Everything valuable still routes through a phone number — bank OTPs, wallet resets, exchange confirmations, account recovery — and the number is not protected by any of those systems. It is protected by a carrier. SIM swap is the attack on that layer: move the number to attacker-controlled hardware, and every code the victim's accounts send arrives on the attacker's desk instead. This is the 2026 version — port-out timelines, where carrier social engineering still works, the post-swap exit window, and the OPSEC that survives the victim noticing.
ROUTE MAP (PLAIN ENGLISH)
A phone number is bound to a SIM card by the carrier, and carriers bind it through identity processes built for retail customers, not adversaries. The swap happens two ways: an internal change (the attacker convinces carrier support that they are the subscriber, and the number is re-provisioned onto a new SIM the attacker holds) or an external port (the attacker initiates a port-out to a different carrier under the victim's details, which deactivates the original line mid-transfer). Either way the outcome is identical — the number now terminates on attacker hardware, and the victim's handset goes silent.
The clock matters more than the technique. Financial institutions hold recovery windows: the swap-to-drain sequence is usually minutes to hours for automated systems, longer for anything requiring manual review — and the victim's first notice is a signal that fires SMS-forwarding detection, carrier lockouts, and support calls. Speed on the entry side (number acquired, codes received) and quiet on the exit side (withdrawals split, destinations aged) are what separate a clean run from a frozen account with a fraud file attached to the victim's name.
STEP 1 - TARGET SELECTION AND RECON
STEP 2 - THE SWAP ITSELF
STEP 3 - THE RECOVERY BLITZ
STEP 4 - POST-SWAP EXIT
STEP 5 - FLAGS AND FAILURE MODES
WORKED EXAMPLE - EMAIL + BANK WINDOW
Target: number is the sole recovery factor for a webmail account and the SMS-2FA on a mid-size bank's wire capability. Recon collects carrier, name of record, and a partial billing address from an old breach; the carrier's verification for this prepaid line answers to name plus DOB plus a security question answered in the same breach. Wednesday 02:40, swap executed via support with a damaged-SIM script; the attacker's handset holds the line by 02:47 — the victim, asleep, does not notice until morning. 02:49 webmail recovery: password reset consumed, session established, recovery phone replaced. 03:20 (not 02:51 — spaced from the email event to break correlation): bank login from an aged device fingerprint, SMS-2FA consumed, wire capability verification kicked off with a cooldown that lands at 09:00. The 09:00 withdrawal executes to an aged beneficiary; victim discovers the swap at 07:15, line is restored by 07:40 — forty minutes too early to matter, because the irreversible leg was already complete and the beneficiary was not fresh.
WORKING SEQUENCE
QUICK ANSWERS
RELATED
A phone number is bound to a SIM card by the carrier, and carriers bind it through identity processes built for retail customers, not adversaries. The swap happens two ways: an internal change (the attacker convinces carrier support that they are the subscriber, and the number is re-provisioned onto a new SIM the attacker holds) or an external port (the attacker initiates a port-out to a different carrier under the victim's details, which deactivates the original line mid-transfer). Either way the outcome is identical — the number now terminates on attacker hardware, and the victim's handset goes silent.
The clock matters more than the technique. Financial institutions hold recovery windows: the swap-to-drain sequence is usually minutes to hours for automated systems, longer for anything requiring manual review — and the victim's first notice is a signal that fires SMS-forwarding detection, carrier lockouts, and support calls. Speed on the entry side (number acquired, codes received) and quiet on the exit side (withdrawals split, destinations aged) are what separate a clean run from a frozen account with a fraud file attached to the victim's name.
STEP 1 - TARGET SELECTION AND RECON
- Number-linked asset map first: before touching the carrier, map what the number actually protects — email recovery, bank OTP, wallet and exchange 2FA, cloud backups, social account resets. A number guarding nothing but marketing SMS is not a target; a number that is the sole recovery factor for a funded account is.
- Subscriber detail recon: carrier name (from porting databases or the number's behavior), name of record, partial billing details, last four of the payment method on the account — all of this surfaces through breach data, social recon, and the target's own digital exhaust. Carrier verification scripts are built around exactly these fragments; collect them before the call, not during it.
