The data broker opt-out piece mentioned SIM-swap social engineering almost in passing — the aggregated profile a broker builds (your name, phone number, relatives, current address) is close to a starting kit for one. It’s worth explaining why that specific attack works, because it’s one of the few remote attacks that can drain a bank account, take over an email address, and lock you out of your own phone number in the same afternoon, and most people have never heard of it until it happens to them.
Want the technical reference sheet for this stuff too? Subscribe and get the Security Command Reference free — plus one new deep-dive article a week, no daily spam.
What a SIM Swap Actually Is
A SIM swap is an attacker convincing your mobile carrier to move your phone number onto a SIM card they control — not a technical hack of your phone, a social-engineering attack on a customer service rep. Once your number is on their SIM, they receive your calls and texts, including any SMS-based two-factor authentication codes. From there they reset passwords on email, banking, and crypto accounts using “forgot password, text me a code” flows, and because they now control the phone number, the account provider’s own security check hands them the keys. The attack doesn’t require breaking any encryption or exploiting any software vulnerability — it requires knowing enough about you to sound convincing to a carrier employee, which is exactly what an aggregated data-broker profile supplies.
Why This Specific Attack Works So Well
Carrier customer service exists to help legitimate customers who’ve lost access to their own accounts, which means the entire process is designed to work with imperfect verification — a name, a birthdate, an address, maybe the last four of a SSN or an account PIN most people never set. Every one of those is exactly what shows up in a data broker profile or a previous breach dump. The attacker doesn’t need to guess; they need to look it up. Carriers have gotten better about this (account PINs, port-out freezes, in-store-only transfers for some carriers), but the underlying weakness — a human being persuaded by a confident, correctly-informed caller — hasn’t gone away, and won’t, because the fix would require carriers to make legitimate account recovery meaningfully harder for everyone, which they’re reluctant to do.
What Actually Stops This
Set a port-out PIN or account freeze with your carrier, today, not after something happens. This is the single highest-leverage fix and takes about ten minutes. Every major US carrier supports some version of this; the setting is usually buried under account security, not the main account page. Without it, the “PIN” an attacker needs is often just guessable account information, not something you actually control.
Move two-factor authentication off SMS wherever the account supports it. An authenticator app (or a hardware key, which is stronger) generates codes independent of your phone number, so a SIM swap doesn’t hand the attacker anything useful for that account. Email and financial accounts are the highest-priority targets to move first — the passkeys/hardware keys comparison covers the tradeoffs in more depth than fits here.
Use a PIN-protected voicemail and don’t rely on your phone number as an account-recovery method where you can avoid it. Some services let you remove SMS recovery entirely in favor of backup codes stored somewhere offline. Wherever that option exists, it’s worth using, since it removes the phone number as an attack surface for that account entirely.
Watch for the actual warning sign: your phone suddenly loses service with no explanation. A successful SIM swap deactivates your real SIM the moment it completes. If your phone drops to “no service” or “SOS only” and a carrier outage isn’t in the news, that’s the signal to call your carrier from another phone immediately, not to assume it’s a coverage glitch.
What I Actually Have Set Up
Port-out PIN set with my carrier, SMS 2FA moved to an authenticator app or hardware key on every account that supports it, and a calendar reminder to re-verify the port-out PIN is still active every six months — carriers have, more than once industry-wide, quietly reset these during system migrations without notifying customers. I found mine had reset silently after a carrier system change about a year in, which is exactly the kind of thing you only catch by checking rather than assuming a one-time setup holds indefinitely.
What I got wrong initially: I set the port-out PIN and considered the problem solved, without checking whether my accounts still had SMS-based recovery available as a fallback even after I’d switched their primary 2FA to an authenticator app. Several services keep SMS as a silent backup recovery option even once you’ve configured something stronger as primary — meaning a successful SIM swap could still have reset those accounts through the “can’t access your authenticator, text me instead” path I’d forgotten was still enabled. Finding that gap meant going back through every account individually and explicitly disabling SMS as a fallback, not just adding a better primary method on top of an unremoved weaker one.
Common Mistakes
Assuming an authenticator app alone fixes the problem. If SMS is still available as a fallback recovery method on the same account, a SIM swap can still get in through that door.
Treating the port-out PIN as a one-time setup. Carrier system migrations have reset these before, industry-wide, without proactively notifying customers.
Not knowing what a successful attack looks like from your end. Sudden total loss of phone service, with no carrier outage reported, is the signal — most people don’t recognize it until financial accounts start getting drained.