Most teams already know SMS codes are weak authentication factors. They still leave SMS as the account recovery path, and that's where SIM swapping rears its head. The attack moves a victim's phone number to a SIM the attacker controls, so the calls, texts, and one-time codes intended for that person arrive on the attacker's device instead.
Calling your carrier helps individuals after the fact but the damage has already been done. If you build an app, the fix for SIM swapping is to stop treating SMS codes as identity. Remove SMS as a recovery path first, then as a login factor, and replace it with phishing-resistant methods like passkeys, email magic links, or device biometrics.
More Info