- Prepaid vs postpaid asymmetry: prepaid lines with no billing relationship verify against thinner data (name, DOB, security answer) while postpaid lines with account numbers and PINs demand more. The weakest verification surface on the target's carrier wins — sometimes that is the line itself, sometimes a family or business account the line hangs under.
- Port-out protections inventory: many carriers and regions now default port-out PINs, in-store-only porting, or app-confirmation flows. Identify which protections the specific carrier applies before committing to internal vs external path — a carrier with hard port-out locks pushes the play back to social engineering support.
STEP 2 - THE SWAP ITSELF
- Internal reprovision path: support contact with harvested identity fragments, a script built around a believable reason (SIM damaged, phone lost, traveling), and a SIM the attacker controls ready to receive the re-provisioned line. Consistency beats sophistication — details that contradict the carrier's own records fail instantly; details that match partial records pass because the verifier is matching, not investigating.
- External port-out path: port request filed under the victim's details with the receiving carrier; the moment it processes, the original line drops and the number lives on the attacker's SIM. Port-outs are messier — confirmations sometimes reach the victim through app or email channels the attacker does not control, which is why the internal path is quieter when it is available.
- Verification moment discipline: carrier reps escalate when the caller's story shifts under follow-up questions. Pre-answer the three follow-ups the flow is built to ask (recent charges, plan type, payment method), keep the reason mundane, and never improvise new details — contradictions are what turn a routine swap into a flagged account note that blocks the next attempt.
- The silence check: the instant the swap completes, the victim's handset loses service. Every second between that moment and their next phone use is the attacker's window — some swaps run unnoticed for hours because the victim is asleep, flying, or simply not calling anyone.
STEP 3 - THE RECOVERY BLITZ
- Priority order by liquidity: email first (it is the master recovery factor for everything else), then the funded accounts — bank OTP reset, wallet withdrawal confirmation, exchange 2FA disable. Each system has its own cooldown after a number change; map which ones apply, because a forced cooldown is not a failure, it is a scheduled second visit.
- Code hygiene: SMS codes arrive on the attacker's hardware now — never reply to them, never forward them from a phone tied to the identity, and never trigger a code you cannot consume immediately; excess reset requests across services create a correlated timeline that investigators reconstruct later.
- Simultaneous vs sequential: hitting email, bank, and exchange in the same ten minutes builds a perfect cross-service correlation; spacing consumption to each service's natural pattern (password reset, then login, then withdrawal hours later) reads as the account holder returning to their accounts. The money does not care about speed — the detection stack does.
- Victim-side clock: assume the victim discovers the swap within hours. Anything requiring their cooperation (bank freeze, carrier restore) becomes possible at discovery — which is why withdrawal paths that are irreversible the moment they execute (chain transfers, cash pickup, P2P to aged accounts) are the only ones that matter in this window.
STEP 4 - POST-SWAP EXIT
- Irreversible first, everything else never: movement that cannot be clawed back at the moment of execution is the only exit that counts during the discovery window. Reversible steps (bank-to-bank, card credits, reversible wallet states) can be frozen by any participant downstream — sequence them out of the critical path entirely.
- Chain conversion discipline: if value moves to crypto, the conversion venue, deposit address age, and withdrawal destination all carry metadata. Fresh addresses, immediate sweeps to aged wallets, and privacy-preserving movement are OPSEC primitives — not optimizations — because every hop is logged by someone.
- Laundering patience vs window urgency: these two pressures fight each other. The window pressure says move fast before the freeze; laundering discipline says move clean. Resolution: execute the irreversible leg fast, then take all the time you want inside assets that are already out of reach — the freeze lists only touch rails that still answer to institutions.
- Handset hygiene: the attacker's SIM and the codes it received are physical evidence. Do not keep the SIM in a device tied to anything else, retire the number after the window closes, and never reuse a swap number across two targets — carrier fraud teams correlate swap histories across accounts.
