A SIM swap attack is when a criminal transfers your mobile phone number onto a SIM card they control — usually by convincing your telco it is you, using personal details they have stolen. From that moment, every SMS verification code intended for you lands on their phone, which is why SIM swapping defeats the very multi-factor authentication most businesses rely on. This guide explains how the attack works, the warning signs, and how to protect both your own accounts and those of your staff.
TL;DR
- A SIM swap is phone-number theft: an attacker ports your number to their SIM card.
- Its main business use is defeating SMS-based multi-factor authentication — your codes arrive on the attacker's phone.
- Warning signs: sudden loss of mobile service, or 2FA codes arriving unrequested.
- The strongest fix is moving off SMS codes to authenticator apps or security keys.
- An attacker who cannot beat MFA goes after the person instead — phishing training closes that fallback path.
How a SIM swap attack works
The attack is social engineering aimed at a telco, not a hack of your phone:
- They gather your identity data. Name, date of birth, address — usually from data breaches, social media, or a phishing email.
- They contact your telco. Posing as you (or with an insider accomplice), they report a lost phone and request the number on a new SIM.
- Your number moves. Your phone silently loses service; the attacker's phone starts receiving your calls and texts.
- They reset your accounts. With your number, password resets and SMS 2FA codes flow to them. Email, banking, and work systems follow.
The telco is the weak link, and the attack runs in minutes. The practical defence is therefore not trusting the telco, but removing the dependency on the phone number itself.
Why SIM swapping defeats SMS-based MFA
SMS two-factor authentication assumes the phone number is the person. When the number is stolen, that assumption collapses — the "second factor" becomes the attacker's own device. The code prompts keep arriving and keep looking legitimate: the staff member whose number was swapped has no codes arriving at all, which is precisely the warning sign to escalate.
The security hierarchy is clear across the industry:
| Method | Security level | Why |
|---|---|---|
| Security keys (FIDO2/hardware) | Strongest | Bound to the physical key, not the phone number |
| Authenticator apps | Strong | Codes generated on-device, not over the mobile network |
| SMS codes | Weakest | Any control of the SIM controls the code |
Any business that relies on SMS codes for email, banking or remote access carries this exposure — and if attackers cannot beat the MFA directly, they route around it: the fallback is targeting the person, not the phone. That is why phishing simulations remain the complementary control even with strong MFA.
The warning signs
- Your phone loses service unexpectedly while others around you have signal.
- You receive 2FA or password-reset codes you did not request.
- Bank or email security alerts about logins or changes you did not make.
- Colleagues cannot reach you while your phone shows no network.
Any one of these is an immediate escalation: contact the telco, then reset the affected accounts from a clean device.
How to protect your business and staff
- Move off SMS 2FA. Authenticator apps first, hardware security keys for finance and admin accounts. This is the single highest-value change.
- Add a telco port-out PIN. A separate PIN required before any number transfer — it turns the easiest telco attack into a hard one. Ask your provider to enable it.
- Train the identity-theft path. SIM swaps are fuelled by personal data leaked through phishing and breaches. Security awareness training reduces the raw material attacks feed on.
- Monitor for the pattern. Sudden service loss plus unrequested reset codes is the signature; make sure staff know to raise it immediately.
- Reduce what depends on your number. Where services offer non-SMS recovery, use it.
How SIM swaps combine with other attacks
A SIM swap rarely arrives alone — it is the enabling step for a chain of higher-value frauds:
- Account takeover. With SMS codes flowing to their device, the attacker resets email, banking and work logins in sequence, starting with email because it unlocks password resets everywhere else.
- Payroll diversion. Control of a staff member's mailbox is used to redirect their next pay run to a mule account — the change request looks genuine because it comes from the real address.
- Business email compromise. The hijacked mailbox sends payment-fraud requests to suppliers and customers, continuing real threads with real signatures.
- Extortion. Contacts, messages and cloud photos harvested from the accounts become leverage against the individual.
This is why the response to the warning signs is urgent even when "nothing has happened yet": the service loss is the quiet moment before the resets begin. Staff should know that losing service and receiving unexpected codes means calling the telco from another phone — not waiting for the network to return.
FAQ
What is a SIM swap attack in simple terms? A criminal convinces your mobile provider to transfer your phone number to a SIM card they hold, so your calls, texts and SMS verification codes arrive on their phone.
How do I know if I've been SIM swapped? Your phone suddenly shows no service, you receive codes you never requested, or you get alerts about account changes you did not make. Contact your telco immediately.
Does a SIM swap defeat multi-factor authentication? SMS-based MFA, yes — the codes arrive on the attacker's device. Authenticator apps and hardware keys do not depend on the phone network, so they resist SIM swapping.
Can a SIM swap be reversed? Yes — telcos can restore your number once the fraud is confirmed, but the damage from intercepted codes happens in the minutes to hours before you notice. Speed of detection matters more than the reversal.
How common are SIM swap attacks in Australia? They are a known component of identity-crime and account-takeover incidents reported to authorities, and Scamwatch and the telcos have flagged porting fraud as a persistent threat. Treat any unexplained service loss as urgent.
One last thing
Check two things today: whether your telco offers a port-out PIN and enable it for every business phone; and which critical accounts still use SMS codes — move those to an authenticator app this week. Both fixes cost minutes; together they close the attack's whole path.