TL;DR: SIM swapping can redirect SMS-based MFA codes to an attacker, letting groups like Lapsus$ bypass a control many organisations treat as sufficient, according to Unixi. The lesson is that MFA alone does not close account takeover risk when the recovery and phone-number trust chain remains exposed.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Unixi's blog post: SIM swapping defeats SMS-based MFA by redirecting verification codes to an attacker.
Why it matters: It matters because IAM teams cannot treat MFA as a complete control if recovery and phone-number trust paths remain exposed.
Context
SIM swapping is a phone-number takeover technique that redirects SMS messages to an attacker-controlled SIM. In identity security terms, it turns a recovery channel into an access path, which is why SMS-based MFA is only as strong as the telecom trust chain behind it.
The article’s core governance point is that MFA can reduce account takeover risk without eliminating it. For IAM and PAM teams, the real weakness is not the second factor itself but the surrounding enrollment, recovery, and help-desk processes that can be abused to reset or reroute access.
Key questions
Q: What breaks when SMS MFA is used for high-assurance identity?
A: SMS MFA breaks when the organisation treats a phone number and a delivered code as strong identity proof. SIM swapping, interception, and real-time phishing can all defeat that assumption, especially if credentials are already stolen. For privileged or regulated access, the issue is not second-factor presence but second-factor resistance to takeover paths.
Q: Why do SIM swap attacks remain dangerous even when multi-factor authentication is enabled?
A: SIM swaps can undermine SMS-based MFA because the attacker may take control of the phone number used to receive one-time codes or recovery prompts. Once that happens, access controls that rely on the mobile number as a trust signal can be bypassed. The risk grows when profile details, account numbers, or plan data are already exposed and can support convincing social engineering.
Q: What are the signs that recovery processes are weaker than login controls?
A: Warning signs include help desks that can reset factors with minimal verification, telecom changes that are not audited, and fallback channels that can be used to regain access without step-up approval. If recovery is easier to manipulate than sign-in, the identity programme has pushed its real control boundary into an unreviewed process.
Q: How should organisations choose between SMS-based MFA and phishing-resistant authentication methods?
A: Organisations should treat SMS-based MFA as a lower assurance option, not a final destination. It can still help reduce risk compared with passwords alone, but SIM swap attacks, interception, and phishing make it unsuitable for high-risk access. For stronger protection, prioritise phishing-resistant methods such as FIDO2 hardware keys or biometric authentication for critical users and sensitive systems.
Technical breakdown
How SIM swapping defeats SMS-based MFA
SIM swapping works by moving a victim’s phone number to a SIM controlled by the attacker. Once that transfer succeeds, SMS one-time codes intended for the legitimate user are delivered to the attacker instead, so the second factor becomes an attacker-controlled interception channel. The attack can be enabled through social engineering, insider collusion, or interception of SMS traffic. The underlying weakness is that SMS assumes the phone number remains bound to the intended person, when in practice that binding can be changed outside the identity system.
Practical implication: treat SMS-based MFA as a weak factor for privileged and high-risk accounts.
Why MFA-first programmes still leave recovery exposed
MFA-first programmes often focus on the login event and overlook the processes that let a user regain access. If a support desk, telecom provider, or recovery workflow can rebind a number without strong verification, the attacker bypasses the very control MFA was meant to enforce. This is why SIM swapping is not just an authentication problem. It is an identity lifecycle and recovery problem, where the trust decision is made outside the primary authenticator and can be easier to manipulate than the login itself.
Practical implication: place recovery controls under the same governance as sign-in controls.
Why SMS trust chains create account takeover blast radius
When attackers succeed with SIM swapping, they often gain more than one account. The article cites cases where Lapsus$ used the method against NVIDIA, Microsoft, and Okta, showing how a single compromised phone-number trust chain can spread across multiple services. In practice, SMS-based MFA becomes a shared dependency across systems, which expands blast radius when it fails. That makes the verification channel itself part of the security boundary, not merely a convenience layer on top of it.
Practical implication: reduce reliance on SMS where account takeover would create material operational or data risk.
Threat narrative
Attacker objective: The attacker wants to bypass MFA, take over trusted accounts, and use that access to reach sensitive systems or data.
- Entry occurs when the attacker persuades a mobile provider or insider to transfer the victim’s number to an attacker-controlled SIM.
- Credential access follows when SMS-based MFA codes are redirected to the attacker instead of the legitimate user.
- Escalation happens as the attacker uses the captured codes to sign in to protected accounts and reach internal systems or support channels.
- Impact includes account takeover, exposure of internal data, and in some cases broader customer or source-code compromise.
