SIM swap attacks on executives and the phone numbers behind them

What is a SIM swap, and why do attackers target executives?

A SIM swap is fraud in which a criminal persuades a mobile carrier to move a victim's phone service to a SIM card or device the criminal controls. The glossary entry has the short version. The US Federal Communications Commission (FCC) describes the practice as a bad actor convincing the victim's wireless provider to transfer the victim's service and number from the victim's phone to a phone in the bad actor's possession. The victim's own phone is never touched.

Executives are attractive targets for three reasons. Their accounts hold more: corporate email, cloud consoles, banking and, in some cases, cryptocurrency. Their identities are easy to research, because the details a carrier asks about are often public. And one compromised account leads to others, since email and chat accounts are used to confirm payments and instructions to staff, which is the pattern behind business email compromise and CEO fraud.

How does a SIM swap work, step by step?

A SIM swap has four steps: the attacker collects the number and personal details, convinces the carrier to move the number, uses the incoming SMS messages to take over accounts, and then monetizes or abuses the access. The FBI's Internet Crime Complaint Center (IC3) says criminals primarily use social engineering, an insider at the carrier, or phishing of carrier employees.

The FBI describes the three routes this way: impersonating the victim to trick the carrier, paying a carrier employee to switch the number, and phishing employees "into downloading malware used to hack mobile carrier systems that carry out SIM swaps." Once the number is moved, "the victim's calls, texts, and other data are diverted to the criminal's device." The attacker then sends "Forgot Password" or "Account Recovery" requests and reads the one-time codes.

A related attack, port-out fraud, skips the SIM card. The FCC describes it as a bad actor, posing as the victim, opening an account with a different wireless provider and then arranging for the victim's number to be ported out to that account. The result for the victim is the same.

Why does an exposed phone number start the attack?

An exposed phone number tells the attacker whom to target and which carrier account to impersonate. The number is the identifier for the whole attack, and personal details gathered around it help the attacker pass the carrier's identity check. The FBI therefore advises people to avoid "posting personal information online, such as mobile phone number, address, or other personal identifying information."

Numbers reach attackers through several routes, and executives usually cannot see all of them:

• Breach and leak data. Records from breached services often include a phone number next to an email address, a name and sometimes a password. Our overview of what breach data shows about executives' personal accounts and the broader piece on executive digital exposure explain how those records are assembled. Terms: leak database, breach corpus, PII.
• Stealer logs and traded data. Infostealer malware copies autofill data from a browser, and stealer logs are sold and shared on the dark web and in other channels. A log from a personal device can carry a number and an address.
• Listings and directories. A people-search listing, a conference attendee list or a leaked company directory is one more place a number can sit. Check which fields the listing shows for your executives.
• Social media and the executive's own posts. The FBI's advice covers this directly, and it also advises against advertising financial assets, including cryptocurrency, on social media and forums.

Where it fits the situation, WebThreat's information removal specialists audit where an executive's personal data, including phone numbers, appears on people-search sites, file the opt-outs and takedown requests, verify each removal and re-check closed listings every 30 days. Executives' families can be included on request.

What do attackers gain from a SIM swap?

An attacker who controls an executive's number gains the executive's SMS codes and account recovery messages. The FBI says the criminal "uses the codes to login and reset passwords, gaining control of online accounts associated with the victim's phone profile." That access is used in four main ways.

1. Account takeover. Email is the first target, because it unlocks password resets elsewhere. See account takeover.
2. Financial theft. The FBI's 2022 public service announcement (PSA) describes criminals using SIM swapping to steal money from fiat and virtual currency accounts. From January 2018 to December 2020, IC3 received 320 SIM swapping complaints with adjusted losses of approximately $12 million. In 2021 it received 1,611 complaints with adjusted losses of more than $68 million.
3. Business email compromise. A hijacked executive mailbox lends authority to payment requests. Our article on which exposed data fields make CEO fraud convincing shows what attackers combine with a stolen number.
4. Impersonation by voice and text. With the number, an attacker can receive calls and messages meant for the executive, including verification calls from banks and colleagues.

The FBI figures count complaints received by IC3 in those years, not all incidents.

What do the FCC rules of 2023 require from carriers?

The FCC adopted rules on 15 November 2023 (Report and Order FCC 23-95) that require US wireless providers to authenticate customers securely before a SIM change or a port-out, to notify customers immediately, and to offer free account locks. The order revised the Commission's customer proprietary network information (CPNI) and number portability rules. This is general information, not legal advice.

The order covers wireless providers in the United States. Executives who use carriers elsewhere should ask those carriers what protections they offer.

Is SMS safe to use for two-factor authentication?

SMS is a weak second factor for executives because anyone who controls the phone number receives the code. NIST classifies the use of the public switched telephone network (SMS or voice) for out-of-band authentication as a "restricted" authenticator in its Digital Identity Guidelines (SP 800-63B-4). NIST also says verifiers should consider risk indicators such as a SIM change or number porting before sending a code that way.

