Mobile Communications Protection for High-Risk Individuals Guide: Channels, Carrier Accounts and Messaging Controls

For people likely to be singled out by capable attackers, the mobile network itself has to be treated as untrusted: ordinary calls and SMS can be intercepted, redirected or taken over without the phone ever being hacked. CISA published its mobile communications best practice guidance in December 2024 for highly targeted individuals, after espionage against commercial telecommunications infrastructure showed how much an attacker inside a carrier can see. This guide goes below the device layer covered in the Executive and VIP Device Protection Guide and deals with the communications themselves: which channels protect content and which do not, how to lock down carrier and messaging accounts, how to verify the person at the other end, and how to detect quiet takeovers such as linked devices. It is for security teams running a protected tier for executives, officials, journalists or negotiators.

Key takeaways

• Assume the carrier path is readable. SMS, ordinary voice calls and call records pass through infrastructure the user does not control, so sensitive content belongs only in end-to-end encrypted apps.
• The phone number is an identifier, not a credential. Remove it from authentication and account recovery wherever possible, and protect it with a carrier PIN for the cases that remain.
• Lock the messaging accounts as well as the devices. Registration lock, two-step verification PINs and linked device audits stop an attacker re-registering or silently mirroring an account.
• Verify keys for the conversations that matter. Signal safety numbers and iMessage Contact Key Verification turn "encrypted" into "encrypted to the right person".
• Stop silent downgrades. Turn off SMS fallback, block 2G where the platform allows it and train people to notice when a chat drops out of its encrypted mode.

Why the network is the threat, not just the phone

Most mobile security programmes concentrate on the handset: patching, hardening modes and malware. For highly targeted people that is necessary but not sufficient. An attacker with access to a telecommunications provider, a signalling interconnect or a rogue base station can collect content and metadata from channels that were never designed to resist that position. The intrusions into US carriers described in the 2024 to 2025 telecommunications intrusions breach analysis involved stolen device credentials, captured TACACS and RADIUS secrets and packet capture across network devices, with access in one case lasting more than three years.

ATT&CK once had specific mobile techniques for SS7 call redirection, rogue base stations and device communication manipulation; in ATT&CK v20 they are deprecated or revoked, so map those risks to the controls above rather than to the old IDs. For the signalling layer see the SS7 and Diameter Signalling Security Guide, and for the carrier side the Telecom Network Security Guide.

Channel by channel: what actually protects content

People choose channels by habit. Give them a simple rule for each one and say which classes of conversation it is approved for. CISA's guidance is explicit that highly targeted users should use end-to-end encrypted messaging, avoid SMS for authentication and, on Android, use RCS only when end-to-end encryption is on.

• Metadata still leaks: end-to-end encryption hides content, not the fact that two numbers talked, when and from where. Where the relationship itself is sensitive, meet in person.
• Backups are part of the channel: a chat that is end-to-end encrypted in transit but copied to a cloud backup in a recoverable form is only as safe as that backup. Apple's Advanced Data Protection extends end-to-end encryption to most iCloud data, including iCloud Backup, Photos and Notes; it requires two-factor authentication and a recovery contact or a 28-character recovery key, and Managed Apple Accounts are not eligible.
• Records retention: disappearing messages conflict with regulatory record-keeping in some sectors. Decide which conversations are records before approving a channel. See the Enterprise Messaging Retention and Off-Channel Communications Guide.

For how the protocols work see the End-to-End Encryption and Messaging Protocols Guide and the Securing Messaging Apps Guide.

Locking down the carrier account

The mobile number is the weakest identifier most people own, because the carrier can be persuaded to move it. CISA recommends a PIN or passcode on the mobile account. Treat the carrier account as a privileged account belonging to the protected person.

1. Set an account PIN or passcode with the carrier that is required for any change in store, by phone or online. Use a random value stored in the password manager, not a birth date.
2. Turn on port-out or number lock where the carrier offers it, so the number cannot be transferred to another provider without first removing the lock from the authenticated account.
3. Protect the carrier's online account with the strongest sign-in method it supports and remove SMS to the same number as its own recovery method, which is circular.
4. Register an alert channel that is not the phone number itself (for example a corporate email address monitored by the protected tier team) for SIM change and port requests.
5. Use corporate accounts for corporate lines so the organisation, not the individual, controls who can request SIM changes, and restrict the authorised contacts on the business account to named people.
6. Brief the person that unexplained loss of signal or a "SIM changed" message can mean a swap in progress.

