Mobile T1451 SIM Card Swap: How It Reaches Android and iOS Devices and How to Block It

SIM Card Swap (T1451) is an adversary persuading or bribing a mobile carrier to move a victim's phone number to a SIM the adversary controls, so that calls and text messages, including one-time passcodes, go to the adversary instead. MITRE ATT&CK for Mobile v20 lists T1451 under Initial Access for Android and iOS. The attack happens at the carrier, not on the handset, so the platform makes little difference: the device simply loses service. The damage lands on every account that trusts that phone number. This guide is for identity, mobile and fraud teams who need to cut that trust, spot a swap quickly and respond. For the consumer fraud angle see the SIM Swap Fraud Guide; this page stays on the ATT&CK technique and enterprise controls.

Key takeaways

• The handset is not the target, the number is. ATT&CK describes the adversary impersonating the victim to the carrier; once the number moves, the victim loses calls and texts and the adversary receives them.
• SMS and voice codes are the payoff. ATT&CK notes adversaries use intercepted SMS to log into accounts that use SMS-based authentication. NIST SP 800-63B-4 classes PSTN out-of-band authentication as restricted and not phishing-resistant.
• Real groups use it against enterprises. ATT&CK records Scattered Spider (G1015) using SIM swapping to bypass MFA and LAPSUS$ (G1004) using it to gain access to victims' devices.
• Two ATT&CK mitigations, both practical. Enterprise Policy (M1012) says to monitor for SIM card changes in EMM or MDM; User Guidance (M1011) says to use non-SMS authenticators and enable carrier SIM swap protections.
• Carriers now carry obligations in the US. The FCC's 2023 rule requires wireless providers to authenticate customers securely before SIM changes, notify them and offer free account locks.

How the technique works, at the level defenders need

ATT&CK describes three stages: the adversary gathers information about the victim through phishing, social engineering, data breaches or other sources; impersonates the victim to the carrier to request a transfer of the number to an adversary-controlled SIM; and then receives the victim's calls and texts. The FBI's February 2022 public service announcement adds two other routes: bribing a carrier employee, and phishing carrier staff into installing malware that gives access to carrier systems. The FBI reported 320 SIM swapping complaints with adjusted losses of about 12 million US dollars from January 2018 to December 2020, and 1,611 complaints with more than 68 million US dollars of losses in 2021.

What it means for Android and iOS devices

ATT&CK lists both platforms because both depend on the carrier for the phone number. Neither platform setting prevents the carrier from moving the number, so device controls focus on detection and on making the number matter less.

• What the user sees: the FBI describes calls, texts and other data being diverted to the criminal's device. In practice the victim's phone shows no service or emergency calls only while it otherwise looks normal, and the FBI advises watching for unexpected changes in SMS connectivity.
• What MDM can see: ATT&CK's M1012 says enterprises should monitor for SIM card changes through EMM or MDM. ATT&CK's DET0658 analytic correlates host status and settings from the Android Enterprise device policy controller or Apple MDM device information queries with identity provider sign-in events. A SIM or carrier change on a managed device followed by sign-ins from a new device is the pattern to alert on.
• Platform parity: ATT&CK gives DET0658 an Android analytic (device policy controller status and settings) and an iOS analytic (Apple MDM device information and security queries). What each MDM reports about the SIM varies by product and OS version, so confirm in your own MDM which field changes on a swap. On both platforms the defence that matters most is removing SMS and voice from authentication.

Real cases recorded by ATT&CK

• Scattered Spider (G1015): ATT&CK records the group using SIM swapping to bypass MFA and to maintain persistence on mobile carrier networks and SIM cards, citing Mandiant, CrowdStrike and Check Point reporting. See the Scattered Spider Threat Actor Profile.
• LAPSUS$ (G1004): ATT&CK records SIM swapping to gain access to victims' devices. Microsoft's March 2022 analysis of DEV-0537 describes a SIM swap used to take over a user's phone number before signing into the corporate network, so the actors could handle phone-based authentication prompts. See the Lapsus$ Threat Actor Profile.

Both groups also relied heavily on help desk social engineering, so SIM swap defences and help desk verification belong in the same programme. See the Account Recovery and Help Desk Security Guide.

Prevention: removing the value of the phone number

The US FCC order Protecting Consumers from SIM-Swap and Port-Out Fraud (FCC 23-95, published in the Federal Register on 8 December 2023) requires wireless providers to use secure authentication before SIM changes and port-outs, notify customers immediately of such requests, offer all customers a free option to lock their accounts against them, and keep records of SIM change requests for at least three years. Some provisions had compliance dates that depended on later FCC notices, so check the current status with the FCC. Confirm against the official text before relying on it. These rules help, but they do not remove the need to stop trusting SMS. See the Phishing-Resistant MFA Guide.

