SIM Card Swapping

How SIM Card Swapping Works

SIM card swapping, also called sim swap fraud or number port-out fraud, abuses the mobile carrier’s control plane rather than the handset itself. Once the number is moved to a new SIM or eSIM, calls and SMS messages can be redirected to the attacker, including one-time codes used for account recovery and multi-factor authentication.

The key security break is trust in the phone number as an authenticator. A number may look stable to the victim, but if the carrier accepts a fraudulent transfer request, the attacker can inherit the message stream and disrupt the victim’s access to accounts that still rely on SMS delivery.

Why SIM Swapping Is Dangerous

The danger is not limited to missed calls. A successful swap can give an attacker a short but highly valuable window to reset passwords, intercept recovery links, approve logins, and lock the victim out of services that still treat the phone number as proof of control. That makes the attack especially effective against consumer accounts, email, crypto platforms, and support workflows that still accept SMS as a recovery factor.

It is also a trust abuse problem. The attacker does not need to defeat the target’s device security if they can convince or bypass the carrier. In practice, the weakest point is often identity verification at the telecom layer, not the phone itself.

For a deeper operational view of the attack pattern and countermeasures, see the SIM Swap Fraud Guide.

How Organisations Check Exposure

Exposure starts with knowing where SMS is still used for account recovery, step-up authentication, or help-desk verification. Organisations should inventory all systems that send one-time codes by text, identify any privileged or high-value accounts still dependent on a phone number, and review whether carriers or telecom providers are part of the trust boundary.

They should also look for operational signs that a number has been moved, such as sudden loss of service, unexpected device reactivation, or a user reporting that messages stopped arriving. Vendor advisories, carrier controls, and fraud-prevention guidance matter here because the practical exposure is often determined by how the mobile provider handles porting, PINs, freezes, and recovery workflows.

SIM swap activity also maps cleanly to mobile attack tradecraft. The MITRE ATT&CK for Mobile Guide helps teams connect this abuse pattern to mobile tactics, detections, and mitigations.

Remediation and Compensating Controls

The strongest long-term control is to reduce dependence on SMS for authentication and recovery. Where possible, move critical accounts to phishing-resistant authenticators, stronger recovery processes, and out-of-band verification methods that do not rely on possession of a phone number alone.

If SMS cannot be removed immediately, compensate by tightening carrier-side protections, such as number port protection, port-out PINs, SIM locks, and stricter account recovery rules. Organisations should also apply stronger admin workflows for high-value users, because a single successful swap can become a broad account takeover path if help-desk processes are weak.

For organisations managing telecom, mobile, or private network dependencies, the 5G Security Guide gives useful context on how telecom trust models and provisioning controls affect exposure.

Detection and Post-Compromise Review

Detection should focus on both carrier-side and account-side signals. Sudden loss of service, repeated failed OTP delivery, unexplained MFA resets, login attempts from unfamiliar locations, or changes to recovery settings can all indicate that a number transfer has been abused or is in progress.

After a suspected swap, the incident review should assume that any SMS-delivered code, session, or recovery path may have been exposed. Teams should review recent authentication events, password resets, help-desk changes, and any linked accounts that used the phone number for recovery. Where the compromise is part of a broader campaign, threat reporting can help distinguish isolated fraud from repeated operational tradecraft, as seen in the Lapsus$ Threat Actor Profile.

Risk and Threat Considerations

SIM card swapping is dangerous because it turns a telecom support process into an account takeover path. The attacker does not need malware on the victim’s phone if they can redirect the number and intercept SMS-based trust signals.

Failure mechanism: Weak carrier identity verification, support abuse, or porting fraud allows the attacker to transfer the number and hijack message delivery before the victim notices.

Impact: The attacker can capture recovery codes, reset credentials, seize accounts, and create downstream lockout or fraud across any service that still trusts SMS.

Practitioner Guidance

Why practitioners should care: Treat sim swapping as an identity and recovery design problem, not just a telecom fraud issue. If a critical workflow still depends on SMS, the organisation has already created a high-leverage takeover path.

Governance implication: Assign ownership for number-based recovery, carrier protections, and help-desk verification standards so that mobile number changes and account recovery are reviewed as security events, not routine admin tasks.

Practitioner takeaway: The safest posture is to make the phone number a contact channel, not a primary proof of control.

Related resources from NHI Mgmt Group

• Why does SIM swapping create such a high impact credential theft risk for organisations?
• How should organisations reduce SIM swapping risk in mobile authentication flows?
• Why do SIM swapping attacks succeed even when users have basic password hygiene and MFA?
• Who is accountable when an attacker bypasses MFA through SIM swapping?