SIM Swapping Attacks: How They Work and Prevention Strategies

From an embedded systems perspective, the SIM is elegant: a tamper-resistant UICC containing an IMSI, Ki key, and authentication algorithms that prove to the network you are who you claim to be. The vulnerability isn’t in the cryptography on the card. It’s in the human-operated provisioning systems that bind that IMSI to your phone number (MSISDN) in the carrier’s HLR/HSS database — and the fact that so much of modern authentication trusts that binding implicitly.

1. The Attack Chain: From OSINT to Account Takeover

Most SIM swaps follow a predictable five-stage pipeline. Understanding each stage helps you break the chain.

Stage 1 — Reconnaissance & Data Harvesting

Attackers start with open-source intelligence (OSINT): data broker listings, breach dumps, LinkedIn, and previous phishing. They need the target’s full name, phone number, carrier, date of birth, last four of SSN, and billing zip — often enough to pass a carrier’s knowledge-based verification. For high-value targets, spear-phishing or SIM-adjacent malware on cross-platform framework apps can collect this directly.

Stage 2 — Social Engineering the Carrier

The attacker contacts carrier support via phone, chat, or in-store visit, impersonating the victim. Pretexts vary: “my phone was stolen,” “I need to activate my new eSIM while traveling,” or “port my number to this new carrier.” Weak verification is the enabler — answers to security questions, recent call history, or a photocopied ID that store reps are not equipped to authenticate. In some documented cases, attackers have bribed retail employees directly, bypassing verification entirely.

Stage 3 — HLR/HSS Remapping

Once verified, the agent performs a SIM change: dissociating the victim’s MSISDN from the original IMSI and linking it to the attacker’s SIM/eSIM profile. This update propagates through the Home Location Register (HLR) for 2G/3G or Home Subscriber Server (HSS/UDM) for LTE/5G. No over-the-air signal attack is needed. Unlike vulnerabilities in the mobile RF frontend architecture, the network itself considers this a legitimate administrative action.

Stage 4 — Interception & Enumeration

Within minutes, SMS and voice calls route to the attacker. The victim’s phone drops to “SOS” or “No Service” — often mistaken for poor signal reception. The attacker now triggers password resets on email, banking, and social accounts. Any service that sends an OTP or reset link via SMS delivers it straight to the hijacked number.

Stage 5 — Lateral Takeover

Email is the master key. Once the primary email is recovered via SMS, the attacker enumerates other accounts, disables 2FA, and exfiltrates funds or data. Crypto wallets, payment apps, and enterprise SSO accounts are prime targets because they historically defaulted to SMS fallback even when stronger factors were enrolled.

2. Why the Cellular Trust Model Is Broken

The global SS7/Diameter signaling system that interconnects carriers was designed in the 1970s-80s for trusted operators, not adversarial environments. While modern mobile GPU architecture and baseband isolation have hardened device security, the carrier identity layer remains soft.

Three structural weaknesses persist:

• Fallback insecurity: Many services still offer “send code via SMS” even after you enable an authenticator app, creating a downgrade path. Attackers specifically request SMS fallback.
• Knowledge-based verification: Carrier reps rely on breached PII. Last-four SSN, mother’s maiden name, and billing address are static secrets, not proofs of presence.
• Lack of hardware binding: Unlike FIDO2/WebAuthn where the private key never leaves a secure enclave, SMS codes are bearer tokens — anyone who receives the message can use it from any device.

eSIM and 5G SA have not fixed this. While eSIM enables remote provisioning via SM-DP+ servers, it adds another remote social-engineering surface. The fundamental issue is logical, not physical: whoever controls the HLR/HSS entry controls your number.

3. Visualized: SIM Swap Attack Flow

4. Authentication Methods Compared

Not all second factors are equal. The key metric is whether control of your phone number compromises the factor. From a firmware perspective, SMS is a clear outlier: it relies on network state rather than device-bound cryptography.

If you take one action after reading this, make it this: migrate off SMS 2FA to a TOTP app or passkey, and then remove your phone number as a recovery option where services allow it. Keeping SMS as a fallback negates the upgrade.

5. Defense in Depth: Three-Layer Prevention

As with RF design, defense is layered. No single control is sufficient against a motivated attacker with breached PII. You need carrier-level, account-level, and operational controls.

Layer 1 — Harden the Carrier

• Set a Number Transfer PIN / Port-Out Passcode: All major US carriers now offer this (T-Mobile Account Takeover Protection, Verizon Number Lock, AT&T Number Lock). This adds a 6-15 digit PIN required for any port or SIM change. Enable it in the carrier app, not via phone support.
• Add a SIM Change Lock & Callback PIN: Request a “SIM protection” flag and a verbal passcode that agents must ask for before any account modification. Note that store reps can override — ask for “no override without in-person ID + PIN.”
• Reduce PII exposure: Freeze credit, remove your number from data broker sites, and use a Google Voice or secondary number for public listings so your primary MSISDN is less exposed to OSINT.

Layer 2 — Harden the Accounts

• Prefer FIDO2/WebAuthn passkeys for Google, Apple, Microsoft, and GitHub. Keys are bound to the origin domain, so a fake login page cannot relay the assertion.
• Use TOTP where passkeys aren’t supported. Store recovery codes offline on paper, not in email. Disable SMS fallback after enrollment.
• Separate email recovery: Create a hardened, non-public recovery email protected by hardware keys. Never use your phone number as the sole recovery for your primary email.

Layer 3 — Harden Your Operations

• Monitor for “no service” events. If your phone suddenly shows SOS for more than a few minutes without travel, assume a swap. Immediately contact your carrier from another device and freeze financial accounts.
• Carrier notifications: Enable email alerts for SIM changes and port requests. Some carriers send them automatically — verify they go to an email, not SMS.
• High-risk users (executives, crypto holders): Consider a carrier with enhanced enterprise protections, or move 2FA-critical services to a number on a separate carrier with a non-public identity.

6. If You’ve Been Swapped: 15-Minute Response

Time matters. Attackers automate password resets within minutes of intercepting the first OTP.

1. Don’t power-cycle repeatedly. Use a different device to call your carrier’s fraud line (not regular support) and request an immediate SIM freeze and number reclaim.
2. Secure email first. From a clean device, change your primary email password and revoke active sessions. Email is the pivot for all other resets.
3. Freeze financial access. Contact banks, rotate passwords, and place a temporary transaction hold if available. Check for added forwarding rules or API keys.
4. Document and report. File an FCC complaint, FTC identity theft report, and police report. Request a port history log from the carrier — this is critical for disputes and insurance claims.

After recovery, perform a full rotation: new passkeys, new TOTP secrets, new recovery codes, and a new carrier PIN. Assume any secret sent via SMS during the compromise window is burned.

About the author: David Okonkwo is an embedded systems engineer specializing in baseband firmware, secure elements, and cellular IoT provisioning. He has worked on eUICC integration and carrier certification for low-power LTE-M deployments.