The carrier PIN reduces risk; it does not remove it, because carrier staff can still be socially engineered or insiders can bypass controls. The durable fix is that losing the number should not lose the accounts. See the SIM Swap Fraud Guide.

Taking the phone number out of authentication

NIST SP 800-63B-4 classes out-of-band authentication over the public switched telephone network (SMS or voice) as a restricted authenticator, lists device swap, SIM change and number porting as risk indicators verifiers should consider, and states that out-of-band authentication is not phishing-resistant. At AAL2 verifiers must offer at least one phishing-resistant option, and AAL3 requires cryptographic authenticators. CISA's advice for highly targeted users is to enable FIDO phishing-resistant authentication and avoid SMS-based MFA.

• Corporate identity provider: FIDO2 security keys or device-bound passkeys only for the protected tier, with SMS and voice methods removed from the user object, not just deprioritised. See the Phishing-Resistant MFA Guide.
• Personal email and cloud accounts: security keys or passkeys, and SMS removed from recovery. Personal accounts receive many targeted lures and often hold the same contacts and documents.
• Messaging accounts: these are registered by phone number, which is why the next section matters: the app's own PIN is what stops a number takeover becoming an account takeover.
• Recovery processes: any help desk or vendor that can reset an account by calling the person's number should instead call back through a pre-registered alternative or require in-person or video verification. See the Account Recovery and Help Desk Security Guide.

The 2022 SMS phishing campaign described in the Twilio breach analysis shows both sides of the problem: phishing kits relayed one-time codes in real time, and because Signal used Twilio for phone number verification, about 1,900 Signal users' numbers and SMS verification codes were exposed to possible re-registration attempts.

Hardening the messaging accounts

An end-to-end encrypted app protects content in transit. The account itself can still be taken over or mirrored. Configure each approved app on day one, in person, and record the settings.

Linked device abuse

In February 2025 Google's threat intelligence team reported state-backed campaigns that abused Signal's linked devices feature. Victims were sent malicious QR codes, or legitimate-looking group invite pages that redirected to a device-linking link instead of a group, so that their account was linked to an attacker-controlled instance and new messages synced to it in real time. In close-access cases, attackers with brief physical access to an unlocked phone linked it themselves. Google described this as a low-signature form of access because few central detections watch for newly linked devices. Google recommends regular linked device audits, suspicion of any QR code or link presented as a group invite, update or security alert, keeping the app updated and a long alphanumeric screen lock.

Verifying the person, not just the encryption

Signal's safety number is unique to each one-to-one chat; Signal recommends comparing it by scanning each other's QR code, ideally in person, then marking the contact as verified. Signal warns that a change is most often a new phone or reinstall, but frequent or unexpected changes may indicate a problem. Apple's iMessage Contact Key Verification (iOS 17.2, iPadOS 17.2, macOS 14.2 and later on every device signed in to the account, with iCloud Keychain and two-factor authentication) verifies automatically, alerts on errors, and supports manual code comparison or a public verification code. It is not supported with Managed Apple Accounts, so it only applies to personal Apple Accounts. Verify the few contacts the person discusses sensitive matters with.

Device and platform settings that protect communications

The VIP device guide covers hardening modes in general. These are the settings that bear directly on communications.

• Block legacy cellular: Apple Lockdown Mode turns off 2G and 3G support. Android Advanced Protection blocks 2G on supported devices; Google warns this can leave the phone without service where only 2G exists, which matters for some travel destinations.
• Disable SMS fallback on iPhone: CISA advises turning off sending as SMS when iMessage is unavailable, so a message never silently leaves the encrypted channel.
• Protect DNS and web traffic: CISA recommends encrypted DNS and iCloud Private Relay on iPhone and, on Android, protected DNS, Chrome set to always use secure connections, Enhanced Protection in Safe Browsing and Google Play Protect kept on. CISA advises avoiding personal VPNs, which shift trust to the VPN provider. See the Encrypted DNS Enterprise Guide.
• Scam and link warnings: Android Advanced Protection requires scam detection in supported chat apps and warns about links from unknown senders in Google Messages.
• Microphone, camera and location: restrict app permissions, as CISA recommends, so a compromised or over-privileged app cannot collect calls or movements (ATT&CK T1429 Audio Capture, T1430 Location Tracking).

See the iOS and iPadOS Enterprise Security Guide and the Android Enterprise Security Guide.

