SIM Swap Fraud: Why SMS Verification Keeps Failing After Onboarding

SIM swap fraud works because the phone number was never a secure channel. It was a convenient one, and for years the industry treated convenience as if it were security. The attack is not sophisticated, it is not new, and the standard defenses mostly relocate it rather than remove it. What removes it is taking the phone number out of the authentication path entirely.

How the attack works

At the pattern level: an attacker convinces a mobile carrier to move a victim's phone number onto a SIM the attacker controls. The methods are social, not technical: impersonation at a retail store, a bribed or careless support agent, leaked personal data used to pass the carrier's account checks. Once the number moves, every SMS meant for the victim arrives on the attacker's device, including the one-time passcodes that guard bank logins, password resets, and transaction approvals.

Notice the target. The attacker never touched the victim's bank, never phished a password, never broke any cryptography. They attacked the carrier's customer service process, which is the actual security perimeter of every SMS-based authentication system, whether the institutions relying on it think of it that way or not.

Why the timing of the attack matters

Here is the detail fraud teams already know and most content on this topic misses: SIM swap does not attack onboarding. It attacks everything after.

At account opening, a customer passes through the strongest checks they will ever face: documents, biometrics, database lookups, carrier signals. The fraudster does not fight that battle. They wait. The account ages, the assurance decays, and the daily authentication surface becomes an SMS code. That is the surface SIM swap targets: the long, quiet stretch between onboarding and every login, transfer, and password reset that follows.

The institution spent real money verifying the customer once. The attacker spends a phone call defeating the check that replaced all of it.

Why the standard mitigations relocate the problem

Carrier PINs and port-freeze locks raise the cost of the swap, but the enforcement point is still a support agent having a conversation with a stranger. The perimeter has not moved; it has a second lock on the same door.

Switching from SMS to voice calls changes the format of the interceptable message.

Authenticator apps are a real improvement, since the code no longer travels through the carrier. But most deployments keep SMS alive as the fallback, and attackers do not use the strong path when a weak one is offered. A fallback is a front door with a spare key under the mat.

The common thread: as long as a phone number can authenticate anything, the carrier's account-recovery process is part of your security model, and it is the part you neither control nor audit.

What actually closes it

Remove the phone number from the authentication path. Not augment it, not rate-limit it: remove it.

A passkey bound to the customer's device does this structurally. Authentication becomes a cryptographic ceremony between the enrolled device and the institution's servers. There is no code in transit to intercept, no channel to redirect, and no number whose ownership matters. A fraudster who successfully swaps the victim's SIM has acquired the ability to receive text messages that no longer decide anything.

In Passkeys+, the credential is bound with MPC-based device binding, so it also cannot be exported or replayed from other hardware: the phishing-resistant, cryptographic ceremony only completes with the genuinely enrolled device. And when the credential is enrolled during onboarding itself, at the moment of highest assurance, the vulnerable stretch never opens at all. The account goes from verified to cryptographically authenticated with no SMS era in between. That pattern is covered in depth in KYC Passkeys.

The uncomfortable summary

SIM swap is not a flaw in SMS authentication. It is the design of SMS authentication, seen from the attacker's side. The channel authenticates whoever the carrier believes owns the number, and the carrier can be persuaded. Defenses that keep the number in the loop are negotiating with that fact. Removing the number ends the negotiation.

If your fraud roadmap includes retiring SMS from the authentication path, that migration is exactly what we build: book a demo, or start with the evidence in the security report.

REVIEWER NOTES (delete before publish): 1. Attack description stays at the pattern level deliberately: no step-by-step detail beyond what any fraud-team reader already knows. 2. No loss figures or incident stats cited; if we want them, they must come from named, verifiable sources (e.g., FBI IC3 annual report) and be checked against the original. 3. [GRAPHIC B3-1] goes after "Why the timing of the attack matters": account lifecycle timeline with the attack window shaded across SMS re-auth events, vs. the same timeline with a bound passkey where the window never opens. 4. Links: A2 (/post/what-is-device-binding), A1 (/post/whats-inside-passkeys-plus), and A3 (/post/mpc-authentication-explained) are drafts and 404 until published; the SMS OTP, TOTP, MFA-circumvention, telecom-bypass, and B1 links are live. B4 link removed; that post is being deleted.