SIM swapping
The transfer of a phone line to a SIM card controlled by someone else. What it is exactly, how it differs from phishing a code, and what it does to an account's second factor.
In short
SIM swapping is the transfer of a phone number to a different SIM card, done without the holder's consent. The attacker gets the mobile carrier to associate the line with a SIM they control, and from that point on they receive the calls and messages sent to that number.
What gets stolen isn't the phone or the account. It's the line, and with it everything the number vouches for: the OTP codes that arrive by SMS and the validations a service performs by calling or texting that number.
It's not phishing a code, and the difference matters
The two routes end up in the same place — an attacker holding the code — but they're stopped with different controls.
- Phishing a code — the attacker convinces the holder to hand over the OTP they just received. The code passes through the person, and the defense targets the person: education, interface cues, retry limits.
- SIM swapping — the attacker doesn't ask the holder for anything. They convince the carrier, and the code stops reaching the holder. The defense can't rely on the user, because the user is never involved.
That gives the organization the most useful signal: the holder of a hijacked line usually loses service before finding out anything is wrong. The loss of signal precedes the access attempt.
Where it shows up in an identity journey
SIM swapping doesn't attack sign-up. It attacks the moments when the phone number counts as proof of identity.
- SMS second factor — the code reaches the attacker's SIM and the possession factor is fulfilled in their favor.
- Access recovery — the "I forgot my password" flows that send a link or a code to the registered number.
- Transaction confirmation — the authorizations a bank validates with a message to the declared phone.
In all three cases the organization is delegating a segment of its authentication to a third party: the mobile carrier, which manages who controls the line through its own processes and its own support channels.
What reduces the exposure
A factor that doesn't depend on the line. MFA factors tied to the device or to biometrics don't travel over the phone network, so a line hijack doesn't reach them.
The full development of the attack, with the complete sequence and the points where it can be cut off, is on the fraud-type page: SIM swapping.
Frequently asked questions
It's the transfer of a person's phone number to a SIM card controlled by a third party, done without their consent. Once completed, the calls and messages for that line reach the attacker, including the one-time codes many services send by SMS to confirm identity or authorize transactions. The original holder loses service on their own device.
In who gets deceived. In phishing a code, the holder receives the message and hands it over. In SIM swapping, the deception happens at the mobile carrier and the holder never sees the code, because it stops reaching them. That's why controls focused on warning the user don't cover this case.
No. SIM swapping is a method and an account takeover is the outcome: control of someone else's account. Hijacking a line is one of the routes that leads to that outcome, alongside phishing and credential stuffing. Naming them separately helps, because each route gets cut off in a different place.
