Most security controls within your business can be improved, such as passwords, training, and access permissions. However, SMS-based two-factor authentication (2FA) is different, because your business can’t make it stronger. The codes are only as secure as your phone number, and your mobile carrier controls who that number belongs to. Its weakest point is the carrier’s customer support agents.
An attacker only needs to call one of them, pretend to be one of your employees, and ask for that employee’s phone number to be moved to a SIM card the attacker controls. From then on, every SMS code sent to your employee goes to the attacker. Nothing in your security setup can influence what happens during that call.
This is SIM swapping. SMS codes aren’t just a weaker form of multi-factor authentication (MFA). With SIM swapping, attackers can bypass them completely, without ever touching your systems. In this article, we explain how the attack works, why businesses are now a common target, and what your business can use instead of SMS codes.
What is SIM swapping?
In a SIM swap targeted at a business, an attacker convinces a mobile carrier to move an employee’s phone number to a SIM card the attacker controls. They usually do this by impersonating that employee to the carrier’s customer support and asking for a replacement SIM or a number transfer.
As soon as the transfer goes through, the employee’s phone loses service. Every call and text sent to that number, including SMS authentication codes, goes to the attacker’s device instead.
The employee’s device isn’t hacked. The attacker doesn’t need common methods such as malware(新視窗), brute force attacks, or phishing. The carrier simply reassigns the number, using its normal process, to someone who has no right to it.
The weak point is the carrier’s identity checks; something your business has no control over.
How attackers carry out a SIM swap
A SIM swap relies more on preparation than technical skill. First, the attacker collects enough personal information to pass the carrier’s identity checks, such as their full name, date of birth, and answers to common security questions.
Much of this is public, collected from sources such as social media profiles, company websites, and professional directories. The rest often comes from data breaches, where personal details like these circulate for years after the original leak.
With this profile, the attacker contacts the carrier and poses as the customer. They give a reason for the request, such as a lost phone, a damaged SIM, or an upgrade. The goal is always to get the support agent to activate the number on a new SIM.
Some attackers skip this step. Instead, they bribe or pressure someone who works at the carrier, or use forged documents at a retail store. In every case, the carrier’s process decides the outcome, not anything your employee did.
Once the swap is complete, the attacker moves fast. Password resets for many accounts, such as business email, banking, and software-as-a-service (SaaS) tools, often rely on SMS. The attacker triggers resets on the most valuable accounts first, intercepts each code, and locks the real owner out. This often happens before the employee realizes why their phone has no signal.
Many account takeover attacks on business accounts start this way. A SIM swapping attack is a means to gain access to every account the phone number protects.
Why attackers now target businesses
SIM swapping started as a crime against individuals, mostly cryptocurrency holders and high-profile people. That has changed.
A business admin account protected by SMS codes is worth far more than most personal accounts. It can unlock business systems such as email administration, payroll, and cloud consoles. Attackers don’t need to target the whole company, just one or two employee whose phone numbers grant access to the most valuable business accounts. The most likely targets are people with high-level access, such as finance leads, IT admins, and founders.
The numbers show how fast this has grown. Cifas, the UK’s fraud prevention service, recorded a 1,055% rise(新視窗) in unauthorized SIM swaps in 2024, from 289 reported cases to nearly 3,000. Its Fraudscape 2026 report(新視窗) shows a further 38% increase in 2025, driven by easy access to stolen personal data and more automated attacks.
Mobile phone accounts now make up most account takeover cases, according to the Cifas Fraudscape 2026 report(新視窗). A phone number has become the recovery key for almost everything else.
For a business, the risk is greater. One swapped number can give an attacker access to critical systems, such as your email admin console, payment platforms, and customer data. To protect your business, you need to prevent SIM swaps where you can and limit the damage if one succeeds. The same approach applies to preventing data breaches in general.
What to use instead of SMS codes
Your business doesn’t need to give up MFA. It needs to move the second factor somewhere a carrier support agent can’t hand it to a stranger. The three options below remove the phone number from the MFA process. You can use all three across your business, depending on the account.
TOTP authenticator apps
Authenticator apps generate time-based one-time passwords (TOTP) on your team’s devices, using a secret key shared when each account is first set up. The code never travels over the carrier network, so a swapped SIM has nothing to intercept.
Even if an attacker takes over the phone number, the authenticator app keeps working. For most businesses, this is the practical default. It’s widely supported, free, and a clear improvement over SMS.
Hardware security keys
A hardware security key is a physical device your team needs to sign in. It stops SIM swapping and most phishing, because the key checks that it’s connecting to the real website before it responds.
