SIM Swap
A SIM swap is an attack in which a criminal gets a victim's mobile number moved to a SIM or eSIM they control, usually by deceiving or bribing mobile carrier staff, so that calls and text messages for that number, including one-time codes, go to the attacker.
SIM swapping defeats SMS and voice MFA and, more damagingly, SMS-based account recovery, which often resets both the password and the second factor at once. It is one reason NIST's digital identity guidelines have treated codes sent over the public telephone network as a restricted authenticator since 2017, and in the United States the FCC adopted rules in 2023 requiring carriers to authenticate customers before SIM changes and number transfers. The durable fix is to stop relying on the phone number: move sign-in to passkeys or other phishing-resistant MFA, and remove SMS from recovery for high-value accounts. Microsoft Entra ID is ending the SMS and voice codes it delivers itself in 2027.
See also: MFA, account recovery, account takeover, OTP relay social engineering, smishing
Related on Start with Identity
- GlossaryMFA Fatigue
MFA fatigue, also called push bombing, is an attack in which someone who already has a user's password triggers push approval prompts over and over until the us
- GlossaryVishing (Voice Phishing)
Vishing, short for voice phishing, is social engineering carried out over a phone call, in which an attacker impersonates a trusted party to get the target to r
- GlossaryBrowser-in-the-Browser (BitB)
Browser-in-the-browser (BitB) is a phishing technique in which a web page draws a fake browser popup window, complete with title bar, address bar and padlock, o
- Blog46.5% of 2025-2026 identity breaches had no login for MFA to protect
SWI's Identity Breach Report 2026 classified 115 identity breaches from 2021 to October 2026. Where MFA status is known it was bypassed in 25 of 40 cases, and i
- Blog54% of business SaaS apps support passkeys or security keys. Only 13% let you require them
SWI's Phishing-Resistant MFA Support Matrix checked 95 business SaaS apps against their own documentation. 51 support passkeys or FIDO2 security keys, 12 let ad
- ReportIdentity Breach Report 2026: how attackers get in
123 identity breaches, 2021 to 2026: MFA was bypassed in 25 of the 41 with a known MFA status, and 44% of 2025-2026 cases had no login for MFA to protect.