Original topic illustration: ChainView BTC866 original topic diagram · ChainView BTC866 Editorial · CC BY 4.0
A SIM swap changes the number route
A carrier process can move a phone number to an attacker-controlled SIM. The original handset may remain with its owner while SMS codes are redirected for email, exchange and other account recovery.
Carrier protections vary by local service, including account PINs or transfer controls. Ask official support what is available instead of assuming every carrier has the same lock. Never disclose full account information merely because an inbound caller knows some personal facts.
A SIM-swap attack redirects a phone number through a carrier process and can expose SMS codes even when the victim's handset remains physically secure.
Find the weakest recovery link
A strong daily login does not protect an account if SMS remains the fallback. Inventory email, custody, cloud and social accounts that depend on the number, then add supported stronger authentication and carrier protections.
Keep recovery codes appropriately separate from the handset. Include mailbox recovery, cloud sync and payment services in the review. Protecting only the visible exchange leaves indirect reset routes exposed if another account controls its recovery.
Attackers may target password resets, email recovery and exchange recovery paths, so a strong daily login method is weakened by an unprotected fallback.
Verify a service outage independently
Unexpected loss of calls or texts warrants contact through a published carrier channel or a store. Do not provide a one-time code or screen share to an inbound caller claiming to reverse a transfer.
When internet remains available, use saved official addresses rather than an urgent text link. A service outage can have benign or hostile causes. Preserve evidence and verify independently instead of publishing a personal number while seeking public assistance.
Use carrier account protections and stronger supported authentication, store recovery codes safely and review which accounts still depend on the number.
Recheck access after containment
Once the number is restored, inspect forwarding rules, active sessions, API keys, withdrawal addresses and notices. A password change alone may not revoke existing sessions or application authorisations.
If a new withdrawal destination or permission appears, follow provider freeze and revocation controls, including waiting periods. Do not install unfamiliar remote-control software to save time. Legitimate support does not require a transfer to validate account recovery.
Unexpected loss of service warrants independent contact with the carrier and affected providers; do not disclose codes to callers claiming to reverse the transfer.
Keep a timeline and report
Preserve dates, carrier references and security emails, then notify affected providers through verified routes. Separate unauthorised transaction response from assumptions about the attacker, and seek local professional help where appropriate.
Separate loss of service, notices, detected changes and restoration in the timeline. Base loss amounts on confirmed records. A later review should repair the recovery chain, not merely attach the same weak method to a replacement number.
Carrier records and platform records can use different time zones, so retain their original timestamps alongside a normalised timeline. This helps establish whether a reset preceded an unauthorised transfer without claiming that timing alone proves an attacker's identity. If no asset movement occurred, document that outcome as well. Near misses reveal weak recovery paths worth repairing. The response should remain proportional: independent checks and provider controls are preferable to handing device access to someone who promises immediate restoration through an unofficial channel.
A response card can use phone number, carrier change, recovery chain and containment as checkpoints for observed symptoms, trusted verification, stop conditions and responsibility. Confirm facts before any action that changes permissions or moves funds. An urgent support message does not justify revealing secrets. Prefer read-only inspection, then document and recheck settings when a real change is necessary. After containment, repair the underlying recovery or access weakness rather than only dismissing the visible warning. Retain evidence without exposing identity material publicly. The aim is a controlled decision that reduces risk, not a hurried series of signatures prompted by fear or a stranger offering assistance.
