A SIM swap moves a victim’s phone number onto a SIM card the attacker controls. From that moment every call and text intended for the victim arrives on the attacker’s device, including one-time passcodes and account recovery links. The victim’s phone typically goes quiet, showing no service, which is often the first sign anything is wrong, and by then the account changes have usually happened.
A port-out is the same outcome by a different route: the number is transferred to a different carrier rather than a different SIM. Defensively they are one problem.
How a swap actually happens
Carrier social engineering. The attacker contacts the mobile operator posing as the customer, reports a lost or damaged phone, and requests activation on a new SIM. They supply personal details assembled from breach data and public profiles. The carrier’s own verification is often the same category of knowledge check that fails everywhere else.
Insider assistance. Retail and support staff have the access to perform a swap, and there is a market for it.
Port-out fraud. The number is transferred to a rival carrier using an account number and a PIN, both of which appear in breach corpora when customers reuse them.
Bypassing account protections. Where a customer has set a port-out PIN, attackers work around it through the same channels rather than guessing it.
The common thread is that none of this touches your systems. It happens at the carrier, in an account your organization does not administer, and your directory keeps showing the same phone number afterwards.
Why a swap is so effective against enterprise accounts
It defeats SMS and voice one-time passcodes completely. The attacker becomes the legitimate recipient rather than intercepting anything in transit. The code is delivered correctly, to the wrong person.
It defeats callback verification. A callback confirms someone answered the number on file. After a swap, the number on file is the attacker’s device. This is the reason callback-based wire verification quietly stops working.
It defeats phone-based account recovery. Any recovery flow that sends a link or code to the registered number now recovers the account into the attacker’s hands.
It survives a password reset. Because the attacker controls the recovery channel, resetting the password without also fixing the number hands the account straight back.
CISA lists SIM swap attacks among the core techniques used by Scattered Spider, alongside push-notification fatigue and help desk impersonation, and describes attackers conducting swaps before the layered social engineering that follows (CISA, advisory AA23-320A).
How to check for a SIM swap
For an individual, the practical signals are blunt: the phone loses service unexpectedly, texts and calls stop arriving, or a carrier notification confirms a change nobody requested.
For an organization making a real-time decision on a call, none of that is available. You cannot see whether a caller’s phone lost service, and the caller is not going to mention it.
What you can do is ask the network. Mobile network operators know when a number was last ported or moved to a new SIM, and that date is queryable. The check is simple and decisive: when did this number last change hands? A number that moved hours before someone calls asking for a password reset tells the agent more than anything else in that conversation.
This is why SIM swap detection belongs at the moment of the request rather than in a monthly report. The signal is only actionable while the agent still has the caller on the line.
SIM swap and port-out detection is one of ATO Protect’s four checks, alongside authoritative-source verification of a government ID, man-in-the-middle detection, and anti-replay defense.
Where enterprises should place the check
At the IT help desk, before a password or MFA reset. The caller’s premise is that they cannot use their enrolled factor. A recently moved number turns that from an inconvenience into a signal.
At customer support, before high-value account recovery. The same pattern in the customer-facing direction, where the account holds funds, loyalty balances, or medical records.
Before payment and payroll changes. Where the verification step is a callback, the number’s history determines whether the callback proves anything.
Wherever SMS one-time passcodes are still in use. If you cannot remove SMS as a factor immediately, at least know when the number receiving the code changed hands.
Reducing exposure
Detection is the control that works at the moment of risk. These reduce the surface it has to cover.
Move privileged users off SMS. Phishing-resistant methods bound to a device or origin do not depend on a phone number at all. This is the single largest reduction available, and it is worth prioritizing for administrators and finance staff.
Treat the phone number as an identifier, not as proof. It confirms which device to contact, and nothing about who is holding it.
Encourage carrier-side protections for high-risk staff. Port-out PINs and account locks raise the cost of a swap. They are set on personal carrier accounts, so this is guidance rather than policy for most organizations.
Do not let a recovery flow depend on a single channel. If both the credential reset and its verification travel to the same phone number, a swap defeats both at once.
