SMS redirect is the diversion of text messages from their intended recipient to another number or messaging endpoint. In security practice it usually involves abuse of mobile carrier features, account takeover, or porting and SIM swap activity, so one-time passcodes sent by SMS are weak protection when redirect paths exist.
What SMS Redirect Means in Practice
SMS redirect is not just message forwarding, it is a control failure that lets an attacker or insider shift a text from the intended recipient to another endpoint. In security programs, that matters because SMS is often treated as a delivery channel for verification codes, alerts, and account recovery messages, even though the channel can be subverted.
The key distinction is that the message itself is usually unchanged, but the trust relationship around delivery is broken. That makes SMS redirect especially dangerous in identity-dependent workflows, where possession of a phone number is assumed to represent possession by the legitimate user.
How SMS Redirect Happens
SMS redirect commonly appears through carrier-side account changes, porting abuse, SIM swap activity, or manipulation of message routing features. In some cases, the attacker does not need to read the victim’s inbox directly; it is enough to reroute the message stream long enough to intercept codes or confirmations.
Because the abuse may occur outside the victim’s device, endpoint controls alone do not fully address it. The weakness sits in the telecom and account-control layer, which means the attack path can remain invisible to the organisation that relies on the SMS message.
Why SMS Redirect Undermines Authentication
SMS redirect becomes most serious when SMS is used as an authenticator or recovery factor. A redirected code can defeat one-time-password workflows, reset flows, and “confirm via text” checks, turning a supposedly second factor into a transferable access path.
This is why SMS should be viewed as a weak channel for high-value access decisions. If an adversary can redirect the number, they can often bypass the assumption that the message recipient is the authorised user, even when the underlying account password remains unknown.
Organisations should also treat redirect risk as a sign that account recovery and step-up authentication may be too dependent on the phone number alone. A stronger design uses phishing-resistant methods or multiple independent signals instead of assuming SMS delivery proves identity.
Detection and Response for Suspected SMS Redirect
Signs of SMS redirect often show up as missing or delayed messages, unexpected carrier changes, failed login notices that the user never received, or reports that security codes arrived on a different device. If a redirect is suspected, the incident should be treated as potential account compromise, not as a simple telecom inconvenience.
Response should focus on confirming whether message delivery paths were altered, whether any accounts used SMS for login or recovery, and whether other channels were abused after the redirect began. Where the attack has succeeded, the organisation should review authentication events, session activity, and any changes made while the attacker may have controlled the text channel.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5, NIST SP 800-63 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST SP 800-53 Rev 5 | IA-2 — Identification and Authentication (Organizational Users) | SMS redirect weakens user authentication pathways that rely on text-delivered codes. |
| IA-5 — Authenticator Management | SMS redirect directly affects the lifecycle and handling of SMS-based authenticators and recovery codes. | |
| Recommendation — Reduce reliance on SMS by enforcing stronger user authentication methods for privileged access. Manage authenticators so SMS is not the sole or primary recovery factor for sensitive accounts. | ||
| NIST SP 800-63 | Digital Identity Guidelines | The topic centers on the assurance limits of SMS as a digital authenticator and recovery mechanism. |
| Recommendation — Use phishing-resistant authenticators instead of SMS for high assurance identity transactions. | ||
| NIST CSF 2.0 | PR.AA-05 — Identity Management, Authentication and Access Control | SMS redirect creates access-control exposure when messaging is used to verify user identity. |
| Recommendation — Strengthen authentication and recovery controls so SMS delivery is not a trusted access decision. | ||
| MITRE ATT&CK | T1098 — Account Manipulation | Redirecting SMS often accompanies account changes that alter where verification messages are delivered. |
| Recommendation — Investigate account-setting changes that could redirect verification messages during compromise hunting. | ||
Practitioner Guidance
Why practitioners should care: SMS redirect matters because it can collapse both authentication and recovery if SMS is trusted too much. The practical issue is not the message transport itself, but the business process built on top of it. If a phone number is treated as a durable proof of user control, the redirect path becomes an identity takeover path.
What to watch for: Monitor for sudden delivery anomalies, carrier change notifications, unexplained password resets, and user reports that codes are arriving elsewhere or not at all. Those are often early indicators that the number, the SIM, or the message route has been hijacked.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 3, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org