Number hijacking is the fraudulent takeover or misuse of a telephone number, usually by an attacker who diverts calls or messages to a number they control. Practitioners encounter it in identity verification and account recovery, where control of a phone number can be used to intercept one-time codes or reset access.
What Number Hijacking Means
Number hijacking is a form of communications and account abuse in which an attacker takes control of a telephone number, or redirects calls and messages so they reach the attacker instead of the intended owner. Its importance comes from the number's role in verification, recovery, and trust, not just in voice service.
Because many systems still treat a phone number as proof of continuity or ownership, hijacking can become a bridge into email, banking, messaging, and enterprise accounts. The security problem is therefore broader than telephony fraud: it is a trust failure in a recovery path.
How Hijacking Usually Works
Common takeover paths include port-out fraud, SIM swap-style transfers, manipulation of carrier records, or misuse of call forwarding and voicemail settings. The attacker does not need to break cryptography if they can convince a carrier, reseller, or support desk to move control of the number.
Some attacks are opportunistic and rely on weak identity checks at the telecom layer. Others are targeted, using stolen personal data to pass verification or social-engineer support staff. The practical effect is the same: the victim loses reliable receipt of calls, texts, and one-time codes.
For broader control context, telephone-number hijacking is best understood alongside account recovery weaknesses and weak step-up authentication, which is why identity assurance guidance such as NIST SP 800-63 Digital Identity Guidelines is relevant to how organisations think about phone-based verification.
Why It Is Dangerous for Verification and Recovery
Number hijacking is dangerous because many services still use a phone number as a second factor, a recovery channel, or a notification endpoint. When the number is compromised, the attacker can intercept one-time passcodes, approve resets, or delay the victim's awareness of account changes.
That creates a direct path from communications fraud to account takeover. Once the attacker can receive messages intended for the victim, they may be able to reset passwords, defeat recovery workflows, or impersonate the victim in downstream services that trust the number too much.
From a control standpoint, this is one reason organisations should prefer stronger authentication and recovery design. Practical alignment with NIST Cybersecurity Framework 2.0 helps place the issue in identity, protection, detection, and recovery rather than treating it as a pure telecom dispute.
Detection, Containment, and Recovery
Exposure is often discovered only after login failures, missed messages, unexplained account lockouts, or alerts that a phone number has changed. Organisations should treat sudden recovery-channel changes, unusual MFA prompts, and customer reports of lost service as possible compromise signals.
Containment usually means forcing a fresh trust check on the affected account, revoking sessions that may have been approved through the hijacked number, and replacing phone-based recovery with stronger mechanisms where possible. If the number was used to reset access, review whether any sessions, tokens, or linked accounts were created or modified during the compromise window.
For attack-path analysis and fraud-response mapping, MITRE ATT&CK Enterprise Matrix is useful for framing the credential-access and social-engineering behaviours that often accompany this kind of takeover.
Risk and Threat Considerations
Number hijacking matters because it turns an everyday communications identifier into a high-value access path. The risk is greatest where teams rely on SMS or voice as a recovery factor, or where customer support can change account state without strong verification.
Failure mechanism: An attacker compromises the numbering relationship itself, then uses the redirected calls or messages to satisfy recovery checks, capture one-time codes, or impersonate the victim in support flows.
Impact: The outcome can include account takeover, loss of message confidentiality, fraudulent password resets, disruption of legitimate communications, and delayed detection of identity compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-63 | Digital Identity Guidelines | Defines assurance and recovery practices for phone-based authentication use. |
| Recommendation — Prefer phishing-resistant authenticators and reduce reliance on phone-number recovery. | ||
| NIST CSF 2.0 | ID.AM-01 — Identity Asset Management | Number hijacking affects identity trust paths and recovery channels. |
| Recommendation — Inventory phone-number dependencies that can alter account access or recovery. | ||
| MITRE ATT&CK | T1110 — Brute Force | Hijacking often pairs with access abuse and recovery attempts against accounts. |
| Recommendation — Correlate takeover signals with repeated recovery and login abuse patterns. | ||
Practitioner Guidance
Why practitioners should care: A phone number should be treated as a weak proof of continuity, not as a durable identity control. When a workflow depends on it for account recovery, the business inherits a telecom-layer trust assumption it cannot fully control.
Practitioners should review where phone numbers are accepted as a recovery or step-up factor, and tighten those workflows where the number alone can alter account state. In parallel, monitor for number-change events, re-enrollment requests, and support interactions that could indicate abuse.
Practitioner takeaway: The safest posture is to limit what a hijacked number can unlock, and to design recovery so a stolen communications channel cannot by itself become account control.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org