Threat Spotlight: SIM Swapping — When the Attacker Becomes Your Phone Number

For years the advice was “protect accounts with your phone number”. SIM swapping turned that on its head. In this fraud, a criminal convinces — or bribes — a telco into moving your mobile number onto a SIM they control. From that moment, every call and every SMS meant for you goes to them, including the six-digit codes protecting your email and bank. Documented cases worldwide have cost individuals and businesses millions, and Australian telcos introduced mandatory identity-verification rules for number porting precisely because the losses became routine.

How the swap happens

• Research: your name, number, birthday and address — assembled from old breach data and social media — are enough to impersonate you convincingly.
• The port: the attacker contacts the telco as “you”, claiming a lost phone, and requests the number be moved to a new SIM — or bribes an insider to do it directly.
• The takeover window: your phone drops to “No service”; they trigger password resets on email and banking, receiving every SMS code meant for you.
• The drain: money moves, mailboxes are looted, and by the time the telco untangles it, the damage is hours old.

Why businesses should care, not just individuals

The owner’s mobile number is often the recovery path for the business’s email admin account, banking and domain registrar — the exact trio an attacker wants. A successful swap on one founder’s number can hand over the whole company. And staff who use SMS codes for business logins carry the same exposure in their pockets.

Cutting the risk down

• Move business-critical accounts off SMS codes: authenticator apps or passkeys are immune to SIM swaps.
• Ask your telco about porting protection — Australian carriers offer PINs or additional verification on port-out requests.
• Treat sudden “No service” as an incident, not an annoyance: call your telco from another phone immediately, then your bank.
• Keep recovery paths consistent: an email account “protected” by app MFA but recoverable via SMS is still an SMS-protected account.

SIM swapping is the reason security people call SMS the weakest second factor — but the fix costs nothing: an authenticator app, a porting PIN, and recovery settings that don’t quietly route back to your phone number.