Notifications
Clear all
Topic starter
06/09/2026 6:20 pm
TL;DR: SIM swap attacks move a victim’s number to an attacker-controlled SIM, breaking SMS and voice OTPs, callback checks, and phone-based recovery, according to Trusona. The real control gap is treating a phone number as proof of identity instead of a mutable routing detail.
NHIMG editorial — based on content published by Trusona: SIM swap protection for enterprises and related detection guidance
By the numbers:
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
- Only 5.7% of organisations have full visibility into their service accounts.
Questions worth separating out
Q: What should security teams do first when a phone number may have been swapped?
A: Stop the reset or recovery action and verify whether the number was recently ported or moved to a new SIM.
Q: Why do SIM swaps and call forwarding increase account takeover risk?
A: Because they attack the delivery channel, not just the password.
Q: Why do phone-based identity checks fail in account recovery?
A: They fail because the phone channel provides context, not proof.
Practitioner guidance
- Disable SMS for privileged recovery flows Move administrators, finance users, and other high-risk accounts to phishing-resistant authentication methods that do not depend on a phone number.
- Add live number-change checks before reset Query carrier state or equivalent telemetry at the moment of password reset, MFA reset, payment change, or account recovery.
- Separate verification from the phone channel Ensure the credential reset and the verification step do not both travel through the same phone number, callback path, or voice channel.
What's in the full article
Trusona's full blog covers the operational detail this post intentionally leaves for the source:
- Step-by-step detection logic for checking when a number was last ported or moved to a new SIM
- A live-call decision flow for help desk and support teams handling password, MFA, and payment-change requests
- Specific guidance on carrier-side protections such as port-out PINs and account locks for high-risk users
- Examples of how Trusona positions SIM swap and port-out detection within its ATO Protect checks
👉 Read Trusona's blog on SIM swap protection for enterprises →
SIM swap detection: are your recovery and reset checks enough?
Explore further
06/09/2026 6:21 pm
SIM swap fraud exposes the weakness of phone-number possession as an identity signal. Enterprises often treat a number as proof that a caller is the legitimate account holder, but a swap breaks that assumption without changing the directory record. This is a governance failure at the verification layer, not a telecom edge case. The practical conclusion is that phone-number possession must be treated as a routing condition, not an identity proof.
A question worth separating out:
Q: How should organisations reduce dependence on SMS for identity verification?
A: Move privileged users to phishing-resistant methods, use number-change detection as a gating control, and require a separate authoritative proofing step for any high-risk reset or recovery. SMS can remain a contact route, but it should not be treated as proof of identity. The goal is to make account recovery independent of a single mutable channel.
👉 Read our full editorial: SIM swap detection belongs at the moment identity is verified
