SIM-swap attacks: why your phone number is a bad security anchor

What a SIM swap actually is

A SIM swap is when someone convinces — or pays — your mobile carrier to activate your phone number on a SIM card in their hands. Nothing on your device needs to fail for this to work: it’s an identity assertion made to your carrier by a stranger. From that moment, calls and texts meant for you (every SMS 2FA code included) arrive on the attacker’s hardware. You usually notice as a "No Service" banner, or not at all.

Public cases have taken down crypto fortunes, X co-founder Jack Dorsey in 2019, and thousands of ordinary customers when dealer-agent insider rings were prosecuted. Insurance-sounding “protections” change: the one constant is that the control sits on the carrier side with strangers, not with you.

The attack playbook, step by step

1. Recon. The attacker collects on you: leaked breach databases, social media, and — crucially — the last digits of your phone number and answers to your carrier’s security questions, which come mostly from public records and past data breaches, not from mind-reading.
2. Port request. One of three routes: a call to the carrier’s (sometimes outsourced, sometimes bribed) support desk; a retail dealer activation; or an online eSIM portal abuse. Weak carriers need almost nothing; strong ones need only the failures of their weakest agent.
3. Interception. Password resets start flying — email first, exchange accounts next, then the SMS codes for each land on the attacker’s SIM.
4. Harvest. Sessions get taken, tokens issued, seed backups saved. High-value targets get a "maintenance window" of hours before they even see the network banner.
5. Fast exit. The number is ported on again once the drain is done; meanwhile you see nothing on your phone but a dead connection.

Why SMS 2FA dies with your number

SMS was never designed as an authentication channel. Two-failure modes matter:

• The code travels, the factor doesn’t. With TOTP, the secret lives on your device and nothing is transmitted — an attacker needs your device and your password. With SMS, the secret (your subscriber identity, roughly your number) is held by a third party and the code gets delivered over a network an attacker can quietly re-point. The proof factor can be redirected without you.
• One blast radius. Whoever controls your number receives every SMS code on every account whose 2FA rests on it. There’s no per-app isolation, no offline mode, and no rotation you control.

That is why NIST’s US federal guidance has formally restricted SMS and phone-bound out-of-band factors — SP 800-63B classifies SMS out-of-band authentication as RESTRICTED, allowed only under safeguards that consumer services rarely meet — long before this article. The exchanges that push hard for "authenticator app" over SMS aren’t being difficult; they’re shipping the fix.

What carriers can genuinely do

Carrier-side measures cut your exposure a worthwhile amount, though none of them turn your number into a cryptographic factor:

• Port-out PIN / number lock. Every major US carrier now offers some form: an extra PIN, a freeze on porting, in-app identity gates. Set the one your carrier offers today.
• Demand the PIN be used in-store too — dealer activations frequently bypassed phone-based checks in the cases that made headlines.
• Watch your SMS/email for carrier messages about number changes; treat a surprise as a fire alarm, not spam.

The defense that removes the number

The structural fix is to stop routing security proofs through the phone network. Replace SMS with a TOTP authenticator wherever the service allows it: the code is computed locally from your own secret, expires in 30 seconds, and no phone number participates at all. Hardware keys and passkeys go further and bind the proof to the real domain — our TOTP-vs-passkeys article maps out who should choose which. And if part of your thinking here is "but my authenticator backup lives in some app's cloud", read what app cloud-sync actually means for your keys.

Where SMS cannot be disabled — banking apps that insist, service email-confirmation loops — at least subscribe to the carrier hardening above, and shrink what an SMS compromise can touch: use unique email addresses per high-value account, keep backing passwords fresh, and whitelist withdrawal addresses on exchanges so a stolen session can’t invent a destination.

If it already happened

1. Freeze the number. Call the carrier from another phone or use their portal; demand an emergency block, then a fresh SIM with port protection. Get a support ticket number before you hang up.
2. Secure email first. Change its password, sign out all sessions, then re-secure the forgot-password chains rooted in it.
3. Tiered re-securing. Exchanges and banks: revoke sessions, cancel standing orders, freeze withdrawals if the platform offers it. Then social accounts and connected apps (check OAuth grants — attacker sessions can hide behind them.)
4. Report it. Fraud reports (FTC/IC3 in the US; your national equivalent elsewhere) create the paper trail carriers and courts sometimes need to unwind the damage, and the exchange’s fraud desk may be able to flag and claw back outgoing transfers caught in time.