New SIM swap tactics put two-factor logins at risk as telcos race to adapt

Mobile carriers and banks are reporting a rise in SIM swap fraud that targets the very tools many people rely on for security: one-time codes sent by SMS and calls. The tactics are not entirely new, but the techniques and targets are shifting in ways that are harder for ordinary users to spot.

As more services move to digital-only customer support and automated verification, criminals are finding fresh ways to convince telecom staff to move a phone number to a new SIM card under their control, then quickly drain bank accounts and hijack social media and email.

How modern SIM swap attacks actually work

In a classic SIM swap, an attacker contacts a mobile operator, pretends to be the account holder and asks to transfer the victim’s number to a new SIM card. Once the carrier completes the request, the victim’s phone loses service and the attacker receives all calls and SMS messages for that number.

From that point, login flows that rely on SMS codes or call-based verification become a powerful weapon. Criminals trigger password resets at banks, cloud services or messaging apps, intercept the codes, and take over accounts before the victim realizes the phone has gone offline.

New social engineering tricks and data sources

What has changed over the last year is not the basic concept, but how attackers gather the information needed to convince telecom staff that they are the real customer. Instead of relying only on leaked passwords or public social media profiles, fraud groups now combine multiple data sources.

Leaked customer databases, phishing emails that ask for partial ID numbers, and malware that scrapes autofill data in web browsers can provide a detailed profile: full name, billing address, partial payment card details and answers to common security questions. That makes scripted conversations with call centers far more convincing.

Targeting customer support automation and self-service portals

Telecom operators have invested heavily in self-service portals and automated flows that reduce pressure on call centers. These tools, however, can create new paths for SIM swaps if verification steps are weak or if staff override security checks under time pressure.

Some operators now allow customers to request SIM replacements through apps or web dashboards. If an attacker has already compromised an email account or gained access to a weakly secured telecom account, they may be able to initiate a SIM change without ever speaking to a human agent.

Why banks and fintechs are feeling the impact

Banks and fintech providers have long promoted SMS codes as an extra layer of protection for logins and high-risk transactions. The rise in SIM swap attacks is pushing many of them to reconsider how much they rely on a customer’s phone number as proof of identity.

In incident reports from financial regulators and industry groups, SIM swaps appear frequently alongside account takeover cases. The pattern is often similar: within minutes of a number port, attackers log in, change contact details, add new payees and move funds to accounts that are quickly emptied.

How telecoms are tightening verification

Mobile operators are responding with a mix of policy changes, technical controls and staff training. Many carriers now require additional checks for SIM changes, such as in-store ID verification, extra one-time passwords sent to existing contact channels or mandatory waiting periods before a new SIM is fully active.

Some networks have introduced account-level security flags that customers can enable, which require more stringent checks for any change to SIM cards or number ports. Others are using machine learning systems that look for unusual patterns, like multiple SIM swap requests from the same IP address or device.

What individuals can do to reduce their risk

Consumers cannot control how telecom operators run their internal checks, but they can reduce their exposure to SIM swap damage. The central idea is simple: treat your phone number as a weak link and avoid using it as the only barrier to valuable accounts.

Several practical steps make a difference in case a number is hijacked, or even prevent attackers from targeting it in the first place.

Reduce reliance on SMS for important accounts

Where possible, switch from SMS verification to app-based multi-factor authentication that uses one-time codes or push prompts generated on your device. Many major platforms, including email providers, password managers and cloud services, offer this option in their security settings.

For especially sensitive accounts, such as primary email and banking, hardware security keys are increasingly supported and offer stronger resistance to SIM-related attacks and phishing.

Lock down telecom accounts and support PINs

Most carriers allow customers to set a dedicated account PIN or passphrase that must be provided before staff make changes like SIM replacements or number ports. If you have not set one, or if it uses easily guessable information, updating it is a useful first step.

It is also worth checking whether your provider offers additional protections, such as a “no remote SIM swap” flag that forces in‑store verification with ID, or alerts for any change to SIM status or account contact details.

Warning signs and what to do if you suspect a SIM swap

One of the most important signals of an active SIM swap is a sudden loss of mobile service in areas where coverage is normally stable, especially if friends or colleagues can still make calls without issues. A wave of password reset notifications or login alerts from your email, social media or banking apps at the same time is another red flag.

If you suspect your number has been moved, try to borrow another phone or use internet calling to contact your mobile operator immediately, report the incident and ask them to reverse the swap or temporarily suspend the line. In parallel, start changing passwords on key accounts, prioritizing email and financial services.

Why the problem is unlikely to disappear soon

As long as phone numbers are used as identity anchors across banking, messaging apps and cloud services, SIM swap fraud will remain attractive. Telecom operators can raise the cost and difficulty for attackers, but they cannot fully eliminate the appeal of taking control of a single identifier that unlocks many services.

Security teams in both telecoms and finance increasingly view SIM swaps as one symptom of a broader challenge: identity verification that depends heavily on static personal data and shared infrastructure. Moving away from SMS for high‑value security flows and adopting stronger, device-based or cryptographic methods is likely to be a long process, but pressure from rising fraud rates is speeding it up.