SIM Swap Attacks: Which Second Factor Survives

The attack is on your carrier, not your handset

A SIM swap does not require malware on your phone, a stolen password or a breach at the exchange. It requires a convincing call to a mobile carrier. The FBI’s 2024 Internet Crime Report defines the crime in one sentence: “The use of unsophisticated social engineering techniques against mobile service providers to transfer a victim’s phone service to a mobile device in the criminal’s possession.”

Once that transfer completes, the attacker’s handset receives everything the victim’s should: incoming texts, one-time codes, password-reset messages and carrier voicemails. If an exchange account’s second factor is an SMS code, the second factor is now in the attacker’s hand and the account has effectively returned to a single factor — a password the attacker may already have.

The scale is smaller than the headlines imply and still substantial. The same report counts 982 SIM swap complaints in 2024 with losses of $25,983,946, against 1,075 complaints and $48,798,103 in 2023, and 2,026 complaints and $72,652,571 in 2022. The direction is down, and the average loss per complaint has risen, which fits a pattern of fewer, better-targeted attacks rather than a solved problem.

What the standard actually says about SMS

The instinct after reading the paragraph above is to ask which authentication methods are considered sound. NIST’s digital identity guidelines answer that for one class of method very bluntly.

SP 800-63B carries a dedicated section titled “Authentication Using the Public Switched Telephone Network,” which opens by stating that “use of the PSTN for out-of-band verification is restricted as described in this section.” A phone number, the guidelines note elsewhere, can be reassigned, and the person who ends up holding it is not necessarily the subscriber.

That is the technical version of the point. A phone number is not a secret that belongs to you; it is a routing instruction that a third party controls. Any factor delivered through it inherits the carrier’s ability to reassign it.

Three controls that survive a swap

The useful question is not “is SMS bad” but “what still works when the number is gone”. Three controls answer it.

An authenticator app on a device that is not the phone line. A time-based code generated on a handset or tablet does not travel through the carrier. The caveat is that many people install the authenticator on the same phone whose number is being targeted — which is still fine, because the code is generated locally and does not depend on the SIM. The failure mode is losing the device, not losing the number.

A hardware security key. A FIDO2 key requires a physical presence and, on most keys, a touch. It cannot be phished by a lookalike page and it cannot be ported. It is the strongest option and the least convenient, which is why it is usually deployed on the two or three accounts that matter most — the email account that resets everything, and the venue that holds the funds.

A withdrawal delay at the venue. This is the control most people miss, and against a takeover it is the one that changes the outcome. Binance’s withdrawal settings page describes a whitelist limit under which transfers to newly added addresses are blocked for 24, 48 or 72 hours, chosen by the account holder. The stated purpose is exactly this scenario: a buffer in case an unauthorised address is added to the account.

Put the three together and the attack changes shape. The attacker can still reset the password. They can still pass an SMS challenge. But they cannot move funds to a new address without starting a timer that the account holder will see, and they cannot use an existing whitelisted address unless they already control it.

Why the email account is the real target

Exchange accounts are usually not attacked first. The email account is, because almost every other account can be reset from it. An attacker who controls the inbox can request a password reset at the exchange, receive the link, and then face only the second factor.

That changes the priority order of a personal security review. The email address used for financial accounts should be:

• Separate from the address used for shopping, forums and newsletters, so a breach elsewhere does not point at it.
• Protected by a factor that does not use SMS, because an email reset that depends on the phone number inherits every weakness above.
• Logged somewhere you can audit, so an unexpected session or a forwarding rule is visible rather than silent.

A dedicated address does not make the attack impossible. It makes the reconnaissance step — finding which address belongs to the person who holds crypto — harder, and it removes the convenient path where one breached mailing list leads straight to the inbox that controls everything.

What to do in the first ten minutes of a suspected swap

The sequence matters because the attacker is working the same clock.

1. Call the carrier from another phone and report the number as ported without authorisation. Ask for the line to be frozen and for port-out protection to be applied.
2. Get into the email account from a device that is already signed in, if one exists, and change the password. Check for forwarding rules and connected sessions.
3. Log in to the exchange and check the withdrawal address list. Remove anything you did not add. If a whitelist exists, confirm it is still enabled.
4. Revoke active sessions and API keys. A key created today is a key the account holder did not create.
5. Check the pending withdrawal queue. A whitelist timer shows up as a pending transfer with a countdown, which is the difference between a scare and a loss.
6. Rebuild the second factor on a device that was never part of the port.

Steps 3 to 5 are only possible if the account has the features switched on before the attack. That is the uncomfortable part of this subject: every control described here has to be configured on a calm afternoon to be worth anything on a bad one.

The habit that outlasts the attack

The durable version of this advice is not a list of settings. It is a rule about dependencies: no single channel should be able to reset everything. If the phone number can reset the email, and the email can reset the exchange, and the exchange can move the money, then one call to a carrier compromises the whole chain.

Break one link deliberately. Use an authenticator app or a hardware key for the email account. Keep the exchange’s whitelist limit enabled and let it run for 24 hours rather than switching it off for convenience — the timer is the only part of this system that works while you are asleep. And keep the recovery codes for the second factor somewhere that is neither the phone nor the cloud drive the phone can open; the storage question is the same one covered in seed phrase handling that actually works.

For the account-level settings that make the last link expensive, Binance withdrawals: whitelists, network suspensions and the wait walks the timers in detail. For the reason a self-custody balance is not exposed to this class of attack at all, custodial versus non-custodial wallets is the structural comparison.

Risk note. The complaint counts and losses in this article come from the FBI’s 2024 Internet Crime Report, and the treatment of PSTN authentication from NIST SP 800-63B, both read on 2026-10-31. The whitelist timer figures come from Binance’s withdrawal settings page of the same date. Carrier protections differ by country and by operator; nothing here is a guarantee that a specific control will prevent a specific loss.