SIM swapping: why SMS codes aren’t enough
Twitter’s CEO lost control of their account after the phone number was taken over. Move important accounts off SMS.
On Friday, the Twitter account of Twitter’s own CEO posted offensive messages for about 20 minutes. Twitter said the phone number linked to the account was compromised through a security oversight by the mobile provider, which let the attackers send tweets by text message.
Taking over someone’s phone number is called SIM swapping. The attacker convinces the carrier to move the number to a new SIM, then receives the victim’s calls and texts, including login codes.
What to do:
- Add a PIN or password with your mobile carrier for any changes to your line.
- Use an authenticator app or a security key instead of SMS codes for email, banking and social accounts.
- Remove your phone number as a recovery option where a better one exists.
SMS codes are better than nothing. They aren’t enough for accounts that matter.