SIM Swap Attack Defense

Name, address, date of birth, the last four digits of a card, sometimes an account number. Most of this is available in old breach data, on social media, or from data brokers. Some is phished from you directly with a fake carrier text.

A call to support, a chat session, or a walk-in at a store with a fake ID. The story is always the same: a lost or damaged phone, and a new SIM is needed urgently.

Your phone shows "No Service" or "SOS only". Many people assume it is a network outage, and that assumption buys the attacker the time they need. If you cannot call or text but Wi-Fi still works normally, treat it as an attack until proven otherwise.

Email first, because it unlocks the rest. Then banking, exchanges, and social accounts. Each "forgot password" flow texts a code to a number they now control. The whole sequence often takes under thirty minutes.

Tell them explicitly that you believe your number has been fraudulently transferred and ask them to reverse it and freeze the account. Do not wait to see whether service comes back.

Your phone still has internet access even with no cellular service. Change the email password, revoke all active sessions, and remove the phone number as a recovery option. Email first, always -- it is the key to everything else.

Tell them your number is compromised and ask them to block SMS-based verification and freeze transfers pending identity checks in person.

Change passwords and revoke sessions everywhere that used SMS. Assume anything with SMS recovery has been reached.

File with your national cybercrime service -- ic3.gov in the US -- and ask the carrier in writing for records of the change. You will need these for any dispute, and carriers have been held liable in some jurisdictions.

Go: open a terminal in a folder you can write to — cd ~/Desktop on macOS or Linux, cd %USERPROFILE%\Desktop on Windows.

Do: save this as portout.py and run python3 portout.py.

"""A SIM swap is a database change at the carrier. Your phone is not involved."""

carrier_record = {
    "number": "+44 7700 900412",
    "subscriber": "S. Whitfield",
    "active_sim": "8944 1234 5678 9012 345",     # the chip in your handset
}

print("before:")
for k, v in carrier_record.items():
    print("   %-12s %s" % (k, v))

# The attacker persuades a shop or a call centre that he is the subscriber.
carrier_record["active_sim"] = "8944 9999 0000 1111 222"

print()
print("after (one field changed):")
for k, v in carrier_record.items():
    print("   %-12s %s" % (k, v))

print()
print("what happened to your handset  :", "nothing")
print("what happened to your passwords:", "nothing")
print("what happened to your phone    :", "it stops receiving calls and texts")
print("where your texts go now        :", "his handset")
print()
print("No malware, no hacking, no password. One field in one database,")
print("changed by a member of staff who believed a caller.")

You should see: one field different, and everything downstream of it redirected:

before:
   number       +44 7700 900412
   subscriber   S. Whitfield
   active_sim   8944 1234 5678 9012 345

after (one field changed):
   number       +44 7700 900412
   subscriber   S. Whitfield
   active_sim   8944 9999 0000 1111 222

what happened to your handset  : nothing
what happened to your passwords: nothing
what happened to your phone    : it stops receiving calls and texts
where your texts go now        : his handset

No malware, no hacking, no password. One field in one database,
changed by a member of staff who believed a caller.

This is worth dwelling on because it defeats the intuition people bring to security problems. Nothing was installed, nothing was cracked, and your phone was never touched — it simply stops receiving service, because the network now associates your number with a different chip.

The consequence is that none of your personal defences apply. The vulnerability is in a customer-service process at a company you are a customer of, and the only controls that matter are the ones that company offers you — which is step 5.

If not: this script only prints a dictionary and cannot really fail; if the two blocks look identical, the assignment between them was removed.

Go: the same folder.

Do: save this as timeline.py and run python3 timeline.py.

"""The window, in minutes. This is why the first symptom matters so much."""

EVENTS = [
    (0,   "the swap completes; your phone shows 'No Service'"),
    (2,   "attacker requests a password reset on your email"),
    (3,   "reset code arrives on his handset; email taken over"),
    (7,   "email searched for 'bank', 'crypto', 'invoice'"),
    (11,  "bank password reset; SMS one-time code arrives on his handset"),
    (18,  "transfer initiated"),
    (140, "you find a shop, prove who you are, and get the number back"),
]

print("%6s  %s" % ("MINUTE", "EVENT"))
print("-" * 66)
for minute, event in EVENTS:
    print("%6d  %s" % (minute, event))

attack_done = 18
recovery = 140
print()
print("attacker needed      :", attack_done, "minutes")
print("you needed           :", recovery, "minutes")
print("your margin          :", attack_done - recovery, "minutes")
print()
print("'No Service' where there is normally coverage is not a network fault")
print("until you have checked. It is the only warning you get, and it")
print("arrives at minute zero.")

