Why does call forwarding increase the risk of phone-based authentication?

How call forwarding changes the trust boundary for phone-based authentication

Call forwarding matters because it changes where the phone call actually lands. If a login, reset, or step-up flow trusts the number rather than the handset, forwarding can make the “trusted” channel reachable by someone who does not control the victim’s device. The security problem is not the carrier feature itself, but the assumption that a dialed number still equals the rightful recipient.

That assumption is especially weak when the same number is used for both authentication and account recovery. If the forwarding state is active, an attacker may receive the call, the voice prompt, or the one-time code without needing to compromise the victim’s endpoint directly. In practice, the risk is highest when the phone number has become the primary proof of possession.

Where phone forwarding undermines OTPs, callbacks, and help desk checks

Call forwarding creates a path around the intended possession test. Voice OTP, callback verification, and some help desk identity checks often rely on the idea that the person answering controls the registered number. If forwarding is enabled or silently changed, the trust signal can be redirected to a different device or service, which weakens the security value of the call itself.

This is why forwarding is more dangerous than a simple nuisance setting. It can turn a second factor into a reachable relay, especially when the organisation uses telephone verification as a fallback after password reset, MFA reset, or “we will call your registered number” support workflows. The weakness is architectural: the control depends on telephony routing staying under the legitimate user’s control.

For a broader look at how telephone-based factors fail under relay, forwarding, and account recovery abuse, see OTP security. Where teams are deciding how much weight to place on phone-based factors at all, Workforce Identity Security Guide covers the recovery and help desk patterns that most often make forwarding dangerous.

Why attackers pair call forwarding with recovery abuse

Call forwarding is useful to attackers because it can preserve the appearance of a normal call flow while changing the recipient. That makes it attractive in social engineering and account takeover chains, particularly where the defender still treats the phone number as a reliable identity proof. The attacker does not need to break the phone system outright, only to change the route that the security signal follows.

Once forwarding is in place, it can be combined with password resets, MFA resets, or support escalations that still accept voice verification. The practical consequence is that the attack can move from initial access to durable control without triggering the kinds of alerts organisations expect from a direct device compromise.

For the adversary playbook around phone-based social engineering and help desk manipulation, the Storm-1811 Threat Actor Profile Guide shows how call and chat pressure can be chained into support abuse. If the failure is broader than a single factor and extends into account recovery design, Account Recovery Planning Guide is the right reference point.

Risk and Threat Considerations

Call forwarding is risky because it can bypass the intended “something you have” signal without alerting the user. The threat is greatest when the organisation accepts a forwarded voice call as equivalent to speaking with the registered subscriber, or when help desk staff treat caller ID and a known number as sufficient proof.

Failure mechanism: The authentication flow trusts telephony reachability, but call forwarding changes the destination while preserving the number, so the attacker can intercept the trust signal or redirect it to a device they control.

Impact: An attacker may complete MFA, password reset, or account recovery, then use the resulting access to change recovery details, enroll stronger control of the account, or lock out the legitimate user.

Practitioner Guidance

What to prioritise: Treat any authentication or recovery flow that depends on a voice call or callback as high-risk if forwarding can be enabled on the number. The most important question is whether the number is being used as an identity proof or only as a convenience channel.

What to verify: Check whether recovery steps can be completed with voice alone, whether forwarding changes are visible to the user, and whether support staff have a way to detect that the call was rerouted before they rely on it.

Decision rule: If the flow can unlock the account, reset MFA, or change recovery data, do not rely on forwarded voice delivery as a primary verifier. Use a stronger factor or a separate out-of-band control that is not tied to the same number.

Practitioner takeaway: Phone-based authentication is only as strong as the routing integrity behind it, so any feature that can silently redirect the call should be treated as a potential bypass path, not a harmless convenience.

Related resources from NHI Mgmt Group

• Why does a recent SIM change increase fraud risk for phone-number based authentication in high assurance flows?
• Why do phone-based recovery routes increase account takeover risk?
• Why do SIM swaps and call forwarding increase account takeover risk?
• Why does weak identity verification increase risk for FIDO, certificate-based authentication, and other strong credentials?