Choosing the right level of protection

Not everyone in a protected tier needs the same settings, and the friction is real: Lockdown Mode breaks some web pages, disappearing messages break record-keeping, and 2G blocking can strand a traveller.

Small vs large organisations: a small organisation protecting a handful of people can do everything above by hand at a single in-person session with a written checklist, repeated every quarter. A large organisation should put the tier in its own MDM group, automate identity-side checks (no SMS methods registered, keys enrolled), and add carrier account controls to the corporate telecoms contract so that SIM changes on protected lines require a named approver.

Rolling it out

1. Agree scope and channels: name the people in scope and publish a one-page channel rule (what may go over SMS and voice, which E2EE app is approved, which conversations are records).
2. Identity first: enrol security keys, remove SMS and voice methods from corporate and willing personal accounts, and fix recovery paths. Test by attempting a recovery through the help desk.
3. Carrier accounts: set PINs and port locks, move alerts to a monitored channel, and test by asking the carrier what it would need to change the SIM.
4. Messaging accounts: in person, set registration lock or two-step PINs, check linked devices, enable encrypted backups or Advanced Data Protection, and verify keys with the agreed contacts.
5. Pilot the device settings: two or three volunteers run Lockdown Mode or Advanced Protection and SMS fallback off for two weeks; log every broken workflow. Rolling back is turning the setting off on the device, which is immediate; record why and set a date to retry.
6. Full rollout and drills: extend to the tier, then run a tabletop exercise for a suspected SIM swap and one for an unknown linked device.

Detection and measurement

• Identity signals: alerts to the tier team, not just logs, for new authenticator registrations, recovery attempts and any SMS or voice method added to a protected account.
• Carrier signals: SIM change and port request notifications routed to the monitored channel; sudden loss of cellular service reported by the person.
• Messaging signals: safety number or verification code changes for key contacts, and unknown linked devices found in the weekly check. These are self-reported, so make reporting easy.
• Downgrade signals: chats observed in SMS mode, and travel to areas where 2G blocking prevents service.

Framework mapping

Common failure patterns

• Encrypted app, SMS recovery: the person uses Signal for everything but the email account that controls their cloud backup still resets by SMS.
• No registration lock: a SIM swap gives the attacker the number, and the messaging account follows because no app PIN was set.
• Never checking linked devices: a mirrored session runs for months because nobody opened the linked devices screen after a convincing "group invite" QR code.
• Silent downgrade: SMS fallback left on, or an RCS chat that dropped to SMS while travelling, carries the one message that mattered.
• Trusting the caller ID: a voice call that looks like it comes from a colleague's number is acted on without a call back through a known channel. See the Vishing and Smishing Guide.
• Personal lines out of scope: the corporate line is locked down while the personal number, which family, journalists and counterparts actually use, has no carrier PIN.

Practitioner checklist

• Publish a one-page channel rule for the protected tier: approved E2EE app, what may go over SMS and voice, and which conversations are records.
• Remove SMS and voice from authentication and recovery on all corporate accounts of members and delegates; enforce FIDO keys or passkeys.
• Set a carrier PIN and port lock on every protected line, corporate and personal, with alerts to a monitored channel.
• Turn on Signal Registration Lock or WhatsApp two-step verification for every approved messaging account.
• Run a weekly linked device check and make "unknown device" a one-tap report to the tier team.
• Verify safety numbers or iMessage contact keys in person with each member's named key contacts.
• Turn off SMS fallback on iPhone and block 2G through Lockdown Mode or Android Advanced Protection where travel allows.
• Enable Advanced Data Protection or encrypted chat backups so backups do not undo end-to-end encryption.
• Exercise a suspected SIM swap and an unknown linked device scenario at least once a year.

Standards and references

• CISA: Mobile Communications Best Practice Guidance
• NIST: SP 800-63B-4 Authentication and Authenticator Management
• Signal: What is a safety number and why do I see that it changed?
• Apple: About iMessage Contact Key Verification
• Apple: How to turn on Advanced Data Protection for iCloud
• Google: Android Advanced Protection
• Google Threat Intelligence Group: Signal linked devices targeting
• Google: End-to-end encryption in Google Messages

Related NHI Mgmt Group resources: Executive and VIP Device Protection Guide · SIM Swap Fraud Guide · Securing Messaging Apps Guide · Mobile Spyware Infection Response Playbook · Commercial Spyware Guide