In a SIM-swap attack, a criminal convinces a mobile carrier to move a victim’s phone number to a device or SIM under the criminal’s control. Calls and text messages may then reach the attacker.
SMS recovery can become the weak link
An attacker who also has a password may intercept text-message login codes or password-reset messages. Email, exchange, and mobile-carrier accounts can form a chain of recovery dependencies.
Control of a phone number can unlock other accounts
Text-message codes and password-reset messages can let an attacker move from the mobile account to email, exchange, or financial accounts.
Use stronger authentication where possible
Protect the carrier account with a PIN, minimize public personal information, and prefer an authenticator app or hardware security key over SMS for sensitive accounts. Unexpected loss of mobile service deserves immediate attention.
A security key does not travel with the phone number
Authenticator apps and hardware security keys avoid the specific weakness of SMS interception, though they still require secure backups and recovery planning.
Sources
Educational information, not investment advice.