Skip to main content
Identity Authority
Category: Multi-Factor Methods

SIM Swap Attack

Also known as: SIM swapping, SIM hijacking, SIM splitting, port-out scam
Simply put

A SIM swap attack is a form of account takeover fraud in which an attacker convinces or bribes a mobile carrier into transferring a victim's phone number to a SIM card the attacker controls. Once the number is moved, the attacker receives the victim's calls and text messages, including one-time codes sent for account verification. This lets the attacker bypass phone-based security and take over the victim's accounts.

Formal definition

A SIM swap attack is a social-engineering-based account takeover technique that exploits the mobile carrier's number-porting or SIM-reassignment process rather than a cryptographic weakness in an authentication protocol. By deceiving or bribing carrier staff (or exploiting weak carrier identity-verification controls), the attacker reassigns the victim's mobile number to an attacker-held SIM, intercepting SMS- and voice-delivered one-time passcodes. The attack primarily targets possession-factor mechanisms that rely on control of a phone number, and it is most effective against SMS/voice-OTP-based two-factor authentication; it does not compromise the authentication factor itself but subverts the out-of-band delivery channel. This makes phone-number-bound second factors substantially weaker than phishing-resistant possession factors such as FIDO2/WebAuthn authenticators, whose credentials are not transferable via carrier account changes. Note that the specifics of carrier verification and porting controls vary by provider and jurisdiction.

Why it matters

SIM swap attacks matter because they undermine one of the most widely deployed forms of two-factor authentication: SMS- and voice-delivered one-time passcodes. Many organizations still rely on phone-number-bound second factors as their default step-up mechanism, and a successful SIM swap lets an attacker intercept those codes without ever breaking a cryptographic control. The attack exploits the mobile carrier's number-porting and SIM-reassignment process rather than any weakness in the relying party's authentication protocol, which means the vulnerability sits largely outside the direct control of the systems that depend on it.

The consequence is account takeover: once the attacker controls the victim's phone number, phone-based verification steps that were meant to protect account recovery, password resets, and high-value transactions can be turned against the account owner. This is particularly damaging because phone-based factors are frequently positioned as a trusted recovery channel, so compromising the number can cascade across multiple accounts that share the same recovery mechanism.

Because carrier identity-verification and porting controls vary by provider and jurisdiction, the exposure an organization faces is difficult to measure or enforce directly. This drives the broader industry shift toward phishing-resistant possession factors such as FIDO2/WebAuthn authenticators, whose credentials are bound to the authenticator and cannot be transferred through a carrier account change.

Who it's relevant to

IAM engineers and security architects
Those designing authentication and step-up flows should treat SMS- and voice-OTP as a phone-number-bound possession factor that can be subverted by SIM swap without breaking any protocol. Where higher assurance is required, phishing-resistant authenticators such as FIDO2/WebAuthn are typically preferable because their credentials cannot be transferred through a carrier account change. Note that the appropriate factor mix depends on threat model and deployment context.
Account recovery and helpdesk operations
Teams that own password reset and account recovery flows should scrutinize any dependence on phone-number-based verification as a recovery channel, since a hijacked number can cascade into takeover of accounts that share that channel. Consider alternative recovery mechanisms that do not rely solely on control of a phone number.
Fraud and threat detection teams
SIM swap is an account takeover technique, and detection often depends on signals outside the relying party's control, such as recent SIM or device changes. Because carrier porting and verification controls vary by provider and jurisdiction, monitoring for anomalous authentication and recovery behavior is a practical mitigation.
Compliance and risk officers
Those assessing authentication assurance should recognize that phone-number-bound second factors carry residual risk that sits partly with third-party carriers. This is relevant when evaluating whether a control meets a required assurance level and when documenting the limitations of SMS- and voice-based two-factor authentication.

Inside SIM Swap Attack

Number Porting / SIM Reassignment
The core mechanism of the attack, in which an adversary convinces a mobile carrier to transfer a victim's phone number to a SIM or eSIM the attacker controls, redirecting calls and SMS to the attacker's device.
Social Engineering of Carrier Support
The attacker typically impersonates the victim to carrier customer service or retail staff, often using previously leaked or phished personal data to satisfy identity checks and authorize the swap.
SMS OTP Interception
Because SMS-delivered one-time passcodes are a possession-factor delivered over the phone number, gaining control of the number lets the attacker receive these codes and complete authentication or account-recovery challenges.
Account Recovery Abuse
Many services allow the phone number to reset passwords or bypass a primary credential; once the number is controlled, the attacker can trigger recovery flows to take over downstream accounts.
Targeted Assets
Accounts protected by SMS-based 2FA or phone-based recovery, such as email, banking, and cryptocurrency wallets, are common downstream targets after the number is hijacked.

Common questions

Answers to the questions practitioners most commonly ask about SIM Swap Attack.