STEP 5 - FLAGS AND FAILURE MODES
- Carrier-side detection: modern carriers score swap requests against device-location history (the real phone is still somewhere else), port-out patterns (multiple ports in short periods), and account notes. A swap that contradicts the phone's live location data gets held — sometimes silently, which is worse than an outright refusal because the attacker believes it worked.
- Service-side detection: banks and wallets watch for SIM-change-then-login sequences, new-device-plus-new-SMS patterns, and withdrawal velocity after number changes. Many institutions now hold withdrawals for a cooling period after any recovery-factor change — the attacker's account view says success while the money sits in a review queue.
- Victim discovery effects: victim calls the carrier from a landline or via Wi-Fi calling, the line gets restored, and the attacker loses access mid-run. Any credentials captured before that moment retain value; anything not yet consumed is a race against restoration. Assume restoration happens and sequence accordingly.
- Evidence trail: carrier records tie the swap to identity fragments used, call recordings, and device identifiers. The fragments that pass verification are the fragments in the case file — which is why harvested detail should be accurate enough to pass and thin enough to limit what the file can grow into.
WORKED EXAMPLE - EMAIL + BANK WINDOW
Target: number is the sole recovery factor for a webmail account and the SMS-2FA on a mid-size bank's wire capability. Recon collects carrier, name of record, and a partial billing address from an old breach; the carrier's verification for this prepaid line answers to name plus DOB plus a security question answered in the same breach. Wednesday 02:40, swap executed via support with a damaged-SIM script; the attacker's handset holds the line by 02:47 — the victim, asleep, does not notice until morning. 02:49 webmail recovery: password reset consumed, session established, recovery phone replaced. 03:20 (not 02:51 — spaced from the email event to break correlation): bank login from an aged device fingerprint, SMS-2FA consumed, wire capability verification kicked off with a cooldown that lands at 09:00. The 09:00 withdrawal executes to an aged beneficiary; victim discovers the swap at 07:15, line is restored by 07:40 — forty minutes too early to matter, because the irreversible leg was already complete and the beneficiary was not fresh.
WORKING SEQUENCE
Code:
recon: asset map (what the number guards) + carrier + verification surface + port-out protection check -> choose: internal reprovision (thinner data) vs external port-out (confirmations leak harder) -> swap: pre-answered follow-ups, mundane reason, SIM ready, silence check on completion -> consume: email first, funded accounts second, spacing natural, cooldowns scheduled not fought -> exit: irreversible leg fast, aged destinations, chain hygiene, no reversible rails in critical path -> retire: SIM out of tied devices, number burned, never reused across targetsQUICK ANSWERS
- Internal swap or port-out — which is cleaner? Internal reprovision, when the carrier's verification surface is thin enough to match. It generates no external confirmation to the victim's other channels and no port record at a second carrier — port-out is the fallback when support will not move the line without the account PIN you do not have.
- Why do banks still trust SMS after everything? Cost and coverage — SMS reaches every handset on earth with no app install, and switching costs land on users, not institutions. The security community has flagged SMS 2FA for a decade; the installed base keeps it alive, which is exactly why it remains the highest-value layer to attack.
- What is the discovery window really? Until the victim next uses their phone for anything — a call, a text, a data notification. For many targets that is minutes; for anyone asleep or traveling it is hours. All irreversible work must complete inside the conservative version of that window, assuming discovery at any moment.
- Does the victim's phone keep working after the swap? On their handset: no — the line deactivates the moment the SIM is re-provisioned or the port completes, and they see No Service. Wi-Fi calling and app-based messaging may still function independently of the carrier line, which is why the quiet window ends the moment they notice and route around it.
- What kills a swap run before it starts? A number that is not the recovery factor. If the email has its own authenticator app and the bank has a separate hardware key, moving the number yields nothing but a carrier record. The asset map in recon exists precisely to prevent swapping into a target with no value behind it.
- Should the number be reused on the next target? Never. Carrier fraud teams, service security teams, and investigators all correlate history attached to a number — a second swap on the same line links both cases together and hands the pattern to whoever is reviewing the first one.
RELATED