A Documented Case: The Twitter CEO Whose Own Number Got Stolen
In August 2019, Twitter's own CEO at the time, Jack Dorsey, had his personal Twitter account hijacked and used to blast out a stream of offensive tweets to his millions of followers. The method wasn't a password leak or a software exploit. Attackers convinced his mobile carrier to transfer his phone number onto a SIM card they controlled, then used SMS-based account recovery to take over his Twitter account through a text-to-tweet feature tied to that number. If it can happen to the head of the company running the platform being attacked, it can happen to anyone whose accounts still trust a phone number.
Your phone number quietly became an identity document over the last decade. Banks text it one-time codes, exchanges verify withdrawals through it, and "forgot password" flows across the internet lean on it as a default recovery method. SIM swapping abuses exactly that trust: an attacker convinces your mobile carrier to move your number onto a SIM card in their possession. Your phone drops to "No Service." Theirs lights up as you. Every SMS code meant for you now lands in their hands instead.
The Social Engineering Steps, In Order
A SIM swap rarely involves any technical attack on your device at all. It's a con run against a call center, step by step:
- Building the identity file. The attacker assembles your full name, date of birth, home address, and the last four digits of a linked account or social security number, usually bought cheaply from one of the many breach data compilations circulating online, since this kind of basic personal data has leaked from dozens of unrelated companies over the years.
- Contacting carrier support. The attacker calls, chats, or visits a retail store, claiming to have lost their phone or damaged their SIM, and asks for a replacement to be activated on a new SIM card they control.
- Passing the verification questions. Using the assembled identity file, the attacker answers the security questions a support representative asks, which are often the same handful of static facts, birth date, address, last bill amount, that the same breach data already contains.
- The swap completes. Support processes the request. The victim's real SIM goes dark. The attacker's SIM now receives all calls and texts addressed to that number.
- The cascade. Email password reset via SMS, then every other account reset through that now-compromised email, then financial accounts, exchanges, and anything else tied to the number, all within minutes, before the victim has figured out why their phone shows no signal.
Other variants skip social engineering entirely: bribed telecom employees have carried out bulk SIM swaps in multiple prosecuted cases, since insider access removes the need to convince anyone of anything. Retail store visits using a printed fake ID and simple confidence at the counter work too. And a newer variant, eSIM hijacking, triggers a digital eSIM transfer through a compromised carrier online account, with no physical SIM card involved at any point.
Why This Defeats SMS Codes But Not an Authenticator App
The mechanism matters here, not just the outcome. An SMS code is generated by your carrier's network and delivered to whichever SIM currently holds your number, full stop. Once the swap completes, that SIM belongs to the attacker, so every SMS code, without exception, routes straight to them. The phone network has no way to know the SIM changed hands maliciously; from its perspective, a legitimate SIM replacement just happened.
A TOTP code from an authenticator app works completely differently: it's generated locally, on your physical device, from a secret that was set up once during enrollment and never travels over the phone network at all. Swapping your SIM does absolutely nothing to that secret or that app, since neither one has any relationship to your phone number. The code your app shows is identical whether your SIM is in your phone, sitting on a shelf, or has been stolen entirely. This is the single clearest illustration of why SMS 2FA and app-based 2FA are not interchangeable, despite both producing "a six-digit code."
Warning Signs and What To Do In The First Ten Minutes
- Your phone suddenly shows "No Service" in a location with normal coverage, and restarting the device doesn't fix it.
- Texts and calls simply stop arriving, while WiFi-based apps continue working normally.
- Password reset emails you never requested start appearing in your inbox.
- Your carrier sends a notification about a SIM change or account access you didn't initiate.
If any of this happens, treat it as a race measured in minutes, not hours. Call your carrier from a different phone or landline to report the swap and demand it be reversed immediately, and simultaneously change your primary email password from a computer, since email is almost always the first domino attackers knock over.
Carrier-Side Protections Worth Setting Up Today
Port-Out PIN or Number Lock
Every major US and UK carrier now offers a dedicated PIN, separate from your account login password, that support staff are supposed to require before processing any SIM change or number port request. Setting this up takes about five minutes through the carrier's app or a support call. Choose a PIN that isn't your birth year, street number, or any digit sequence tied to information already sitting in a breach dump somewhere, since attackers assume you reused something obvious.
Account-Level Security Freeze
Some carriers now offer a broader account lock or freeze feature that goes beyond the port-out PIN, blocking SIM changes, plan changes, and account edits entirely until you manually unlock it, useful if you're not actively expecting to need a new SIM anytime soon.
In-Store Identity Verification Requirement
Ask your carrier whether they support requiring photo ID verification in person for any SIM replacement, closing off the phone-support social engineering path entirely for your account, at the cost of needing a store visit if you ever do need a legitimate replacement.
SMS Codes Versus Authenticator Apps Under a SIM Swap
| Scenario | SMS Codes | Authenticator App |
|---|---|---|
| Number swapped to attacker's SIM | Attacker receives every code | Codes unaffected, generated on your device |
| Password reset attempted via phone | Attacker completes it | Not possible through the phone number at all |
| Traveling with no signal or roaming issues | Codes may not arrive | Works completely offline |
| Carrier support successfully social engineered | Full account compromise likely | No impact whatsoever |
US federal prosecutors have charged SIM swap rings whose individual victims lost millions of dollars in cryptocurrency in a single incident. Several of the defendants charged in these cases turned out to be teenagers. The barrier to entry for this attack is a phone call and a script, which is exactly why it keeps happening at scale.
Unhooking Your Number From Account Recovery
Beyond the carrier PIN, audit the recovery settings on your important accounts directly. If an account's "forgot password" flow can be completed with an SMS code alone, that account's real security ceiling is your carrier's support desk, not your password. Replace phone-based recovery with printed backup codes stored somewhere safe, or a secondary email address that itself has strong protection. And reduce what personal data circulates in the first place: avoid posting your birth date and hometown publicly, and assume anything that's ever appeared in a breach, checkable at haveibeenpwned.com, is already known to whoever wants it.
Frequently Asked Questions
Can a SIM swap happen without me making any mistake?
Yes, and that's the uncomfortable core of this attack: the party that gets socially engineered is the carrier, not you. Your realistic defense is making the number worthless to steal in the first place, no SMS 2FA anywhere important, no SMS-based account recovery, plus a carrier PIN that makes the swap itself harder to execute.
Are eSIMs safer than physical SIM cards?
Mixed. There's no physical card for someone to steal or clone at a store counter, but eSIM profiles can be transferred entirely digitally, which opened up a newer remote attack path through compromised carrier online accounts rather than in-person social engineering. The port-out PIN and general account security matter either way.
How would I know for certain my number was ported without permission?
The clearest giveaway is losing all service while people standing near you keep normal signal. Carriers are increasingly required to notify you, by email or a message to your old SIM, before completing a swap, so enable every notification option your carrier offers.
Is a Google Voice number a useful defense here?
Interestingly, yes, for one specific purpose: a VoIP number isn't tied to a physical carrier SIM at all, so it structurally cannot be SIM swapped the way a mobile number can. Some people keep one exclusively for services that insist on SMS verification. Its security then depends entirely on the underlying Google account, which should have its own app-based 2FA rather than SMS.
What's the single highest-value change to make today?
Two things, both doable in under fifteen minutes total: call your carrier and set a port-out PIN, and move your primary email account's 2FA from SMS to an authenticator app. Those two changes alone defeat the standard SIM swap playbook in almost every real-world case.