You should see: the attack finishing roughly two hours before you can respond:

MINUTE  EVENT
------------------------------------------------------------------
     0  the swap completes; your phone shows 'No Service'
     2  attacker requests a password reset on your email
     3  reset code arrives on his handset; email taken over
     7  email searched for 'bank', 'crypto', 'invoice'
    11  bank password reset; SMS one-time code arrives on his handset
    18  transfer initiated
   140  you find a shop, prove who you are, and get the number back

attacker needed      : 18 minutes
you needed           : 140 minutes
your margin          : -122 minutes

'No Service' where there is normally coverage is not a network fault
until you have checked. It is the only warning you get, and it
arrives at minute zero.

The minute figures are an illustration rather than a measurement — they describe a plausible sequence, not a timed observation. What is not an illustration is the order: email first, because everything else can be reset through it, then a search of that mailbox to find out where the money is.

The practical point is the first line. Your only warning is your phone losing service, and the natural interpretation of that is “the network is playing up”. If you lose service somewhere you normally have it, and a companion standing next to you on the same network does not, that is worth two minutes of checking on wi-fi rather than two hours of waiting.

If not: if your margin prints a positive number, the subtraction was reversed — the whole point is that it is negative by a wide margin.

Go: the same folder.

Do: save this as exposure.py and run python3 exposure.py.

"""Which of your accounts hand something to whoever holds the number?"""

ACCOUNTS = [
    ("email",             "SMS reset",      "catastrophic -- everything resets through it"),
    ("bank",              "SMS code",       "severe -- money moves"),
    ("crypto exchange",   "SMS code",       "severe -- irreversible"),
    ("password manager",  "app + codes",    "none -- no SMS route"),
    ("social",            "SMS reset",      "moderate -- impersonation, contact list"),
    ("work single sign-on","app + key",     "none -- no SMS route"),
    ("shopping",          "SMS reset",      "minor -- saved cards"),
]

print("%-22s %-16s %s" % ("ACCOUNT", "USES THE NUMBER", "IF THE NUMBER MOVES"))
print("-" * 86)
for name, method, impact in ACCOUNTS:
    print("%-22s %-16s %s" % (name, method, impact))

exposed = [a for a, m, _ in ACCOUNTS if "SMS" in m]
print()
print("accounts reachable through the number:", len(exposed), "of", len(ACCOUNTS))
print("   ", ", ".join(exposed))
print()
print("Every one of those can be moved off SMS today, in settings, for free.")
print("The two showing 'none' are not more secure by luck -- somebody chose.")

You should see: five of seven accounts reachable through one phone number:

ACCOUNT                USES THE NUMBER  IF THE NUMBER MOVES
--------------------------------------------------------------------------------------
email                  SMS reset        catastrophic -- everything resets through it
bank                   SMS code         severe -- money moves
crypto exchange        SMS code         severe -- irreversible
password manager       app + codes      none -- no SMS route
social                 SMS reset        moderate -- impersonation, contact list
work single sign-on    app + key        none -- no SMS route
shopping               SMS reset        minor -- saved cards

accounts reachable through the number: 5 of 7
    email, bank, crypto exchange, social, shopping

Every one of those can be moved off SMS today, in settings, for free.
The two showing 'none' are not more secure by luck -- somebody chose.

Rewrite this table with your own accounts and the exercise stops being theoretical. Most people find the first row is true of them — email with SMS recovery enabled — and that one row is the reason the others matter, because email is how everything else is reset.

Removing SMS recovery is usually a setting, not a purchase. Many services let you delete the phone number entirely once an authenticator app or backup codes are in place; some keep it as a fallback whether you like it or not, and those are worth knowing about, because for those accounts the carrier-side controls in step 5 are your only defence.

If not: if the exposed count is not 5, a row's middle column was reworded — the filter matches on the text SMS appearing in it.

Go: the same folder.

Do: save this as survives.py and run python3 survives.py. The first line checks the implementation against the test vector published in the standard itself, so you are not taking the rest on trust.

"""Prove that app-based 2FA is not tied to your phone number."""
import base64, hashlib, hmac, struct, time

def totp(secret_b32, at):
    key = base64.b32decode(secret_b32, casefold=True)
    counter = struct.pack(">Q", at // 30)
    digest = hmac.new(key, counter, hashlib.sha1).digest()
    offset = digest[-1] & 0x0F
    code = struct.unpack(">I", digest[offset:offset + 4])[0] & 0x7FFFFFFF
    return "%06d" % (code % 1_000_000)

SECRET = "GEZDGNBVGY3TQOJQGEZDGNBVGY3TQOJQ"     # what the QR code contained

# Check against the published RFC 6238 test vector before trusting anything else.
RFC_SECRET = base64.b32encode(b"12345678901234567890").decode()
print("RFC 6238 test vector at T=59:", totp(RFC_SECRET, 59), "(expected 94287082 -> last 6: 287082)")

moment = 1_700_000_000
print()
print("your old phone   :", totp(SECRET, moment))
print("your new phone,  ")
print("  same secret    :", totp(SECRET, moment))
print()
print("phone number involved in that calculation:", "none")
print("network involved                        :", "none")
print()
print("A code comes from the secret plus the clock. Move the secret to a new")
print("device -- or keep it in an authenticator that syncs -- and the codes")
print("follow. Losing the NUMBER does not lose the account.")

