SIM swapping is a fraud in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card or eSIM the attacker controls. From that moment, calls and text messages meant for the victim go to the attacker, including one-time login codes.

How it works

• The attacker gathers personal details through phishing, social engineering or data breaches.
• They contact the carrier while posing as the victim, or use an inside contact at the carrier.
• The carrier moves the number to the new SIM, and the victim’s phone loses service.
• The attacker then resets passwords or passes SMS-based checks on email, banking and work accounts.

MITRE ATT&CK describes this process as technique T1451, SIM Card Swap.

Why it matters for defenders

SIM swapping defeats any security that relies on SMS codes or phone-based account recovery. CISA advises moving to phishing-resistant MFA and notes that number matching helps against SMS-based attacks where stronger methods are not yet available. Organizations can also ask carriers for port-out protection on staff numbers. The attack depends on personal data, so leaked phone numbers and identity details of executives and IT staff are an early risk signal worth watching.

Sources: MITRE ATT&CK T1451: SIM Card Swap (Mobile), CISA: More than a Password