Everything worth knowing, nothing that isn't.
How the attack actually runs
The attacker first gathers enough personal detail to pass a retention-team identity check — often from a breach dump or a phishing page. They then contact the operator claiming a lost or damaged handset and request a port or a replacement SIM. Once the swap completes, the victim's phone silently loses service and every SMS and voice call routes to the attacker. Password resets, bank OTPs and account-recovery codes follow within minutes. The victim's first signal is usually that their phone stopped working, by which time the money has moved.
Why SMS OTP is still worth sending
The lesson is not that SMS OTP is worthless — it reaches any handset in any market with no app installed, which nothing else does. The lesson is that it authenticates a phone number, not a person, and a number can change hands. Treat it as one factor among several for anything irreversible, and pair it with a signal the attacker cannot move with the SIM.
The defence: check the line, not just the code
A SIM swap leaves a trace in the operator's own records. A number-lookup or HLR query returns the date the SIM last changed and whether the number has recently been ported. If a subscriber's SIM changed four hours ago and they are now resetting a password, that is a step-up-authentication moment, not a normal login. Operator-direct providers can read this because they hold the operator relationship; a reseller several hops away usually cannot.
What to do in practice
Query the line's swap and port status before sending an OTP for a high-value action. Apply a cooling-off period — many banks refuse password resets for 24 to 72 hours after a detected swap. Offer app-based or passkey authentication as the primary factor for your highest-risk flows and keep SMS as the fallback that still works when someone loses their phone. And alert the customer through a second channel, such as email, when the SIM behind their account changes.