SIM Swap Attack

A SIM swap attack is the fraudulent transfer of a victim's MSISDN — their phone number — onto a SIM (or eSIM profile) controlled by the attacker. Once the swap is processed, the victim's handset loses service, and every SMS or voice call directed at that number is delivered to the attacker. The objective is almost always to intercept SMS-based one-time passwords (OTPs) for banking, email, exchange or social accounts, complete a password reset using the same channel, and take the account over. The technique does not exploit a protocol vulnerability; it exploits the operator's identity-verification and porting workflow.

The two common variants are customer-care SIM swap (the attacker contacts the home operator's call centre, impersonates the subscriber with social-engineering data harvested elsewhere, and requests a replacement SIM) and port-out fraud (the attacker triggers a number portability transfer to a different operator under their control, abusing MNP procedures). Both end at the same place: the HLR/UDM is updated to point the MSISDN at the attacker's SIM, and the SS7/Diameter machinery routes traffic to it normally.

Operator-side containment is workflow-heavy rather than protocol-heavy. The controls that actually work are mandatory port-out PINs that cannot be reset by SMS, strong identity verification before any SIM replacement, anomaly detection on swap velocity and on first-use of a freshly issued SIM, customer-facing notification with a cooling-off window, and tightened authority for high-risk number ranges. SMS-based 2FA is itself the underlying weakness on the consumer side: where it can be replaced with app-based or hardware authenticators, it should be. For the broader SMS attack surface see the SMS Firewall guide; for the SS7/Diameter paths that complement SIM swap (location disclosure and SMS interception without a swap), see SS7 Security.