Keys cost money and need to be distributed, so you’ll need to plan time for their rollout, but they’re among the most secure options, especially when combined with other methods (such as a business password manager).
Passkeys
Passkeys replace passwords and codes with cryptographic credentials stored on a device. Employees unlock them with biometric data like a fingerprint or a face scan, or a PIN.
Like hardware keys, passkeys resist phishing and interception. The UK National Cyber Security Centre (NCSC) guidance on MFA for corporate services(新視窗) states that not all MFA types offer equal protection. It recommends phishing-resistant methods, especially for access to sensitive data.
Today, more business software supports passkeys, so turn them on across your business wherever you can, even while you use other methods elsewhere.
How to find accounts that rely only on SMS
Most businesses that use SMS codes never deliberately chose to adopt them. Each new tool was set up with whichever second factor was quickest, and the dependency grew one account at a time. So the first step is an inventory, not a migration.
Take inventory
List your business’s critical accounts and record the second factor each one actually uses, not the one you assume it uses. Check recovery options carefully. If an account has a strong second factor but uses SMS for account recovery, SMS still protects it. An attacker with a swapped number will try account recovery first. Teams often miss this, even on accounts they consider secure.
Prioritize
Next, prioritize by potential impact, not convenience:
- Email administration: Email is the recovery route for almost everything else. An attacker with your email admin account can reset their way into the rest of your systems.
- Finance and payroll platforms: These accounts can move money.
- Domain registrars and cloud consoles: These control your websites and infrastructure.
- Everything else: Lower-risk tools can move on a slower schedule.
Don’t make accounts that can move money or reset other accounts wait for a quarterly project. Once your audit shows where to start, follow our guide to rolling out multi-factor authentication across your business.
How to spot a SIM swap and what to do in the first hour
The first sign of a SIM swap is usually small. Something like an employee’s phone suddenly having no service in an area with normal coverage, and restarting it not working.
Around the same time, emails about password resets or new sign-ins may arrive for accounts that weren’t requested and aren’t recognized. Each sign is easy to dismiss. But together, on the phone of an employee whose number protects business accounts, they indicate an active incident.
The first hour is critical. The attacker is working through account recovery one account at a time, and every minute gives them more access. Act fast:
- Contact the carrier from another phone or through its online support. Report the unauthorized swap and ask them to freeze and recover the number.
- Secure the accounts the number protects, starting with email. Change passwords from a trusted device and sign out of all active sessions.
- In the UK, report the incident to Action Fraud(新視窗), the national reporting center for fraud and cybercrime. Reports support investigations and push carriers and banks to tighten their checks.
Your business can also reduce the risk on the carrier side. Most carriers offer extra protections, such as a SIM lock, port freeze, or account PIN, that add a check before any transfer. Turn it on for every employee whose number is still linked to important accounts. It makes the attack harder, but it doesn’t stop it. The lasting fix is to make sure a phone number can’t unlock your business accounts.
Move your team off SMS codes with Proton Pass
Moving your whole team off SMS codes is easier when the alternative is simple to use. A business password manager creates and stores a strong, unique password for every account, so employees don’t need to remember or reuse passwords. It also gives your admins one place to share logins securely and remove access when someone leaves.
Proton Pass includes a built-in TOTP authenticator, so the same vault that stores a login generates its one-time codes and autofills both together. Employees don’t need a separate authenticator app, which removes the most common objection to moving away from SMS.
Codes are stored in your business’s encrypted vault, not tied to a phone number, so a SIM swap can’t intercept them. With admin controls for IT teams(新視窗), you can require 2FA across your organization as a policy, so moving off SMS doesn’t depend on each employee. Reports show where 2FA still isn’t active, so you can see the gaps instead of guessing.
With a built-in 2FA authenticator organization-wide policies, and clear reporting, you can confirm your business has moved off SMS codes.
Make your business phone numbers useless to attackers
A phone number isn’t a secure way to protect your accounts. Your mobile carrier controls it, not your business, and an attacker can get it transferred with one convincing call to customer support.
To protect your business:
- Audit where SMS still protects your business accounts.
- Close account recovery loopholes.
- Move your highest-risk accounts to authenticator apps, security keys, or passkeys first.
- Enforce the change as a policy, not account by account.
Your business doesn’t need to wait for carriers to improve their identity checks. That’s the one part of this attack you can’t control. Everything else, you can.
Move beyond SMS authentication with Proton Pass for Business(新視窗)
