SIM Swapping: Stealing the Phone Number to Steal the Account

SIM swapping (SIM-swap fraud, SIM hijacking; the carrier-to-carrier variant is port-out fraud) defeats SMS- and voice-based MFA by moving the victim’s phone number onto an attacker-controlled SIM. The attacker gathers personal data — from phishing, breach dumps or an insider — and impersonates the victim to the mobile carrier by phone, in-store, or by bribing a telco employee. Once the number ports, the attacker receives the victim’s calls and texts (and the victim loses service), intercepting one-time passcodes and account-recovery messages for email, banking and especially cryptocurrency accounts. MITRE ATT&CK tracks it as T1451, SIM Card Swap.

How It Works

The attack is social engineering against the carrier, not a technical exploit of the phone. With enough stolen identifiers to pass a help-desk check — or a complicit insider with access to the provisioning platform — the attacker has the number reassigned to a new SIM. From that moment, every SMS OTP and voice-call verification flows to them, and they walk through password-reset and MFA prompts for the victim’s accounts. T1451

MITRE ATT&CK Mapping

Detection & Mitigation

• Replace SMS/voice OTP with phishing-resistant MFA (FIDO2/WebAuthn hardware keys or passkeys) for high-value accounts; use authenticator apps or hardware tokens for recovery, never SMS.
• Set a carrier account PIN/passcode and enable a port-freeze or number-lock; the 2023 U.S. FCC order (FCC 23-95) now requires secure customer authentication before SIM changes and ports, plus failed-attempt notifications.
• Treat a user’s sudden, unexplained loss of mobile signal paired with near-simultaneous account-recovery events as an incident; monitor enrolled devices via EMM/MDM for unexpected SIM or carrier changes.
• Minimise the use of a phone number as an identity anchor in recovery flows for privileged and finance staff.