A SIM swap moves a victim’s phone number onto a SIM card the attacker controls. From that moment every call and text intended for the victim arrives on the attacker’s device, including one-time passcodes and account recovery links. The victim’s phone goes quiet, showing no service. The FCC calls that loss of service typically the first sign of SIM swap or port-out fraud, and by then the account changes may already have happened.
A port-out is the same outcome by a different route: the number is transferred to a different carrier rather than a different SIM. Defensively they are one problem.
How a swap actually happens
Carrier social engineering. The attacker contacts the mobile operator posing as the customer and asks for the number to be moved to a new SIM, using personal details gathered in advance. Where the carrier verifies with questions, they are the same kind of knowledge check that fails everywhere else, which is why the FCC ruled in 2023 that biographical, account and payment information and call records are not secure ways to authenticate a SIM change.
Insider assistance. Carrier employees have the access to perform a swap, and the FBI reports criminals paying them to do it.
Port-out fraud. The number is transferred to a rival carrier using the account number and PIN a port request asks for. Those leak too: T-Mobile’s 2021 breach exposed the account PINs of about 850,000 prepaid customers.
Bypassing account protections. A port-out PIN helps, but it is still something a person knows, so anyone who obtains it can use it.
The common thread is that none of this touches your systems. It happens at the carrier, in an account your organization does not administer, and your directory keeps showing the same phone number afterwards.
Why a swap is so effective against enterprise accounts
It defeats SMS and voice one-time passcodes completely. The attacker becomes the legitimate recipient rather than intercepting anything in transit. The code is delivered correctly, to the wrong person.
It defeats callback verification. A callback confirms someone answered the number on file. After a swap, the number on file is the attacker’s device. This is the reason callback-based wire verification quietly stops working.
It defeats phone-based account recovery. Any recovery flow that sends a link or code to the registered number now recovers the account into the attacker’s hands.
It survives a password reset. Because the attacker controls the recovery channel, resetting the password without also fixing the number hands the account straight back.
CISA lists SIM swap attacks among the core techniques used by Scattered Spider, alongside push-notification fatigue and help desk impersonation, and describes attackers conducting swaps before the layered social engineering that follows (CISA, advisory AA23-320A).
How to check for a SIM swap
For an individual, the practical signals are blunt: the phone loses service unexpectedly, texts and calls stop arriving, or a carrier notification confirms a change nobody requested.
For an organization making a real-time decision on a call, none of that is available. You cannot see whether a caller’s phone lost service, and the caller is not going to mention it.
What you can do is ask the network. Mobile network operators know when a number was last ported or moved to a new SIM, and that date is queryable. The check is simple: when did this number last change hands? A number that moved hours before someone calls asking for a password reset is a signal the caller cannot talk around.
This is why SIM swap detection belongs at the moment of the request rather than in a monthly report. The signal is only actionable while the agent still has the caller on the line.
SIM swap and port-out detection is one of ATO Protect’s four checks, alongside authoritative-source verification of a government ID, man-in-the-middle detection, and anti-replay defense.
Where enterprises should place the check
At the IT help desk, before a password or MFA reset. The caller’s premise is that they cannot use their enrolled factor. A recently moved number turns that from an inconvenience into a signal.
At customer support, before high-value account recovery. The same pattern in the customer-facing direction, where the account holds funds, loyalty balances, or medical records.
Before payment and payroll changes. Where the verification step is a callback, the number’s history determines whether the callback proves anything.
Wherever SMS one-time passcodes are still in use. If you cannot remove SMS as a factor immediately, at least know when the number receiving the code changed hands.
Reducing exposure
Detection is the control that works at the moment of risk. These reduce the surface it has to cover.
Move privileged users off SMS. Phishing-resistant methods bound to a device or origin do not depend on a phone number at all. This is worth prioritizing for administrators and finance staff.
Treat the phone number as an identifier, not as proof. It confirms which device to contact, and nothing about who is holding it.
Encourage carrier-side protections for high-risk staff. Port-out PINs and account locks raise the cost of a swap. On a personal line they sit on the employee’s own carrier account, where they are guidance rather than policy.
Do not let a recovery flow depend on a single channel. If both the credential reset and its verification travel to the same phone number, a swap defeats both at once.
