What is SIM-swap-assisted account takeover?¶
SIM-swap-assisted account takeover occurs when control of a victim’s mobile number is used to intercept authentication or recovery messages.
Avoid the dangerous assumption¶
The dangerous assumption is that possession of a one-time code proves the genuine subscriber received and entered it.
An offender may persuade or deceive a mobile provider into transferring the number to another SIM or service.
Once control changes, the offender may receive calls, messages or codes intended for the victim.
The mobile number may then be used to:
- reset passwords
- complete account recovery
- approve authentication
- take control of email, banking or other services.
Relevant evidence may exist with:
- the mobile provider
- the affected account provider
- the victim’s device
- customer-service records
- SIM or eSIM change records
- number-porting records
- authentication logs
- password-reset events
- subsequent account sessions.
Investigators should establish when control of the number changed and compare that with account recovery and access events.
Do not assume every loss of mobile service is a SIM swap. Network faults, device issues and legitimate changes may produce similar symptoms.
Likewise, a SIM swap does not by itself prove which downstream account was accessed.
The subscriber, account holder and offender may all be different people.
Provider-specific processes and available records vary and should be verified during drafting or casework.
SIM swap may be one part of a wider method involving leaked personal data, social engineering and prior credential theft.
Operational takeaway¶
Link the timing of mobile-number control changes with recovery, authentication and account activity, and avoid treating receipt of a code as proof of legitimate user action.