How it works
Through social engineering, an insider, or a compromised carrier account, the number is moved to a SIM the attacker controls. Calls and SMS then arrive at the attacker's device, and any service using the number for authentication or recovery follows.
Why a phone number became a master key
A phone number was never designed to identify a person. It identifies a subscription — a billing relationship that can be transferred, reassigned or recycled, and which a carrier employee can move between devices in the course of ordinary customer service.
The security industry nonetheless built an enormous amount of authentication on top of it, because it was convenient and nearly universal. SMS one-time codes, voice callbacks and "we texted a link to the number on file" all treat possession of a number as evidence of identity.
The consequence is a single point of failure that sits outside the user's control and outside the control of every service depending on it. If an attacker obtains the number, they do not need to defeat any individual account. They walk through the recovery flow of each one in turn, and each will helpfully send the proof of identity directly to them.
This is what makes SIM swap disproportionately damaging relative to its technical sophistication, which is close to zero. There is no exploit. The system is being used exactly as designed, by someone who is not the intended subscriber.
How the transfer happens
There are four routes, and they differ in what a defender can influence.
The most common is social engineering of carrier support. The attacker calls, claims to be the subscriber, and requests the number be moved to a new SIM — typically explaining a lost or damaged handset. The verification asked for is usually knowledge-based: date of birth, address, the last four digits of a payment card, recent call details. Almost all of this is available from breach data, public records or the victim's own social media, which means the verification is testing research rather than identity.
The second is a port-out to a different carrier. Number portability exists so customers can change provider without losing their number, and the process is deliberately low-friction. An attacker initiating a port supplies account details and the number transfers, often with the losing carrier notifying only after the fact.
The third is an insider. Carrier retail and support staff have the tooling to reassign numbers, and there is a documented market for that access. This defeats every control based on convincing the carrier, because the carrier employee is the attacker or is being paid by them.
The fourth is compromise of the carrier account itself. If the online portal is protected by a reused password and SMS recovery, an attacker who already has credentials can perform the swap without speaking to anyone.
The chain after the number moves
The swap is the beginning. What follows is a rapid sequence through every account tied to the number, and the order is deliberate.
Email usually comes first, because email is the recovery mechanism for everything else. Once the attacker controls the mailbox, the phone number stops mattering — the mailbox alone is sufficient for most other resets.
Financial and cryptocurrency accounts follow, since these are the monetisation target and frequently the reason the victim was selected in the first place. Exchange accounts are a recurring target precisely because transfers are irreversible.
Social and messaging accounts are taken both for their own value and to extend the attack, since messages from a genuine account to that person's contacts are unusually persuasive.
The whole sequence often completes within an hour, and it is deliberately timed. Swaps disproportionately occur late at night and at weekends, because the victim is asleep, carrier support is thin, and the window before anyone notices lost service is at its widest.
What the victim sees
The signal is unusually clear and unusually easy to misread. Cellular service stops — no bars, no calls, no messages — while wifi continues to work normally.
That symptom is indistinguishable from an ordinary network fault, which is exactly why it succeeds. The reasonable reaction is to assume a carrier outage and wait, and waiting is the worst response available. The correct interpretation of sudden, unexplained service loss on a working handset is that it may be a swap in progress, and the correct action is to contact the carrier immediately through another line.
Secondary signals arrive if the victim still has email access on another device: password reset notifications, new-device sign-in alerts, or carrier confirmations of changes they did not request.
Protecting an individual
Controls in rough order of effect:
- Remove SMS and voice as authentication factors on anything of value. This is the only measure that makes the swap largely irrelevant rather than merely harder — if the number authenticates nothing, taking it accomplishes little.
- Use a hardware security key or an authenticator app instead. Passkeys are stronger still, being both phishing-resistant and unrelated to the number.
- Set a port-freeze and a distinct account PIN with the carrier. The PIN must not be derived from anything discoverable — not a birth year, address number or card digits.
- Detach the number from account recovery wherever the service permits, and store recovery codes offline. A number left on the account as a "backup" is a backup path for the attacker too.
- Use a dedicated email address for financial accounts that is not published anywhere and not recoverable by phone.
- Reduce what is publicly available. Knowledge-based verification is defeated by research, so every detail a carrier might ask about that appears on a public profile is a weakened control.
What services should do
The burden should not sit with the user, and there is a great deal a service can do without waiting for carriers to reform.
Stop treating a number as an identity. It is a delivery channel with a known transfer risk, and it should be weighted accordingly in any risk decision rather than accepted as proof.
Where SMS remains as a fallback, treat a recent number change as a strong negative signal. Carriers expose SIM-change and port recency through commercial interfaces precisely for this purpose. An authentication or recovery attempt on a number that changed hands hours ago deserves to fail or to escalate, not to succeed silently.
Impose a delay and out-of-band notification on consequential recovery. A hold on withdrawals following a credential or factor change, announced to every channel on the account including email and in-app, converts an hour-long attack into one the victim has a chance to interrupt.
Notify on a different channel than the one being changed. Confirming a phone-number change by SMS to the new number is a notification the attacker receives.
And offer account-level options that let a user decline phone-based recovery entirely. Many services still treat a number as mandatory, which means the most security-conscious users cannot remove the weakest link even when they understand it.
Responding to a swap in progress
Speed matters more than precision, because the attacker is working through a list.
Contact the carrier from another line and have the number restored and the account locked. Then move to email first rather than to the most valuable account — email is the recovery channel for everything else, and regaining it closes the path the attacker is using.
After that, revoke sessions rather than only changing passwords. A password change does not necessarily invalidate an existing session, and the attacker may hold one. Then work through accounts in order of consequence, replacing SMS factors as you go rather than restoring them.
Finally, preserve the evidence. Carrier records of who authorised the change, at what time and through which channel are the basis of any subsequent complaint or claim, and they are not always retained indefinitely.
Also known as
What defenders may observe
- Cellular service stops abruptly with no coverage explanation
- Carrier notifications about a SIM change, port request or account update
- Password reset messages for accounts the user did not attempt to access
- Logins succeed from unfamiliar devices immediately after service loss
- Account recovery completes without the user initiating it
Prevention and mitigation
- Remove SMS and voice from authentication for anything valuable
- Set a carrier port-freeze and a separate account PIN not derived from personal data
- Use an authenticator app or hardware key, and keep recovery codes offline
- Detach the phone number from account recovery where the service allows it
- Alert out of band when recovery details change
- Treat a number change as a trigger to re-verify, not merely to notify
Initial response priorities
- Revoke sessions and reset the affected authentication factors.
- Review identity-provider and mailbox audit logs.
- Verify sensitive requests through a separate trusted channel.
Use your approved incident-response plan and adapt decisions to your environment. This is educational guidance, not a substitute for live incident leadership.