SIM Card Hijacking is the takeover of a mobile phone number by getting a carrier to move it to a different SIM card or eSIM. Attackers use the number to intercept calls and SMS messages, especially password reset codes and one-time passcodes, so the account linked to that number can be accessed.
How SIM Card Hijacking Works
SIM card hijacking is not a device hack in the usual sense, it is a takeover of the phone number itself. Once the number is moved to an attacker-controlled SIM or eSIM, calls and SMS messages can be delivered to the wrong device, which makes the number a weak point for any account recovery process that still depends on texted codes.
The technique works because the mobile number has become a login-adjacent trust anchor for many services. If a carrier is persuaded to transfer the number, the attacker can use that trust to receive one-time passcodes, reset links, and verification calls without needing the victim’s phone.
Why It Is Dangerous
The main danger is that control of the number can become control of the account. That matters most when SMS is used for password resets or multi-factor authentication, because the attacker does not need the original password if the recovery path is weak.
This also creates a broad exposure window. A hijacked number can be used to reset email, banking, crypto, or enterprise accounts, and the compromise may look legitimate to the service because the verification step still succeeds from the attacker’s side.
For a practical guide to the attack path, carrier-side protections, and why organisations should move away from SMS OTP where possible, see the SIM Swap Fraud Guide.
How Organisations Check Exposure
Exposure starts with knowing which accounts still rely on a mobile number for recovery or second-factor delivery. Inventory should cover customer, employee, administrator, and high-value financial accounts, because the risk is not limited to one user population.
It is also important to check where the number is operationally exposed. Publicly visible contact details, weak carrier recovery procedures, and any service that allows SMS-based password reset all increase the chance that number takeover becomes account takeover.
For teams mapping mobile compromise patterns to detection and response workflows, the MITRE ATT&CK for Mobile Guide helps place SIM card swap activity in a broader mobile threat context.
Remediation and Safer Authentication Choices
When SIM hijacking is suspected, the first priority is to restore control of the number through the carrier and then secure the accounts that depended on it. After that, the safer long-term choice is to replace SMS recovery and SMS OTP with phishing-resistant authentication or another stronger recovery path.
Organisations should treat the mobile number as a recovery dependency, not as proof of identity. That means reducing reliance on text messages for privileged or high-value accounts, and using stronger controls where account recovery or step-up verification matters most.
For mobile-network context that can influence how number-based trust is abused, the 5G Security Guide provides a useful systems-level view.
Detection and Post-Compromise Review
Detection usually starts with the signs of a silent channel change: loss of service, unexpected SIM or eSIM activation, failed SMS delivery, or account alerts that suddenly arrive on a different device. Those indicators should be treated as potential compromise until the carrier and account owners confirm otherwise.
After a suspected hijack, review every account that used the number for verification or recovery. That review should focus on whether passwords, recovery methods, backup codes, session tokens, and linked email addresses need to be changed, because the number may have been used to cross into other identities and services.
For mobile detection engineering and threat mapping, the MITRE ATT&CK for Mobile Guide also supports post-incident analysis of mobile attack behavior.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-63, CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1451 — SIM Card Swap | Covers mobile adversary technique that hijacks a phone number through carrier processes |
| Recommendation — Map suspected number-takeover activity to T1451 and hunt for linked account-recovery abuse. | ||
| NIST SP 800-63 | IAL2 — Identity Assurance Level 2 | Relevant where SMS recovery is used in identity proofing and authenticator recovery |
| Recommendation — Replace SMS-based recovery with stronger authenticator and recovery assurance choices. | ||
| CIS Controls v8 | CIS-5 — Account Management | Applies because hijacked numbers can drive account recovery and unauthorized account access |
| Recommendation — Review and restrict account recovery paths that depend on phone-number possession. | ||
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | Applies when SMS-based number control is used as part of user authentication flows |
| IA-5 — Authenticator Management | Applies because password resets and OTP delivery depend on authenticator lifecycle control | |
| Recommendation — Use stronger user authentication than SMS-mediated verification for sensitive access. Rotate and reissue authenticators after suspected number-based account compromise. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org