel trust, not password strength: once the attacker controls the number, they control the second factor. This is why SMS MFA is vulnerable to social engineering, insider abuse, and interception in ways that phishing-resistant authenticators are not.

Practical implication: remove SMS as a high-risk fallback for sensitive accounts and treat it as an exposure, not a safeguard.

Why recovery and support processes are part of the attack surface

SIM swapping often succeeds because the identity programme is only as strong as the telecom carrier’s and help desk’s verification steps. If a provider allows a number port or SIM replacement after weak verification, the attacker does not need to defeat MFA directly. They only need to convince an agent, exploit a compromised insider, or abuse a reset path that was never designed as a privileged security control. In practice, the authentication stack now includes customer support, carrier processes, and account recovery workflows, all of which need governance.

Practical implication: inventory every recovery path and apply stronger approval and verification controls to number-change requests.

Why phishing-resistant MFA changes the control model

Phishing-resistant MFA methods such as FIDO2 or WebAuthn bind the authentication ceremony to the legitimate device and the relying party, which makes code interception and replay far harder. They do not solve every account takeover path, but they remove the phone-number dependency that SIM swapping exploits. For identity architecture, the shift is from possession of a transferable secret to possession of a cryptographic authenticator that cannot be rerouted through a carrier. That is a materially different assurance model.

Practical implication: prioritise phishing-resistant authentication for admins, finance, support, and any account with material blast radius.

Threat narrative

Attacker objective: The attacker aims to bypass authentication controls and gain access to high-value corporate systems, data, or customer environments.

1. Entry begins when the attacker uses social engineering, insider collusion, or interception to take over the victim’s mobile number and redirect SMS MFA.
2. Escalation follows when the attacker uses the rerouted codes to authenticate as the victim and move into internal systems or support channels.
3. Impact occurs when the attacker extracts sensitive data, source code, or customer access, as seen in the Lapsus$ cases cited by the article.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MFA is not a complete identity control when the delivery channel is the weak link. SMS-based MFA assumes that the phone number remains bound to the rightful user, but SIM swapping breaks that assumption before the authentication step even starts. The right security question is no longer whether MFA exists, but whether the second factor can be rerouted by an attacker. Practitioners should treat the channel as part of the identity trust boundary, not outside it.

Phone-number trust debt is the named governance problem this article exposes. Organisations accumulate trust debt when they keep SMS MFA, weak carrier recovery, and help desk resets in place because they are operationally convenient. That debt becomes visible only when attackers exploit the handoff between telecom, support, and IAM. The implication is that identity governance must include external dependency risk, not just internal policy compliance.

High-value accounts need phishing-resistant authentication because blast radius, not user convenience, is the deciding factor. Admins, support staff, finance teams, and customer-facing operators all carry different risk profiles, so uniform MFA policy is often too blunt. The strongest control posture is to reserve the most resilient authenticators for the accounts whose compromise would create the widest impact. Practitioners should align factor strength to privilege and business exposure.

Support workflows are privileged identity pathways whether teams label them that way or not. Many organisations govern login harder than they govern recovery, even though recovery can reissue the same access with less scrutiny. That mismatch creates a control gap between the formal identity stack and the operational reality of account restoration. The practical conclusion is that recovery governance belongs in the same conversation as privileged access and lifecycle control.

This pattern validates the need for layered identity assurance across human IAM and adjacent recovery systems. MFA raises the bar, but it does not eliminate account takeover if the identity proofing, reset, and carrier handoff layers remain weak. In governance terms, the programme has to extend beyond authentication and into the processes that can silently rebind a user to a new device. Practitioners should assess the full identity journey, not just the sign-in screen.

From our research:

• 72% of organisations have experienced or suspect they have experienced a breach of non-human identities, with 46% confirmed and 26% suspected, according to The 2024 ESG Report: Managing Non-Human Identities.
• In the same research, enterprises that have experienced a compromised NHI averaged 2.7 separate incidents in the past 12 months, which shows how quickly one exposed identity can become repeated access loss.
• For teams hardening identity assurance, our Ultimate Guide to NHIs , Regulatory and Audit Perspectives helps connect governance controls to audit expectations and lifecycle accountability.

What this signals

SMS-based MFA is increasingly a weak link in broader identity programmes because the control can be undermined outside the application layer. Teams that still rely on phone-number trust should treat it as an exposure in their human IAM architecture and prioritise migration for privileged populations, especially where NIST Cybersecurity Framework 2.0 governance and recovery controls need to align.

Recovery-path exposure: the practical risk is not just login bypass, but the chain of number change, help desk escalation, and account reset that silently rebinds access. That means security leaders need to review support processes with the same discipline they apply to authentication policy, because the attacker only needs one weak handoff to win.

The next governance question is how fast organisations can remove reroutable factors from high-risk accounts without creating operational dead ends. Our Ultimate Guide to NHIs , Lifecycle Processes for Managing NHIs is useful here because the same lifecycle logic applies whenever credentials, recovery paths, or approvals can be reassigned during the identity journey.

For practitioners

• Replace SMS MFA on sensitive accounts Move administrators, finance users, support staff, and executives to phishing-resistant methods such as FIDO2 or WebAuthn, and reserve SMS only for low-risk fallback where no better option exists.
• Lock down number-change and port-out requests Treat mobile number reassignment as a privileged event, require out-of-band verification, and create explicit approvals for SIM replacement or porting requests that affect authenticated users.
• Review recovery and reset workflows Map every path that can reissue access after a lost device, then harden the steps that rely on help desk staff, carrier support, or email-based resets.
• Classify support and carrier dependencies as identity controls Document telecom providers, service desk procedures, and account recovery logic as part of the identity control surface so they are reviewed alongside access policy and authentication strength.

Key takeaways

• SIM swapping works because the attacker hijacks the delivery path for MFA, not because the password is weak.
• The incident evidence shows that one rerouted mobile number can lead to internal access, source code exposure, or customer compromise.
• The practical fix is to move privileged accounts to phishing-resistant authentication and govern recovery workflows with the same rigour as sign-in controls.

Key terms

• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.
• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Recovery Workflow: A recovery workflow is the sequence of checks and actions used to restore access after a credential issue or account lockout. It includes verification, credential issuance, synchronization, and audit logging. Weak recovery workflows are attractive to attackers because they often sit outside the strongest authentication controls.
• Mobile Identity Trust Boundary: The point at which a mobile device stops being a passive endpoint and starts acting as part of the identity assurance process. When apps can read approvals, automate dialogs, or steal codes, the phone itself becomes part of authentication and must be governed as such.

What's in the full article

Unixi's full article covers the operational detail this post intentionally leaves for the source:

• A plain-English explanation of how SIM swapping works across social engineering, insider collusion, and interception scenarios.
• Examples of how Lapsus$ used phone-number compromise to bypass MFA at major organisations.
• The vendor's description of its Universal Single Sign-On approach and how it layers additional credential protection over MFA.
• A direct comparison between SMS-based authentication and stronger account protection patterns for everyday application access.

👉 Unixi's full article covers the Lapsus$ examples, SMS MFA failure path, and its proposed layered approach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.