SIM swap fraud: how it works and why SMS codes aren't enough
In a SIM swap, an impostor takes over the victim's phone number and with it their SMS passcodes. How the attack works and how to protect card payments from it.
A SIM swap moves a phone number onto a SIM card the impostor controls. The victim's phone loses signal. The impostor's phone starts receiving their calls and texts, including every one-time passcode the bank sends.
How it happens
- The impostor gathers personal details from data breaches, social media or phishing.
- They contact the mobile operator posing as the victim, or bribe or deceive staff, and ask for the number to move to a new SIM or to another operator.
- Once the number moves, they request password resets and payment codes, which now arrive on their device.
Why SMS passcodes are the weak point
An SMS code proves possession of a phone number, not of a phone. When the number moves, the proof moves with it. That is why a SIM swap can defeat authentication that relies on text messages, even when everything else is done correctly.
Protecting card payments
- Bind approvals to the device, not the number: a key held in the phone's secure hardware stays with the phone when the number moves.
- Treat a recent SIM change as context, and ask for approval on the enrolled device rather than by text.
- Make the cardholder's own phone the place they say yes or no, so an impostor holding only the number has nothing to approve with.
In 0Fraud, approvals come from the enrolled phone's secure chip. An impostor who has taken the number still doesn't have the phone, so they can't approve anything.