SIM swap: the attack that beats SMS two-factor every time
An attacker moves your phone number to their SIM and receives your codes. Fifteen minutes of setup makes you immune.
Checklist · 4 steps
- Move every exchange and email account from SMS codes to an authenticator app or a hardware key.
- Set a port-out or SIM-lock PIN with your carrier.
- Remove your phone number as a recovery option from your primary email.
- If your phone suddenly loses signal for no reason, call your carrier from another phone immediately.
The attacker calls or visits your carrier with enough of your personal information to pass as you, and asks for a replacement SIM. Your phone goes dead. Theirs now receives your calls and texts, including every one-time code.
From there they reset your email password, then your exchange password, then withdraw. The whole sequence takes under an hour and has been documented in India, the US, the UK and Nigeria this year.
The defence is to make the phone number worthless: no account that holds money should accept an SMS code. Authenticator apps generate codes on your device; hardware keys require a physical touch. Either defeats the attack entirely.