Blog Series #1 — SIM swapping: why 2FA should not live on your phone number

An SMS 2FA code goes to the number, not to you. If someone takes over the SIM, account recovery lands on the wrong phone.

José Eduardo Morini CastroOct 12, 20264 min

SIM swapping is an attack in which someone convinces the carrier to issue a new SIM with your number. Your phone loses signal. The attacker’s device starts receiving calls and SMS messages for that number.

That sounds like a telephony problem. For anyone using SMS two-factor authentication, it becomes an account problem.

The second factor should be something only you control. A phone number is not that. The number belongs to the carrier. An authenticator app generates the code on your device from a secret that does not travel with the SIM.

What SIM swapping is

The attacker does not need your physical phone. They need your number.

In practice this usually goes through the carrier: a port-out, a “replacement” SIM, a support flow where identity is weak. Once the number is rerouted, SMS stops being a message to you and becomes a message to whoever controls that number’s destination.

The important point is not the theater of the scam. It is the trust model. The account is asking “who can receive SMS at this number?”, not “who has the device you enrolled?”.

Why SMS is not a second factor

Two-factor authentication exists to require two different things: something you know, like the password, and something you have.

SMS fails the second part. The code does not live on your device. It is delivered to a public address, the number, which the carrier can reassign.

password  +  SMS to the number
                  │
                  ▼
              carrier
                  │
                  ▼
        whoever holds the SIM

If the password leaks, SMS can still look like a safety net. In a SIM swap, that net falls with it: the attacker receives the login code and, worse, the password-reset code.

Many services treat the number as an emergency channel. Forgot your password? We will send an SMS. In that design, the second factor and account recovery live in the same place. Whoever gets the number gets both.

The authenticator app does not travel with the SIM

An authenticator app works differently. At enrollment, the service and your device share a secret. From then on, the six-digit code is generated locally, every 30 seconds, without going through the carrier.

service  +  secret in the app
                  │
                  ▼
              TOTP code
                  │
                  ▼
        only who has the device

Swapping the SIM does not take that secret. The attacker can receive SMS on your number and still cannot generate the app’s code.

That holds for an authenticator on the phone, in a password manager, or on a hardware key. The test is the same: the second factor needs to live in a secret or a key you control, not in how a number is routed.

There is one caveat. If the authenticator itself recovers the account by SMS, the problem comes in through the back door. Authenticator backup needs to sit on another factor, not on the number a SIM swap hijacks.

What to do now

Leave SMS 2FA on the accounts that matter: email, GitHub, cloud, bank, password manager. Switch to an authenticator app. Where it exists, prefer passkeys or a security key.

Remove the phone number from account recovery whenever the service allows it. If the carrier offers a port-out PIN or an account PIN, turn it on. That does not replace the authenticator, but it makes swapping the SIM more expensive.

The practical order is simple:

1. authenticator instead of SMS
2. unique password in the manager
3. number out of recovery

SMS 2FA is still better than having no second factor. It is just not a real second factor. The code needs to live in the authenticator app, not on the phone number.