You should see: the published vector matching, and two devices producing the same code:

RFC 6238 test vector at T=59: 287082 (expected 94287082 -> last 6: 287082)

your old phone   : 921300
your new phone,  
  same secret    : 921300

phone number involved in that calculation: none
network involved                        : none

A code comes from the secret plus the clock. Move the secret to a new
device -- or keep it in an authenticator that syncs -- and the codes
follow. Losing the NUMBER does not lose the account.

The first line is the important one methodologically: RFC 6238 publishes 94287082 as the correct value for that secret at that moment, and truncating it to six digits gives 287082, which is what the code produced. An implementation that agrees with the standard's own test vector is one you can reason from.

The rest follows: a code is a function of a secret and the clock. No network, no carrier and no phone number appear anywhere in that calculation, which is why moving the secret to a new device — or keeping it in an authenticator that syncs across your devices — keeps the account reachable even when the number is gone.

If not: if the first line does not print 287082, the secret string was altered; it must be the base32 encoding of the twenty ASCII characters 12345678901234567890, which the script computes rather than hard-codes.

Go: the same folder.

Do: save this as lockdown.py and run python3 lockdown.py.

"""What actually stops the swap, and what to do in the first thirty minutes."""

CONTROLS = [
    ("a port-out PIN / transfer PIN on the carrier account", "stops it",
     "ask your carrier to set one; it is separate from your voicemail PIN"),
    ("a 'number lock' / 'port freeze' setting",              "stops it",
     "in the carrier's app or account page, often off by default"),
    ("removing SMS as a recovery route on email",            "limits it",
     "the single highest-value change on this page"),
    ("an authenticator app or security key instead of SMS",  "limits it",
     "codes stop depending on the number, as step 4 proved"),
    ("a strong password on the phone itself",               "does nothing",
     "the swap happens at the carrier, not on your handset"),
    ("antivirus on the phone",                              "does nothing",
     "there is no malware involved at any point"),
]

print("%-54s %-12s" % ("CONTROL", "EFFECT"))
print("-" * 74)
for control, effect, _ in CONTROLS:
    print("%-54s %-12s" % (control, effect))

print()
print("controls that help  :", sum(1 for _, e, _ in CONTROLS if e != "does nothing"))
print("controls that do not:", sum(1 for _, e, _ in CONTROLS if e == "does nothing"))
print()
print("IF IT IS HAPPENING NOW -- the order matters:")
FIRST_30 = [
    "1. Use someone else's phone or wi-fi. Yours has no service.",
    "2. Ring your bank's fraud line first. Freeze, do not explain.",
    "3. Change the EMAIL password. Everything else resets through it.",
    "4. Sign out of all devices on the email account.",
    "5. Then ring the carrier and report the number as stolen.",
]
for line in FIRST_30:
    print("   ", line)

You should see: four controls that help, two that are irrelevant, and a running order:

CONTROL                                                EFFECT      
--------------------------------------------------------------------------
a port-out PIN / transfer PIN on the carrier account   stops it    
a 'number lock' / 'port freeze' setting                stops it    
removing SMS as a recovery route on email              limits it   
an authenticator app or security key instead of SMS    limits it   
a strong password on the phone itself                  does nothing
antivirus on the phone                                 does nothing

controls that help  : 4
controls that do not: 2

IF IT IS HAPPENING NOW -- the order matters:
    1. Use someone else's phone or wi-fi. Yours has no service.
    2. Ring your bank's fraud line first. Freeze, do not explain.
    3. Change the EMAIL password. Everything else resets through it.
    4. Sign out of all devices on the email account.
    5. Then ring the carrier and report the number as stolen.

The two “does nothing” rows are there because they are what people reach for first, and both miss entirely: the attack happens in a carrier's database, so neither the security of your handset nor any software on it is involved.

The single most valuable action is the first row. Ring your mobile provider, or open their app, and ask for a port-out PIN or number lock — a separate code required before your number can be moved to another SIM or another network. It is free, it takes a few minutes, and it converts “persuade a member of staff” into “know a secret you set”.

The running order at the bottom matters because instinct gets it wrong. People ring the carrier first, wait in a queue, and lose the email account while they are on hold. Freeze the money, then take back the email, and only then deal with the number.

If not: the counts are computed from the table, so changing a row's effect changes them correctly; if both counts are zero, the effect strings were edited and no longer match the literal does nothing the filter tests for.