Notifications
Clear all
Topic starter
11/07/2026 8:39 pm
TL;DR: SIM swap fraud works by taking over a victim’s mobile number through social engineering and carrier manipulation, then using that control to bypass SMS-based authentication and drain accounts, according to Prove Identity. The case shows why phone-number trust and OTP delivery are weak identity signals when adversaries can move the identity boundary.
NHIMG editorial — based on content published by Prove Identity: How to Fight the Menace of Rising SIM Swap Fraud in the UK
By the numbers:
- 25 million people in the UK, i.e., approximately half the country, are using mobile for banking activities.
- In the first half of 2020, 483 SIM swap cases were recorded in the UK, resulting in a loss of £839K; the average loss for a user amounted to £2,567.
Questions worth separating out
Q: How should security teams reduce SIM swap fraud in mobile authentication flows?
A: Treat the phone number as a risk signal rather than proof of identity.
Q: Why do SIM swaps create such high account takeover risk?
A: Because the attacker gains control of the channel used to receive authentication codes and recovery messages.
Q: How can teams tell whether mobile verification is working?
A: Look for reduced fraud loss, fewer successful account recovery abuse cases, and lower approval rates on high-risk transactions that follow recent SIM changes.
Practitioner guidance
- Remove SMS OTP from high-risk recovery paths Use SMS only as a low-assurance signal.
- Add mobile intelligence at decision time Score transactions with phone-number reputation, recent SIM change signals, and device context before you send an OTP or approve a recovery step.
- Tune step-up policy by risk tier Block, challenge, or manually review based on the confidence of the mobile signal and the value of the action.
What's in the full article
Prove Identity's full article covers the operational detail this post intentionally leaves for the source:
- How its Trust Score uses phone-intelligence signals and SIM swap checks in real time
- Why legitimate number changes are hard to separate from fraud without transaction context
- How low-risk and high-risk phone events can be routed into different policies
- The customer-experience trade-off between frictionless mobile access and stronger fraud controls
👉 Read Prove Identity's analysis of SIM swap fraud and mobile identity risk →
SIM swap fraud and SMS verification: what IAM teams need to know?
Explore further
11/07/2026 9:07 pm
SMS-based authentication is a brittle trust model when the phone number can be reassigned. SIM swap fraud works because the identity factor being verified is also the identity factor being stolen. That means the control is not merely weak, it is structurally exposed to delegation changes outside the user’s awareness. Practitioners should treat phone-number possession as an input to risk, not as a standalone authenticator.
A few things that frame the scale:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools, according to the Ultimate Guide to NHIs.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
A question worth separating out:
Q: Who is accountable when SMS-based authentication is bypassed through SIM swap fraud?
A: Accountability usually spans fraud, IAM, and customer support because the attacker exploits all three control points. Fraud teams own risk scoring, IAM owns authentication and recovery design, and support teams influence number-port and reset workflows. Regulators and auditors will typically ask whether the organisation assigned clear ownership for the full identity journey.
👉 Read our full editorial: SIM swap fraud exposes the limits of SMS-based identity checks