Breaches seen in the wild
- Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
- Uber breach 2022: A contractor's stolen password and MFA fatigue gave a Lapsus$-linked attacker Uber's internal tools; Uber rotated keys to many services.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
MFA-first identity security fails when the phone number becomes the real second factor: SMS-based verification assumes the telecom layer is trustworthy enough to anchor access decisions. SIM swapping breaks that assumption, so the control that looks like MFA is sometimes only a rerouted delivery channel. The implication is that identity teams must stop treating SMS as an acceptable default for high-risk access.
Recovery paths are the hidden trust boundary in account takeover: Most organisations review login controls more often than they review number-porting, help-desk verification, or recovery escalation. That imbalance creates a governance blind spot because the attacker does not need to defeat the primary authenticator if they can manipulate the path that resets it. Practitioners need to govern recovery with the same discipline as authentication.
SIM swapping is a blast-radius problem, not just an authentication problem: A single compromised number can unlock multiple services, internal tools, and support workflows because many systems reuse the same identity assumption. That makes phone-number trust debt a cross-programme risk spanning IAM, service desk operations, and privileged access. Security teams should treat shared recovery factors as enterprise attack surface.
Support processes become identity infrastructure when they can rebind access: When a help desk or carrier can reset a factor with insufficient assurance, the organisation has delegated authentication authority outside the IAM stack. That delegation was designed for user convenience, not adversarial pressure. The implication is that account recovery, not just sign-in, belongs in identity governance reviews.
From our research library:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
What this signals
Phone-number trust debt: Organisations that still allow SMS to anchor account recovery are carrying a hidden dependency on telecom assurance that IAM teams do not govern directly. Once that dependency exists, identity risk is no longer confined to login policy; it extends into carrier processes, service desk scripts, and escalation approvals.
A better programme design treats recovery as a privileged action and reserves stronger authenticators for any account that can touch customer data, source code, or internal administration. That shift does not eliminate SIM swapping, but it removes the easiest path from number takeover to account takeover.
For practitioners
- Reduce SMS dependence for high-risk accounts Move privileged users, administrators, and support personnel to stronger phishing-resistant factors and reserve SMS for low-risk fallback only.
- Govern recovery as a privileged workflow Review number changes, factor resets, and help-desk identity proofing with the same approval and audit standards used for privileged access changes.
- Harden telecom and support escalation paths Require step-up verification before any SIM or number change request can influence access to business systems or recovery tokens.
- Segment accounts by takeover impact Separate business-critical accounts from routine user accounts so that a compromised recovery channel cannot open broad internal access.
Key takeaways
- SIM swapping exposes a structural weakness in SMS-based MFA because the attacker can redirect the factor delivery channel instead of defeating the password.
- The real governance gap sits in recovery, number-change, and help-desk processes, which often receive less scrutiny than login controls.
- Organisations should move high-risk accounts away from SMS dependency and treat recovery workflows as privileged access decisions.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | SMS MFA is vulnerable when the factor delivery path can be hijacked by SIM swapping. |
| NHI-10 — Human Use of NHI | Help-desk and carrier-mediated recovery paths let humans misuse identity trust chains. | |
| Recommendation — Replace SMS reliance for high-risk accounts with stronger authentication factors and recovery controls. Review human-mediated recovery steps that can rebind credentials or factors without strong assurance. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Authenticator lifecycle and reset governance are central to preventing SMS-based takeover paths. |
| Recommendation — Apply authenticator management controls to restrict resets, factor changes, and recovery overrides. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Access authorisation depends on strong binding between user, factor, and recovery path. |
| Recommendation — Align authentication and recovery approval paths so number changes cannot silently alter access rights. | ||
| MITRE ATT&CK | TA0006;TA0001 — Credential Access; Initial Access | SIM swapping enables credential capture and the initial access needed for account takeover. |
| Recommendation — Map SIM-swapping detections to credential access and initial access tactics in your monitoring pipeline. | ||
Key terms
- Sim Swapping: An attack in which a fraudster convinces a carrier to move a victim's phone number to a SIM card or device they control. Once successful, the attacker can receive calls and texts intended for the victim, including OTPs used in account access or recovery.
- SMS-Based MFA: SMS-based MFA is a login method that sends a one-time code to a phone number by text message. It adds a second factor beyond a password, but the factor is tied to the mobile network and phone number, so it can be exposed through SIM swap, interception, or account recovery abuse.
- Recovery Path: The set of backup methods, reset flows, and help-desk procedures that restore access when a user loses their primary credential. Recovery paths often become the weakest part of identity governance because they can reintroduce shared secrets, manual override, or inconsistent verification standards.
- Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on August 27, 2026.
Updated on October 11, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org