What a SIM swap is and why it matters

A plain explanation of how phone number hijacking defeats SMS-based two-factor authentication, and what to put in its place.

A SIM swap happens when an attacker convinces a mobile carrier to port a victim's phone number to a SIM card the attacker controls. Once the number is theirs, they intercept SMS messages and use them to reset passwords on exchange accounts, email accounts, and any wallet that relies on text-message codes for two-factor authentication.

It is not an attack on a blockchain or a smart contract. It is an attack on the carrier's customer service process, which sits upstream of almost every account recovery flow in the industry. That makes it relevant to anyone doing wallet or exchange forensics, because the entry point was never the chain at all.

Why this matters for practitioners

A SIM swap collapses the distinction between 'the victim's account' and 'the victim's phone number.' Any system that treats SMS as a trusted second factor is implicitly trusting the carrier's identity-verification process, which analysts have no visibility into and cannot audit after the fact.

• SMS-based 2FA protects against password guessing, not against carrier-level social engineering.
• Centralized exchange accounts tied to a phone number are exposed even if the underlying wallet security is otherwise sound.
• Email accounts often cascade: once SMS resets email, email resets everything else downstream.

What to actually do about it

• Move 2FA off SMS entirely, to a hardware security key or an authenticator app that does not depend on the phone network.
• Treat the carrier's account-recovery process as the weakest link in the stack, not an afterthought.
• Where SMS cannot be removed, add a PIN or passcode directly with the carrier to make porting harder.
• Separate high-value accounts from the phone number used for day-to-day communication where possible.

The weak point in a SIM swap is never the cryptography. It is the human process a carrier uses to decide who gets a phone number.

For analysts reviewing how an account was compromised, the question worth asking early is whether 2FA relied on SMS at any point in the chain. If it did, the carrier's recovery process deserves as much scrutiny as the wallet itself.

WalletDNA's glossary keeps terms like this defined in plain language for analysts who need a fast, accurate reference mid-investigation: https://walletdna.com/glossary