Is a SIM swap attack a way of breaking the authentication factor itself, or of stealing the credential in transit?
Neither, precisely. A SIM swap attack does not break the cryptography or the authentication factor as a mechanism; it undermines the assumption that a phone number reliably represents a possession factor bound to a specific user. By convincing a mobile carrier to reassign a victim's phone number to an attacker-controlled SIM, the attacker receives SMS one-time passwords or voice-delivered codes intended for the victim. The weakness is in carrier account control processes, not in the OTP algorithm. It is best understood as a takeover of the delivery channel for a possession-based authenticator rather than a compromise of the authenticator's underlying secret.
Does enabling MFA protect against SIM swap attacks?
Not necessarily, and this depends heavily on which MFA factors are in use. If the MFA relies on SMS or voice-delivered one-time passwords, a successful SIM swap can defeat that factor because the attacker now controls the phone number receiving the codes. MFA is only as strong as its weakest enrolled factor. Factors that do not depend on the phone number as a delivery channel, such as FIDO2/WebAuthn authenticators, authenticator-app TOTP, or push-based approvals tied to a device rather than a number, are generally not defeated by a SIM swap in the same way. The presence of MFA alone does not indicate SIM-swap resistance.
How should an IAM architect reduce reliance on SMS-based OTP without disrupting existing users?
In most deployments this is approached as a phased migration rather than an abrupt cutover. A common pattern is to offer stronger factors such as FIDO2/WebAuthn or authenticator-app TOTP as opt-in alternatives, encourage enrollment through user prompts, and progressively restrict SMS to a fallback or recovery role rather than a primary factor. Some organizations gate high-risk operations behind phishing-resistant factors while retaining SMS for lower-risk flows during the transition. The exact sequencing depends on the user population, regulatory constraints, and the capabilities of the identity provider.
What signals can help detect a SIM swap in a risk-based or adaptive authentication flow?
Depending on the identity platform and available integrations, signals may include SIM-change or carrier-porting indicators (offered by some carriers and telecom data providers), a sudden change in device or SIM identifiers, geolocation or velocity anomalies, and a pattern of account-recovery attempts shortly after a number change. When such signals are available, they are typically fed into a policy decision point to trigger step-up authentication or block sensitive actions. Availability and reliability of carrier-derived signals vary by region and provider, so these should be treated as supplementary rather than definitive.
How should account recovery flows be designed so they are not the weak link exploited after a SIM swap?
Recovery flows are frequently the actual target, because an attacker who controls the phone number may attempt password or MFA resets. A common mitigation is to avoid using the phone number as the sole recovery channel and to require a second, independent proof for high-impact recovery, such as a pre-registered FIDO2 authenticator, backup codes, or an identity-verification step. Some organizations impose a delay or notification window on sensitive recovery actions so the legitimate user can intervene. The appropriate design depends on the assurance level required and applicable compliance obligations.
What can IGA and access review processes contribute to limiting SIM swap impact?
While SIM swap defense is primarily a runtime authentication concern, governance controls can limit the blast radius. Enforcing least privilege and segregation of duties through role and entitlement reviews reduces what an attacker can do if they take over an account. Ensuring that highly privileged accounts are not permitted to use SMS as a factor, and certifying that recovery contact methods for sensitive accounts are current and appropriate, are governance activities that reduce exposure. These lifecycle controls complement, but do not replace, the runtime enforcement measures that stop the takeover itself.

Common misconceptions

SMS-based 2FA is a strong second factor that reliably defeats account takeover.
SMS OTP depends on the phone number as the possession factor, and a SIM swap moves control of that number to the attacker. This undermines the possession factor, so SMS-based 2FA offers weaker protection than phishing-resistant possession factors such as WebAuthn/FIDO2 authenticators.
A SIM swap attack exploits a technical vulnerability in the mobile network protocol.
In most reported cases the attack exploits carrier account-management and customer-support processes through social engineering or insider assistance rather than a flaw in the radio or SIM cryptography itself. It is primarily a process and identity-proofing weakness at the carrier.
Using any form of MFA prevents SIM swap takeovers.
The protection depends on the factor type. MFA that relies on the phone number (SMS or voice OTP) remains exposed to SIM swaps, whereas MFA using inherence factors or cryptographic possession factors bound to a device is not defeated by number reassignment alone.

Best practices

Prefer phishing-resistant possession factors such as WebAuthn/FIDO2 authenticators or passkeys over SMS or voice OTP for both primary authentication and step-up flows, since these are not tied to the mobile number.
Remove SMS and phone-based methods from high-value account recovery paths, or require an additional non-phone factor before a phone number can trigger a password reset or MFA bypass.
Encourage or require users to set a carrier-side account PIN or port-freeze where the carrier supports it, to raise the bar for unauthorized number transfers.
Monitor for signals that may indicate a swap, such as sudden loss of mobile service, recent number-port events, or authentication attempts immediately following a SIM change, and treat them as risk factors in adaptive authentication.
Audit which downstream accounts and recovery flows still depend on a phone number as a possession or recovery factor, and reduce that dependency where feasible.
Educate users and support staff that a phone number is a weak identity proof, and align carrier-facing and internal help-desk identity-proofing procedures accordingly to reduce social-engineering success.
a promotional banner asking how ready are you for PCI DSS 4.0? With a call-to-action to get the checklist now.