Verify the person, not the number. The durable answer is a check against something the attacker does not control. A government-issued ID verified against the authority that issued it — in the US, state DMV records over the AAMVA network — does not care which SIM is in the caller’s phone.
What to do when a swap is detected
A positive signal on a live call changes what the agent should do, and the sequence matters.
Stop the request, do not complete it and flag it. A reset performed and reviewed later is a reset the attacker already used. The window between action and review is the whole attack.
Do not verify through the phone. The compromised element is the number itself, so a callback, an SMS code, or a voice confirmation to that number all reach the same device. Verification has to move to a channel that does not depend on the phone, or to a check against an authoritative source that does not care which SIM is present.
Reach the real user another way. An in-person confirmation, a manager who knows them, or a corporate channel on a managed device. This step also tells you whether the swap is genuine or the user simply changed carriers legitimately, which does happen.
Check what the number can still recover. A number that has moved is a recovery path into every account where it is registered, not only the one being discussed. Email, banking, and identity provider recovery settings all need review, and the corporate directory is usually not the only place it appears.
Treat any account already recovered through that number as compromised, and revoke sessions rather than only resetting credentials.
Then remove the dependency. Once the incident is closed, the affected user is a good candidate for moving off SMS-based factors permanently, because a person targeted once is a person whose details are in circulation.
Where SIM swap fits in the wider attack
A SIM swap is rarely the whole attack, but a step that makes the next one work, and it usually appears alongside others.
CISA’s advisory describes attackers conducting swaps and then using layered social engineering across several calls, first learning the reset procedure, then gathering reset-specific details, then persuading help desk staff to reset passwords or transfer MFA tokens (CISA, advisory AA23-320A). The swap makes the caller’s story survive contact with a callback.
That is the practical consequence. If your verification chain is knowledge questions plus a callback, a swap defeats the second half and breach data defeats the first. The chain looks like two independent checks and behaves like none.
ATO Protect verifies a caller’s government-issued ID against the authority that issued it in real time, and SIM swap and port-out detection is one of its four checks. It requires no pre-registration and no app download, and runs no selfie or liveness challenge. See ATO Protect use cases and ATO Protect for IT Help Desk.
Frequently asked questions
What is a SIM swap attack? A SIM swap attack moves a victim’s phone number onto a SIM card the attacker controls, usually by socially engineering the mobile carrier. Calls and texts, including one-time passcodes and account recovery messages, then arrive on the attacker’s device.
What is the difference between a SIM swap and a port-out? A SIM swap moves the number to a new SIM on the same carrier. A port-out transfers it to a different carrier. The effect on the victim is the same, and both should be treated as one problem.
How do you check for a SIM swap? An individual usually notices the phone losing service. An organization cannot see that during a call, so the practical check is to query the mobile network for when the number was last ported or moved to a new SIM. A number that changed hands shortly before a reset request is a strong signal.
Does a SIM swap defeat multi-factor authentication? It defeats SMS and voice one-time passcodes completely, because the attacker becomes the legitimate recipient of the code. It does not defeat phishing-resistant methods such as passkeys or security keys, which are bound to a device or origin rather than to a phone number.
Why do callbacks fail after a SIM swap? A callback confirms that someone answered the number on file. After a swap, the number on file reaches the attacker’s device. The verification completes successfully and proves nothing.
How can enterprises protect against SIM swap? Check whether the number changed hands recently at the moment of a reset, recovery, or payment change, rather than relying on the number as proof of identity. Move privileged users off SMS-based factors. Ensure a credential reset and its verification do not both travel to the same phone number. Verify the person against an authoritative source that does not depend on the phone.
Does Trusona detect SIM swaps? Yes. SIM swap and port-out detection is one of ATO Protect’s four checks, alongside verifying a government-issued ID against its issuing authority, man-in-the-middle detection, and anti-replay defense.
Can a port-out PIN stop a SIM swap? It raises the cost and does not eliminate the risk. PINs are set on personal carrier accounts, so an organization cannot enforce them, and attackers work around them through the same support channels used for the swap itself.
A phone number tells you which device to call. After a swap it is still the right number, still in your records, and no longer the right person.
ATO Protect verifies the person when the number moves.