Why does SMS one-time passcode authentication fail when a number is ported or swapped?

Why SMS OTP Breaks the Moment the Number Changes Hands

SMS one-time passcodes are tied to a telephone number and the carrier path behind it, not to the user’s physical device identity or the account holder’s intent. When a number is ported or swapped, the delivery path changes, so the message can reach the wrong SIM, the wrong handset, or an attacker-controlled carrier profile. The authentication factor still “looks” valid to the login system, but the legitimate recipient is cut out of the loop.

That is why the failure is structural rather than random. The system continues to trust a number that has lost its original binding, so both login and account recovery can fail at the same time. In practice, the user loses possession of the code channel while the attacker may inherit it.

There is a second weakness hidden in the same design choice: phone numbers are mutable and transferable, while authentication should be anchored to something much harder to redirect silently. SMS therefore works poorly when the account is high value, recovery is sensitive, or the attacker has reasons to target the telecom layer rather than the application itself. For higher assurance use cases, the issue is not just interception, but the fact that the factor can be reassigned without the relying party understanding that trust has changed. For a broader comparison of authentication methods and the attack paths that defeat them, see MFA Guide.

Why Number Porting and SIM Swap Are Authentication Problems, Not Just Telecom Problems

A port or swap changes control of the messaging destination. That means the security boundary is not the login form, it is the carrier relationship behind the number. If the phone number is used for password reset, step-up verification, or fallback access, the attacker may not need the victim’s password at all. They only need enough control over the number to receive the next code.

This is also why SMS OTP often fails in recovery scenarios. Once the number is reassigned, the legitimate user may be locked out while the attacker can keep receiving fresh codes. The failure is especially damaging when the same number is used to prove possession during password resets, account changes, or help desk verification. OTP security becomes much stronger when the code channel is treated as a weak, revocable transport rather than an ownership signal.

From an assurance standpoint, SMS is a low-friction factor that depends on weak external trust. A number can be recycled, ported, intercepted, or socially engineered, and the relying party has little visibility into which of those conditions is in play. That makes the factor brittle for accounts where a missed message is not merely inconvenient, but business critical.

What Organisations Should Change When SMS Is Still in Use

Where SMS cannot be removed immediately, the practical response is to narrow its role. Use it as a temporary step-up for low-risk cases only, then move sensitive accounts to phishing-resistant methods that are not dependent on the number’s current carrier routing. Modern guidance increasingly treats SMS as a fallback, not a strong authenticator, especially when account recovery is part of the design. The NIST SP 800-63 Digital Identity Guidelines are the main external reference for understanding why weaker out-of-band factors deserve limited trust.

Recovery is the area teams most often underestimate. If the same SMS channel is used to regain access, then porting risk becomes recovery risk, and recovery risk becomes account takeover risk. Good design separates notification, step-up, and recovery paths, and it verifies whether a changed number should trigger re-enrolment rather than silent reuse of the old factor. Organisations that want a cleaner migration path should also compare SMS against Passwordless and Passkeys Guide and plan for stronger recovery controls around the replacement method.

Risk and Threat Considerations

The main risk is not that SMS fails occasionally, but that it can fail in a way that benefits the attacker. Number porting and SIM swapping can redirect the code channel without changing the login system’s view of the account, so the user sees a lockout while the attacker sees a working verification path.

Failure mechanism: The factor is bound to a routable number, not to the legitimate user or a trusted device, so control of the number can be transferred without the authenticator noticing.

Impact: Attackers can intercept login and recovery codes, take over accounts, and keep the victim out long enough to change passwords, reset other factors, or persist in the account.

Practitioner Guidance

What to verify: Check whether SMS is still accepted for primary login, account recovery, help desk resets, or step-up on privileged or revenue-bearing accounts. If it is, verify what happens after a number change, because that is where the control usually fails first.

Decision rule: If the account can expose money, customer data, administrative access, or recovery authority, treat SMS as a transitional control and require a stronger factor before you rely on it for ongoing access. If the number change can silently inherit trust, the design is too weak for high assurance.

Practitioner takeaway: The real issue is not SMS delivery, it is trust binding. If the factor can be reassigned without re-establishing proof of control, it should not be the mechanism that protects sensitive access or recovery.

Related resources from NHI Mgmt Group

• One Time Passcode
• How should security teams use phone intelligence to decide whether to send an SMS one-time passcode?
• How should financial institutions reduce reliance on SMS one-time passcodes for customer authentication?
• What is the difference between SMS one-time passcodes and mobile network based authentication?