Topic starter
27/08/2026 8:35 am
TL;DR: SIM swapping can redirect SMS-based MFA codes to an attacker, letting groups like Lapsus$ bypass a control many organisations treat as sufficient, according to Unixi. The lesson is that MFA alone does not close account takeover risk when the recovery and phone-number trust chain remains exposed.
Editorial analysis by NHI Mgmt Group, based on content published by Unixi: “MFA Cannot Stand Alone Series: The Risks of SIM Swapping”.
Key questions
Q: What breaks when SMS MFA is used for high-assurance identity?
A: SMS MFA breaks when the organisation treats a phone number and a delivered code as strong identity proof.
Q: Why do SIM swap attacks remain dangerous even when multi-factor authentication is enabled?
A: SIM swaps can undermine SMS-based MFA because the attacker may take control of the phone number used to receive one-time codes or recovery prompts.
Q: What are the signs that recovery processes are weaker than login controls?
A: Warning signs include help desks that can reset factors with minimal verification, telecom changes that are not audited, and fallback channels that can be used to regain access without step-up approval.
Practitioner guidance
- Reduce SMS dependence for high-risk accounts Move privileged users, administrators, and support personnel to stronger phishing-resistant factors and reserve SMS for low-risk fallback only.
- Govern recovery as a privileged workflow Review number changes, factor resets, and help-desk identity proofing with the same approval and audit standards used for privileged access changes.
- Harden telecom and support escalation paths Require step-up verification before any SIM or number change request can influence access to business systems or recovery tokens.
Bottom line: SIM swapping exposes a structural weakness in SMS-based MFA because the attacker can redirect the factor delivery channel instead of defeating the password.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/08/2026 8:35 am
MFA-first identity security fails when the phone number becomes the real second factor: SMS-based verification assumes the telecom layer is trustworthy enough to anchor access decisions. SIM swapping breaks that assumption, so the control that looks like MFA is sometimes only a rerouted delivery channel. The implication is that identity teams must stop treating SMS as an acceptable default for high-risk access.
A few things that frame the scale:
- Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.
A question worth separating out:
Q: How should organisations choose between SMS-based MFA and phishing-resistant authentication methods?
A: Organisations should treat SMS-based MFA as a lower assurance option, not a final destination. It can still help reduce risk compared with passwords alone, but SIM swap attacks, interception, and phishing make it unsuitable for high-risk access. For stronger protection, prioritise phishing-resistant methods such as FIDO2 hardware keys or biometric authentication for critical users and sensitive systems.
👉 Read our full editorial: SIM swapping exposes the limits of MFA-first identity security