SIM swap

What it means

A SIM swap is a fraud where an attacker persuades a mobile carrier to move a victim's phone number onto a SIM card the attacker holds. The tricks used include impersonating the owner, bribing staff or abusing weak identity checks at a shop or call centre.

From that moment, calls and text messages for that number reach the attacker. Any service that sends a sign-in code or a reset link by SMS is now sending it to the wrong person. The victim often notices only when their phone suddenly loses signal, by which time the codes have already been used.

Why it matters

It turns the phone number into the key to the account. An attacker who already has a password, perhaps from a data breach, can pass a text-message second factor and take the account in minutes. Banks, crypto services and email accounts are common targets.

You cannot fix the carrier, but you choose what your app trusts. NIST's guidance treats codes sent over the phone network as a restricted authenticator, to be offered with care and with alternatives, and asks services to check for recent changes to a number.

How it shows up

You meet it wherever SMS is used: sign-in codes, account recovery, high-value approvals and phone-number-based login. Check whether a number change on the account alone, without other proof, can reset access, and whether you notify the old email address when a number is added or changed.

Safer choices are an authenticator app, a security key or passkeys. Where SMS has to stay, add limits, alerts and a delay on sensitive changes soon after a number moves. Do not let SMS be the only route back into an account that holds money or customer data.