Why can SIM swap attacks defeat one-time passcodes?

Why SIM Swap Attacks Break SMS and Voice Codes

A SIM swap works because the phone number becomes the attacker’s delivery channel, not the legitimate user’s. Once the carrier moves the number, SMS one-time codes and voice calls arrive on the attacker-controlled SIM or eSIM. That means the weakness is not the code length, it is the trust placed in the phone line as an identity signal.

The practical failure is that many recovery and step-up flows still treat possession of the number as evidence of account ownership. When that assumption is wrong, the attacker can receive OTPs, reset credentials, and approve follow-on access without ever learning the victim’s password.

If your authentication design still relies on SMS OTP as a recovery or second factor, the control is only as strong as the telecom process behind the number. The right comparison is not “code versus no code”, but “phishable, reroutable delivery path versus a resistant authenticator”.

Where the Trust Boundary Actually Breaks

SIM swap attacks do not need to break encryption or guess a code. They exploit the handoff between the carrier, the mobile network, and the identity system. SIM Swap Fraud Guide explains the controls around port-out fraud, carrier PINs, and moving away from SMS OTP.

The attack also fits broader account takeover patterns, because the code often unlocks password resets, new device enrollment, or help desk recovery. Account Takeover Prevention Guide covers the downstream abuse of recovery flows and session risk that often follows a SIM swap.

The issue is not limited to one channel. If a workflow accepts either SMS or voice as proof, the attacker only needs one successful reroute. In practice, that turns the phone number into a shared dependency across login, recovery, and customer support.

What Stronger Authentication Changes

Codes delivered over telecom channels are weak when compared with phishing-resistant authenticators, especially when the same number is used for recovery. Passwordless and Passkeys Guide shows why passkeys and FIDO2 reduce dependence on a number that can be ported or swapped.

For users and support teams, the decision is usually whether to keep SMS as a convenience factor or remove it from high-value recovery paths. MFA Guide compares SMS to stronger options and explains why phishing-resistant MFA is the better long-term baseline.

For high-risk accounts, the most important design choice is to stop treating the phone line as a trusted recovery anchor. Mobile Communications Protection for High-Risk Individuals Guide lays out carrier PINs, registration locks, and the case for removing SMS from MFA altogether.

What Happens After the Swap

Once the attacker controls the number, the damage is usually broader than one login event. They can intercept reset codes, hijack step-up prompts, and take over any workflow that assumes the phone number is still bound to the real user. That is why SIM swaps often lead directly to account recovery abuse and session theft.

The attack path is also a social-engineering problem, because the swap is often preceded by calls, pretexts, or help desk manipulation. Vishing and Smishing Guide covers the caller-side and message-side techniques that frequently support the SIM swap itself.

Vishing and Help Desk Social Engineering Awareness Guide is useful where carrier or internal support staff can be induced to bypass verification, because that is often the enabling step before the codes are ever redirected.

Risk and Threat Considerations

SIM swap risk is really a trust-boundary problem: once telecom possession is accepted as identity proof, the attacker can inherit the recovery path as well as the login path. That makes the impact larger than a single intercepted code, because the same rerouted number may be accepted across password reset, MFA reset, and account recovery.

Failure mechanism: The authentication system depends on a channel the attacker can move, clone, or reroute faster than the user or the service can detect, so the “one-time” code is delivered to the wrong endpoint.

Impact: The attacker can complete step-up authentication, reset credentials, enroll a new device, and sometimes maintain access even after the victim notices the original number is unavailable.

Practitioner Guidance

What to prioritise: Treat any account that still uses SMS or voice OTP as a recovery risk first, not just an MFA design choice. The highest-value fix is to remove the phone number from privileged recovery paths before trying to tune alerts around SIM swap detection.

What to verify: Check whether password reset, MFA reset, and account recovery all rely on the same number, and whether support teams can override those checks without stronger proof. If they can, the control gap is operational as much as technical.

Practitioner takeaway: SIM swap defeats OTPs because the delivery channel is the weak link, so the real control objective is to make account recovery and step-up authentication independent of a portable phone number.

Related resources from NHI Mgmt Group

• How should fraud teams adapt mobile identity checks as open banking, real-time payments, and SIM swap attacks converge?
• Why do SIM swap attacks matter for IAM teams?
• Why do traditional MFA controls fail against help-desk and SIM swap attacks?
• Why do one-time passcodes still fail against modern phishing campaigns?