Verify the person, not the number. The durable answer is a check against something the attacker does not control. A government-issued ID verified against the authority that issued it — in the US, state DMV records over the AAMVA network — does not care which SIM is in the caller’s phone.
What to do when a swap is detected
A positive signal on a live call changes what the agent should do, and the sequence matters.
Stop the request, do not complete it and flag it. A reset performed and reviewed later is a reset the attacker already used. The window between action and review is the whole attack.
Do not verify through the phone. The compromised element is the number itself, so a callback, an SMS code, or a voice confirmation to that number all reach the same device. Verification has to move to a channel that does not depend on the phone, or to a check against an authoritative source that does not care which SIM is present.
Reach the real user another way. An in-person confirmation, a manager who knows them, or a corporate channel on a managed device. This step also tells you whether the swap is genuine or the user simply changed carriers legitimately, which does happen.
Check what the number can still recover. A number that has moved is a recovery path into every account where it is registered, not only the one being discussed. Email, banking, and identity provider recovery settings all need review, and the corporate directory may not be the only place it appears.
Treat any account already recovered through that number as compromised, and revoke sessions rather than only resetting credentials.
Then remove the dependency. Once the incident is closed, the affected user is a good candidate for moving off SMS-based factors permanently, because a person targeted once is a person whose details an attacker already holds.
Where SIM swap fits in the wider attack
A SIM swap can be one step that makes the next one work, rather than the whole attack. In the Scattered Spider campaigns CISA describes, it sits alongside push bombing and help desk impersonation.
CISA’s advisory describes attackers conducting swaps and then using layered social engineering across several calls, first learning the reset procedure, then gathering reset-specific details, then persuading help desk staff to reset passwords or transfer MFA tokens (CISA, advisory AA23-320A). The swap makes the caller’s story survive contact with a callback.
That is the practical consequence. If your verification chain is knowledge questions plus a callback, a swap defeats the second half and breach data defeats the first. The chain looks like two independent checks and behaves like none.
ATO Protect verifies a caller’s government-issued ID against the authority that issued it in real time, and SIM swap and port-out detection is one of its four checks. It requires no pre-registration and no app download, and runs no selfie or liveness challenge. See ATO Protect use cases and ATO Protect for IT Help Desk.
Frequently asked questions
What is a SIM swap attack? A SIM swap attack moves a victim’s phone number onto a SIM card the attacker controls, by tricking or paying off someone at the mobile carrier. Calls and texts, including one-time passcodes and account recovery messages, then arrive on the attacker’s device.
What is the difference between a SIM swap and a port-out? A SIM swap moves the number to a new SIM on the same carrier. A port-out transfers it to a different carrier. The effect on the victim is the same, and both should be treated as one problem.
How do you check for a SIM swap? An individual usually notices the phone losing service. An organization cannot see that during a call, so the practical check is to query the mobile network for when the number was last ported or moved to a new SIM. A number that changed hands shortly before a reset request is a strong signal.
Does a SIM swap defeat multi-factor authentication? It defeats SMS and voice one-time passcodes completely, because the attacker becomes the legitimate recipient of the code. It does not defeat phishing-resistant methods such as passkeys or security keys, which are bound to a device or origin rather than to a phone number.
Why do callbacks fail after a SIM swap? A callback confirms that someone answered the number on file. After a swap, the number on file reaches the attacker’s device. The verification completes successfully and proves nothing.
How can enterprises protect against SIM swap? Check whether the number changed hands recently at the moment of a reset, recovery, or payment change, rather than relying on the number as proof of identity. Move privileged users off SMS-based factors. Ensure a credential reset and its verification do not both travel to the same phone number. Verify the person against an authoritative source that does not depend on the phone.
Does Trusona detect SIM swaps? Yes. SIM swap and port-out detection is one of ATO Protect’s four checks, alongside verifying a government-issued ID against its issuing authority, man-in-the-middle detection, and anti-replay defense.
Can a port-out PIN stop a SIM swap? It raises the cost and does not eliminate the risk. On personal lines an organization cannot enforce one, and PINs are still something a person knows: carrier breaches have exposed them, as T-Mobile’s did in 2021.
A phone number tells you which device to call. After a swap it is still the right number, still in your records, and no longer the right person.
ATO Protect verifies the person when the number moves.