Topic starter
06/11/2026 6:40 pm
TL;DR: Holiday spikes in account activity give fraudsters more opportunities to hijack mobile numbers through call forwarding, device additions, porting, SIM swaps, and malware, turning phone-based authentication into a high-value attack path, according to Zumigo. SMS OTPs and weak carrier checks create the conditions for account takeover, so identity controls must move beyond a number that can be reassigned or intercepted.
Editorial analysis by NHI Mgmt Group, based on content published by Zumigo: “Protect Your Digital Identity During the Holiday Rush”.
Key questions
Q: What are the first signs that a mobile number has been hijacked?
A: Early signs include sudden loss of service, inability to receive calls or SMS, unexpected SIM or eSIM activation messages, and account recovery alerts from banks or email providers.
Q: Why does SMS one-time passcode authentication fail when a number is ported or swapped?
A: SMS OTP fails because the code is delivered to the phone number, not to the person or device, so a ported or swapped number now routes messages to the attacker’s SIM or carrier profile.
Q: How should teams redesign mobile account recovery for phishing-resistant assurance?
A: They should remove any recovery path that depends on a code, password reset link, or caller verification that can be intercepted or spoofed.
Practitioner guidance
- Replace SMS as the default second factor Move high-value accounts to app-based authenticators or FIDO-based security keys wherever recovery and step-up risk justify it.
- Harden carrier account recovery Set a unique account PIN or passcode with the mobile provider and require it for number changes, SIM replacement, and porting requests.
- Monitor for number-control anomalies Treat unexpected service loss, forwarding changes, new-device additions, and unusual OTP requests as indicators of possible mobile hijacking.
Bottom line: Mobile hijacking turns the phone number into a takeover point when organisations rely on SMS and carrier workflows as if they were stable identity proof.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:42 pm
Mobile hijacking is an identity governance problem, not just a fraud tactic. The attack succeeds because organisations and carriers still treat the phone number as a stable possession factor when it is actually a transferable control point. That makes the issue relevant to identity proofing, recovery, and step-up authentication at the same time. The practical conclusion is that teams must stop treating mobile possession as a durable trust anchor.
A question worth separating out:
Q: What should organisations do when mobile service changes unexpectedly?
A: They should treat the change as an identity compromise, lock down sensitive account recovery paths, and verify whether the number was ported, swapped, or diverted without authorisation. Then re-issue trusted contact methods, review MFA methods tied to the number, reset recovery factors, and place additional checks on banking, email, and admin accounts that use SMS or voice verification.
👉 Read our full editorial: Mobile hijacking exposes holiday identity fraud gaps