Your phone number is not your identity: SIM swaps and mobile money

For many people in Ghana, a phone number is much more than a way to receive calls. It is the key to a mobile money wallet, the place a bank sends one-time codes, the identity behind WhatsApp, and the recovery route for email and social media accounts.

That is convenient. It also means that whoever controls your number can often become you. SIM swap fraud is the attack that exploits this.

How the attack works

A SIM swap is a legitimate service: if you lose your phone, your network operator can move your number to a new SIM card. The attack abuses that service.

1. Gather details. The attacker collects the victim’s name, number and personal details, from data leaks, social media, or by simply asking under some pretext.
2. Swap the SIM. Using a fake ID, a convincing story, or help from someone inside the process, they get the victim’s number moved to a SIM card they hold.
3. The victim’s phone goes quiet. The real SIM stops working. Many victims assume it is a network problem and wait.
4. Catch the codes. One-time passwords (OTPs), PIN-reset messages and verification codes now arrive on the attacker’s phone.
5. Empty the accounts. With the codes, they reset PINs and passwords, and move money out before the victim realises what has happened.

The attack never touches the victim’s phone. It goes around it, through the network.

Why SMS codes are weaker than they look

We call SMS codes “two-factor authentication”, but it is worth being precise about what they prove. An SMS code does not prove that you are present. It proves that whoever the network currently believes owns your number is present. Usually that is you. After a SIM swap, it is not.

This is why the US National Institute of Standards and Technology (NIST), in its digital identity guidelines (SP 800-63B), treats one-time codes sent over the phone network as a restricted authenticator: allowed, but with known risks that services must account for. A phone number is a good identifier. It is a weak authenticator.

Ghana’s SIM re-registration exercise, which linked SIM cards to the Ghana Card, makes it harder to own an anonymous SIM. That helps. But a swap carried out with forged documents or inside help can still move a real, registered number to the wrong person. Registration answers “whose number is this?”; it does not, by itself, protect the moment that number moves.

Breaking the chain

The useful thing about seeing the attack as a chain is that every link is a place to break it. No single party can stop SIM swaps alone, but each can make one step much harder.

As a user:

• Never share your mobile money PIN or any code sent to you, with anyone, for any reason. No genuine operator, bank or agent will ask for it.
• Treat sudden “No service” as an alarm, especially if your phone was working a moment ago and others around you have signal. Contact your network operator immediately from another phone.
• Share less personal information publicly. Your date of birth, ID details and phone number together are the raw material for step 1.
• Where an app offers a better second factor (an authenticator app, a passkey, or a security key), use it instead of SMS for the accounts that matter most, especially email, because email is often the recovery route for everything else.

As a network operator:

• Apply strict identity checks to every SIM replacement, and log who approved it.
• Notify the old SIM (and any linked email) when a swap is requested, so the real owner has a chance to object.
• Offer a “when was this SIM last swapped?” check to banks and fintechs. Industry efforts already exist, such as the SIM Swap API in the GSMA Open Gateway initiative.

As a developer building financial or identity services:

• Don’t let a phone number alone reset a PIN or password. Combine it with something the attacker is unlikely to have.
• Check SIM swap recency where the operator supports it, and add a cooling-off period (or extra checks) for large transfers or credential changes right after a swap.
• Watch for the pattern: a PIN reset, a new device and a large withdrawal close together is a much stronger signal than any one of them alone.
• Offer stronger options like app-based codes or passkeys, and make them easy enough that ordinary users actually turn them on.

Why this matters to me

Mobile money has brought millions of people into the financial system, including many who never had a bank account. That is exactly why its security matters so much: the people most dependent on it are often the ones with the least room to absorb a loss. Designing authentication that is both simple and strong for these users, on the devices and networks they actually use, is one of the problems I most want to work on.

If you have been affected by a SIM swap, report it to your network operator, your mobile money provider and the police straight away. In Ghana, you can also report cyber incidents to the Cyber Security Authority.