Glossary
Hijacking a phone number by moving it to a new SIM.
Used on CISOs Fraud & risk Compliance
A SIM swap is when a criminal gets a mobile carrier to move a victim's phone number to a SIM or eSIM they control, by social engineering, bribery or stolen credentials. The criminal then receives the victim's calls and texts, including one-time passcodes.
Field guide
Inventory every flow that sends a code, write the risk assessment NIST SP 800-63B-4 asks for, fix account recovery and new-payee setup first, then move customers to phishing-resistant or device-bound methods such as passkeys and in-app approval. Keep SMS only as a restricted fallback, with a dated plan to remove it.
Field guide
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
Buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Vendor brief
Glide Identity(owner interest: see disclosure), a US company that trades as Glide.id, says its MagicalAuth product replaces SMS codes with verification through the mobile network, and in August 2026 it announced a beta across AT&T, T-Mobile and Verizon. Before a pilot, get written answers on how the method would be classified under NIST SP 800-63B-4, when and how fallback triggers, which devices, operating systems and plans are covered, how SIM swaps and eSIM transfers are handled, what data is processed, what it costs and how you would leave. We found no independent security assessment in our sources.
Explainer
The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Explainer
A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.