Where identity fits

SIM swapping is an identity attack that uses a phone number as a credential. List every place your organisation treats a number as proof: SMS one-time passcodes, voice call approvals, password reset links by text, help desk callbacks to the number on file, and shared or break-glass accounts whose second factor goes to a team phone. Shared numbers are a quiet risk because nobody owns them and a swap may go unnoticed. Replace them with phishing-resistant factors held by named people or with vaulted credentials. See the Authenticator Apps and OTP Guide and the MITRE ATT&CK T1111 Multi-Factor Authentication Interception guide for the Enterprise view.

How to implement

1. Inventory phone trust: query the identity provider for accounts with SMS or voice registered as an authentication or recovery method, starting with administrators.
2. Protect corporate lines: set carrier PINs and locks on every corporate mobile account, and record which carriers support them.
3. Turn on detection: enable SIM or carrier change reporting in MDM, and correlate it with identity provider events such as new device registrations and MFA method changes.
4. Migrate in rings: move privileged users to phishing-resistant MFA first, then high-risk staff, then everyone. Keep SMS as a temporary fallback with a dated removal plan, and keep a tested recovery route for users who lose keys.
5. Remove SMS: disable SMS and voice methods in the identity provider policy once usage is near zero. Roll back for a specific group if a recovery gap appears, rather than for everyone.
6. Rehearse response: run a tabletop on a swapped executive number.

Decision guidance

• If you cannot drop SMS yet: keep it only for low-risk access, add risk checks on SIM change and porting where your provider supports them, and never use it for password reset of privileged accounts.
• Corporate versus personal numbers: corporate lines can be locked and monitored; personal numbers used for work MFA cannot, so prioritise moving those users off SMS.
• Small organisations: carrier locks on company lines and authenticator apps or security keys for email and finance accounts cover most of the risk.

Responding to a suspected SIM swap

• Restore the number: the FBI advises contacting the carrier immediately to regain the number.
• Contain identity: revoke sessions and refresh tokens for the user, remove the phone number as an authentication method, and review MFA registrations and recovery changes made since service was lost.
• Check the money: the FBI advises asking financial institutions to flag suspicious logins and transactions.
• Preserve evidence: carrier account change records, identity provider logs and MDM SIM change events.
• Report: the FBI asks US victims to report to IC3; follow your own notification rules for any data accessed.

Detection and measurement

• SMS dependence: percentage of accounts with SMS or voice as an authentication or recovery method (target near zero for privileged users).
• Carrier lock coverage: percentage of corporate lines with a carrier PIN or lock.
• SIM change alerts: number of MDM SIM change events per month and the share confirmed as expected.
• Time to contain: time from loss of service report to session revocation.
• Shared number accounts: count of accounts whose second factor is a shared phone, trending to zero.

Framework mapping

Common failure patterns

• SMS kept as recovery after MFA upgrades: the strong factor is bypassed by resetting through a text message.
• Help desk resets to the number on file: after a swap, the adversary answers the callback.
• Loss of service treated as a network fault: users wait hours before reporting, which gives the adversary time.
• Shared team phones as second factor: no owner notices a swap.
• No carrier lock on corporate accounts: the cheapest control left unused.

Practitioner checklist

• Report every account with SMS or voice registered for authentication or recovery.
• Move privileged users to phishing-resistant MFA and remove SMS recovery for them.
• Enable carrier PINs and SIM and port-out locks on all corporate lines.
• Alert on MDM SIM or carrier changes correlated with identity events.
• Tell users to report sudden loss of mobile service immediately.
• Stop help desk resets that rely only on a callback to the registered number.
• Replace shared phone second factors with named-person or vaulted alternatives.
• Rehearse the response for a swapped executive number.

Standards and references

• MITRE ATT&CK: SIM Card Swap (T1451)
• NIST: SP 800-63B-4 Authentication and Authenticator Management
• US FCC via Federal Register: Protecting Consumers From SIM-Swap and Port-Out Fraud
• FBI IC3: Public Service Announcement I-020822-PSA on SIM swapping
• Microsoft Security: DEV-0537 criminal actor targeting organizations for data exfiltration and destruction
• MITRE ATT&CK: Scattered Spider (G1015)
• MITRE ATT&CK: LAPSUS$ (G1004)

Related NHI Mgmt Group resources: MITRE ATT&CK for Mobile Guide · SIM Swap Fraud Guide · MFA Fatigue and Bypass Guide · Vishing and Help Desk Social Engineering Awareness Guide