CISA's mobile communications guidance, published for "highly targeted" individuals, is blunter: "Do not use SMS as a second factor for authentication." It says SMS MFA "is not phishing-resistant and is therefore not strong authentication for accounts of highly targeted individuals." CISA recommends FIDO hardware keys or passkeys, and it warns that enrolling in an authenticator app does not remove SMS from an account: that "can create a weak, exploitable fallback mechanism," so SMS should be disabled once the stronger method is enrolled. It also notes that some services keep SMS in account recovery flows and that removing it entirely may not be feasible.

What can carrier accounts do to block a SIM swap?

Carriers document account-level protections that block SIM changes and number transfers until the customer turns them off. They differ in name and scope, so each executive's carrier needs checking. CISA recommends setting a PIN or passcode on the carrier account, which is "required for logging into your account or completing sensitive operations, such as porting your phone number."

• AT&T describes Wireless Account Lock as a free security feature, turned on in the AT&T app, that disables specific transactions and account changes for all devices and lines on the account. AT&T emails the primary account holder and texts each active number whenever the lock is switched on or off.
• Verizon documents SIM Protection and Number Lock as two separate settings. SIM Protection blocks SIM changes and upgrade orders; Number Lock protects the number from an unauthorized transfer, and it must be turned off for a port-out to succeed.
• Other carriers offer comparable settings under other names. Look for a SIM change lock, a port-out lock and an account passcode, and ask the carrier who can switch them off and how that person is verified.

A lock only helps if the people who can unlock it are hard to impersonate. That is why the account owner, any authorized users and the carrier's verification steps belong in the review.

What is the protection checklist for executives and their security teams?

Security teams can close most of the SIM swap path with six steps, ordered by how much risk each removes. These follow the FBI, CISA and FCC material above.

1. Lock the carrier account. Turn on the SIM change lock and the port-out lock, and set a long account passcode that is not in any public record. Do this for every line the executive uses, including a partner's or assistant's line if it can reach the executive's accounts.
2. Take SMS out of the second factor. Move email, cloud, banking and password manager sign-ins to FIDO security keys or passkeys. Where an authenticator app is the only option, disable SMS once it is enrolled.
3. Review account recovery. List which accounts recover by SMS or a call. Replace the recovery number with a recovery key, a second email protected by a security key, or a verified helpdesk process.
4. Reduce what is public. Remove the mobile number from social profiles and conference bios. Ask the executive not to post about crypto holdings or financial assets, as the FBI advises.
5. Know which numbers are already exposed. Check which personal and work phone numbers appear in breach and leak data and on people-search sites. A number that has leaked cannot be recalled, so the fix is a new number for sensitive accounts or the protections above.
6. Prepare the response. If texts or calls stop without explanation, the executive contacts the carrier at once on a known number, then changes passwords, alerts the bank and the security team, and reports to IC3 and local law enforcement, as the FBI advises. Also tell finance and the assistant, who should confirm payment requests by calling a previously known number.

The FBI also advises people not to give mobile account information to callers who ask for a password or PIN, to verify such calls by dialling the carrier's customer service line, and to watch for changes in SMS connectivity.

How can you check which executive contact details are exposed?

You can check exposure by looking up each executive's addresses in breach and leak data. CEM finds the leadership team from a company name and checks each executive's current and past email addresses against breach corpora and leak databases, ranked by what to fix first. A found record can include a phone number, a password or a username, so the result shows which of those fields have leaked for each person. CEM does not search by phone number and does not detect SIM swaps or port-outs.

If stolen data from your company is traded on dark web forums, marketplaces or Telegram, EDG3 covers those places and links reposted copies back to the first post. For the response to a password already in a breach, see what to do when an executive's password is in a breach. For the limits of what leak monitoring can tell you, see credential leak monitoring: what it can and cannot tell you, and for the day an executive is doxxed, see the first-day checklist. Stolen credentials also feed credential stuffing, and password reuse widens the damage.

How WebThreat can help

WebThreat does not run carrier accounts, issue security keys or detect SIM swaps. Our part is the data that has already left.

• CEM shows which of your leadership team's email addresses appear in breach corpora and leak databases, and which fields in those records matter most. See the methodology for how findings are ranked.
• Information removal: for executives' personal data such as phone numbers on people-search sites, our specialists file the opt-outs and takedown requests, verify each removal, and re-check closed listings every 30 days.
• EDG3 is threat intelligence for leaked data posted and sold on dark web forums, marketplaces, Telegram and other channels, and in leak databases.

A sensible next step is to see what CEM finds for your leadership team, or to ask our specialists about removal. You can also contact us with questions.

This article reflects the sources linked above as of 29 October 2026. Carrier features and FCC compliance details change; the carrier pages and the FCC order are the authority. This is general information, not legal advice.