Key takeaways
- In a SIM swap, a criminal has the victim’s number transferred to another SIM and then receives the victim’s calls and texts.
- The attack targets the phone number, not the SMS message itself.
- Controls belong in your sign-in and account-change flows: step-up checks, delays and notifications through another channel.
- A messaging provider delivers the message; it cannot stop someone who controls the number.
How the attack works
The attacker collects personal details about the victim and then persuades the operator, or an employee, to move the number to a new SIM card. From that moment the victim’s phone loses service and the attacker receives the texts.
The attacker then starts a password reset or a sign-in on a target service and uses the code that arrives on the new SIM. The weakness is not in SMS as a message format but in how easily a number can be moved.
Warning signs
- A customer reports that their phone suddenly lost service
- A password reset or new-device sign-in is followed at once by changes to contact details or payees
- The phone number was recently ported or changed
- Sign-ins from a new device and a new location right after a code request
Controls you can add
- Ask for a stronger factor before high-value actions, such as an authenticator app or a passkey
- Delay or add friction to sensitive changes soon after a code-based recovery, for example adding a payee or changing the phone number
- Notify the customer by another channel, such as email or an app, when a number or security setting changes
- Where your countries and partners offer a signal that a number was recently swapped or ported, use it as an input to risk decisions
- Do not let SMS alone unlock the most valuable actions
What to tell your customers
- Ask the operator about a PIN or extra protection on the account
- Be careful with personal details shared publicly
- Contact the operator at once if a phone loses service without explanation
- Check any message about a changed number or security setting, and report ones that were not requested
How ZafeConnect fits
ZafeConnect delivers one-time codes and other A2P messages to 190+ countries and offers Numbers Lookup and SenderID Protection as separate products. SIM-swap detection is a control in your own flows; talk to us about what signals are available in the countries you serve.