SIM swap

A SIM swap is the transfer of a phone number to a new SIM card or eSIM profile. Legitimate swaps happen when people replace phones; fraudulent swaps happen when an attacker convinces or compromises a carrier into moving a victim's number onto the attacker's SIM, redirecting every call and SMS, including one-time passcodes, to the attacker.

The fraudulent variant is the opening move of most phone-based account takeover: once the number moves, SMS-based recovery flows mint fresh credentials for the attacker while the victim's handset goes silent.

For a defender the useful question is not whether a swap happened but when, relative to the action being authorized. A swap three weeks before a routine login is ordinary life; the same swap forty minutes before a password reset and a payee change is the middle of an attack. That is why swap signals are consumed as a window rather than a flag, and why a provider that returns only a boolean removes the resolution the rule needs.

The mechanics also explain why the victim sees nothing useful. Once the number moves, the original handset loses service, which reads as a network problem rather than an attack, and every code sent to the number arrives at the attacker. By the time the victim reaches a store, the recovery flows that depend on the number have already run. This is the specific reason an SMS OTP proves possession of a number rather than presence of a person.

Detection therefore has to happen on the authorizing side rather than the victim's. Checking the line's state inside the flow, before the code is sent, is what turns the swap from an invisible precondition into an observable fact, which is the whole subject of SIM swap detection.

Legitimate swaps are common enough that treating every one as hostile is not an option, which is what forces the timing question rather than the fact question.