When Your Phone Number Gets Hijacked: SIM Swapping and the Trouble with Text Message Codes

Most of us think of a phone number as the way people reach us, whether that’s a client, a vendor, or the dentist’s office reminding us we’re overdue for a cleaning. Over the past decade, though, that same number quietly picked up a second job as a security checkpoint for many of our most important accounts. Every time a website texts you a six-digit code to prove it’s really you, your phone number is standing at the door checking IDs.

The trouble is that this particular security guard can be reassigned to a different building without you ever being told, and that’s exactly what SIM swapping takes advantage of.

First, What Is a SIM?

A SIM (Subscriber Identity Module) is the small chip (or, in many newer phones, a digital “eSIM”) that tells your mobile carrier which phone your number belongs to. If your phone number were your mailing address, the SIM would be the mailbox the post office delivers to.

Carriers move phone numbers from one SIM to another all the time for perfectly good reasons, such as when you buy a new phone, lose your old one, or drop it in a lake at the company picnic. In fact, the Federal Communications Commission noted in its 2023 rulemaking that the vast majority of SIM change requests are legitimate. That everyday convenience is also the opening criminals use.

So, What Is SIM Swapping?

SIM swapping happens when a criminal gets your carrier to move your phone number onto a SIM that they control. According to the FBI, criminals primarily pull this off in three ways:

• Social engineering: they contact the carrier, pretend to be you, and talk their way into a number transfer.
• Insider help: they pay off a carrier employee to make the switch for them.
• Phishing: they trick carrier employees into downloading malicious software that gives the criminals access to the systems that perform SIM changes.

The social engineering version is the one worth picturing, because it requires a confident voice far more than technical skill. Someone calls customer support, sounds a little frazzled, explains that their phone was lost or broken, and answers the account questions with personal details about you that are often easier to find than any of us would like. If the story holds up, your number moves to their phone.

On your end, the first sign is usually that your phone suddenly has no service, which is easy to blame on a bad signal or a dead zone. Meanwhile, as the FBI describes it, your calls and texts are now being delivered to the criminal’s device instead of yours.

Why a Stolen Phone Number Is Such a Big Deal

Losing your number would be inconvenient on its own, but the real problem is everything that number unlocks. The FBI warns that once criminals control a victim’s number, they can request “Forgot Password” and account recovery links for email and other accounts tied to that number. Those reset codes and login codes arrive by text, which means they now arrive on the criminal’s phone.

Multi-factor authentication is supposed to work like needing both a key and a fingerprint to get through a door. When the second factor is a text message, though, it’s more like a fingerprint that can be mailed to whatever address the post office has on file, so anyone who changes the address gets the fingerprint too.

The Experts Have Been Saying This for a While

If you’ve heard an IT person grumble about text message codes, they aren’t just being picky. Several government agencies have also weighed in on using text messaging for one of your MFA factors:

• NIST, the agency that publishes the federal digital identity guidelines many organizations follow, classifies authentication codes sent over the phone network (including SMS) as a “restricted” authenticator in its current guidance. It is the only method in that category, and organizations that use it are expected to assess and accept the risks that come with it.
• CISA, the federal Cybersecurity and Infrastructure Security Agency, published guidance in December 2024 that directly advises against using SMS as a second factor, pointing out that text messages are not encrypted. The guidance was written with high-profile individuals in mind, but CISA noted that its advice applies to everyone.
• In 2023 the FCC adopted rules that require wireless carriers to use secure methods of verifying customers before moving a number to a new SIM, and to notify customers when a SIM change is requested.

While the FCC rules are a welcome improvement, even with better carrier safeguards a text message code still travels through a system that neither you nor your business controls.

What to Use Instead

The good news is that the more secure alternatives are easy to use, and most people adjust to them within a day to a couple of weeks.

• Authenticator apps generate login codes directly on your phone, so the code never travels over the phone network. If someone hijacks your number, your authenticator app doesn’t go with it.
• Push notifications with number matching send an approval request to an app on your phone and ask you to type in a number shown on the login screen. CISA recommends number matching specifically because it makes it much harder for attackers to trick someone into tapping “Approve” on a login they didn’t start.
• Passkeys and physical security keys use the FIDO standard, which CISA describes as phishing-resistant. These are considered the strongest option available today.

It’s also worth adding a PIN or passcode to your mobile phone account, which adds an extra hurdle for anyone trying to make changes to your account by pretending to be you.

To be fair to text messages, SMS isn’t banned, and NIST still allows it with conditions. If a website offers nothing else, a text code is better than relying on a password alone. When a stronger option is available, though, it’s worth taking.

Closing the loop for your business

For a business, the stakes go up quickly. If a single employee’s phone number is hijacked and that number is the second factor for their work email, the attacker may be able to reset the password and walk right in. Email tends to be the master key for everything else, including vendor portals, banking notifications, and password resets for other systems.

That’s why many IT teams turn off text message codes entirely and move everyone to an authenticator app or push-based approval. It isn’t about making life harder; it’s about making sure the security guard at the door works for you, and can’t be reassigned by someone with a convincing phone voice and a sad story about a lake.