We had to change our old domain. guideora.net is our new and only official domain. Never trust any fake domain using the GUIDEORA name, or similar names pretending to be GUIDEORA.

GUIDEORA

identity theft guide

SIM-Swap: The Phone Number Is the Real Skeleton Key

Sam OkonkwoSam Okonkwo· Security Researcher· Updated February 3, 2024· 12 min read

Some links on this page may earn GUIDEORA a commission. Disclosure

Quick take

A SIM-swap moves your number to an attacker's SIM. SMS 2FA then helps them. Call the carrier, lock the account, move 2FA off SMS, assume email is next. Aura is the household-monitoring example this site uses — it cannot un-port a number. IdentityTheft.gov if money moved.

They did not need your password first

Social engineering a carrier store or a weak customer-service flow is enough. Once the number moves, password-reset SMS is a welcome mat. The skeleton key was the MSISDN, not the dark-web dump.

You notice when texts stop or a 'your number was moved' SMS arrives too late. Treat it as an incident, not a glitchy day.

From the record

Move 2FA to an authenticator app or a hardware key before someone else moves the number.

GUIDEORA rule for SIM-swap

Do this in order

Call the carrier from another phone. Reclaim the number. Change email passwords from a clean device. Revoke sessions. Tell banks. Freeze credit if new accounts are the fear. File IdentityTheft.gov if you are in the U.S. and crime happened.

A SIM card and SMS codes leaving a phone
The number was the key. The app badges were decoration.

Port

Number leaves

SMS 2FA

Now theirs

Carrier PIN

Do it first

App alert

Not a port freeze

  • Carrier port freeze / extra PIN on the mobile account.
  • Replace SMS 2FA on email and money apps.
  • Assume the inbox is next if they had the number.
  • A monitoring ping is not a port lock.

Where a bundle still helps

Aura currently watches credit-file and dark-web style alerts and can put restoration help on paid plans as they document it. That is after-the-fact noise reduction. It does not replace the carrier call. We mention Aura because it is this site's household example — not because it un-swaps SIMs.

Confirm live plan features. Checkout wins. GUIDEORA is not the carrier.

Pros

  • +A carrier PIN is cheaper than any bundle
  • +Authenticator 2FA shrinks the SMS blast radius
  • +Monitoring can still nag about new credit after

Cons

  • −Bundles cannot freeze a port
  • −Some carriers still fail in-store
  • −Email recovery may already be burning

Lock the number before the dump

Treat the phone number as a key. Aura is the monitoring example this site uses after you have called the carrier. GUIDEORA does not port lines.

Editor take

Carrier first

Reclaim the number, kill SMS 2FA, then use monitoring as a later radar. Aura is the household example. IdentityTheft.gov if money moved.

See Aura's current plan