The Weakest Link in Your Security Is a Phone Call to Verizon
Photo: Océanos y dados, CC0, via Wikimedia Commons
You can follow every security best practice on the books. Unique passwords generated by a manager. Phishing-resistant authentication. A credit freeze at all three bureaus. And yet a stranger in a different time zone can empty your Coinbase account by the time you finish lunch — without ever guessing a single password.
The attack is called SIM swapping, and despite years of warnings from the FBI and FCC, it remains one of the most devastating and easily executed scams targeting Americans. Understanding why requires looking past the victim and at the actual weak point: the American telecommunications system itself.
How a Phone Number Gets Stolen
Your phone number is, functionally, a master key to your digital identity. It's the recovery method for your email. Your email is the recovery method for everything else. And your phone number lives in a database controlled by a customer service representative who may earn fifteen dollars an hour.
In a SIM swap attack, the attacker doesn't hack you — they convince, bribe, or socially engineer someone at a mobile carrier to port your number to a SIM card in their possession. Sometimes it's a persuasive phone call claiming a lost phone. Increasingly, it's an insider recruited through bribes offered in online forums. In several documented cases, contractors at major US carriers have been charged with selling customer port access for cryptocurrency.
The moment the port completes, your phone goes dead. Incoming calls and texts — including every two-factor authentication code — now arrive on the attacker's device. From there, the standard playbook unfolds: password resets via SMS, email account takeover, then a systematic looting of banking, crypto, and social media accounts. For high-value targets, the entire process can take under an hour.
Why Carriers Still Make It Easy
The FCC has moved, albeit slowly. In 2023, it proposed rules requiring carriers to verify customer identity before porting a number and to notify customers of SIM changes. Some carriers now offer port-out PINs and number-lock features. But implementation is inconsistent, third-party retail stores add human weak points, and the incentive structure is skewed: carriers face little financial penalty when a swap succeeds, while the victim bears the entire loss.
The result is a security model that treats your phone number as something you've proven you own — when in reality, proving ownership is as fragile as a customer service interaction.
The Fixes That Actually Work
Here's the encouraging part: defending against SIM swapping requires no technical sophistication. It requires about ten minutes and a shift in assumptions.
Stop using SMS for two-factor authentication. This is the single most important change. Authenticator apps like those from Google, Microsoft, or Authy generate codes on your device, untouched by your carrier. Hardware keys such as YubiKeys go further, binding verification to a physical token that can't be intercepted remotely.
Lock your carrier account. Ask your provider about port-out protection, a port-out PIN, or a number freeze. Major US carriers — Verizon, AT&T, T-Mobile — all offer some version; enable the strongest available and confirm it actually applies at third-party retail locations.
Add a PIN to your account line. A simple account PIN, required for any support interaction, raises the bar for social engineering.
Audit your recovery paths. If your email account can be recovered by SMS alone, your email is only as secure as your phone number. Replace phone-based recovery with backup codes stored offline or an alternate authenticator.
Limit what your number exposes. Financial institutions increasingly allow app-based or hardware-key verification. Wherever an alternative to SMS exists, take it.
A Key That Shouldn't Be a Key
The deeper lesson is architectural: your phone number was never designed to be an identity credential. It's a routing label from the era of landlines, retrofitted by convenience into the master key of modern account recovery. Until that architecture changes, the defense is personal: remove your phone number from the trust chain wherever you can.
Ten minutes of setup today is the difference between an annoyance and a catastrophe the next time someone calls your carrier pretending to be you.
