This alert may not be shared outside your organization, Do Not Repost or send, place on other websites, List servers, or send to others via email, including other associations or parties. Members and Law enforcement use only. Contact us for any permissions. To do otherwise will result in the loss of membership.
Complete Story
08/23/2026
SIM Swapping: How the Attack Works and How to Protect Your Users
Security Boulevard
Most teams already know SMS codes are weak authentication factors. They still leave SMS as the account recovery path, and that's where SIM swapping rears its head. The attack moves a victim's phone number to a SIM the attacker controls, so the calls, texts, and one-time codes intended for that person arrive on the attacker's device instead.
Calling your carrier helps individuals after the fact but the damage has already been done. If you build an app, the fix for SIM swapping is to stop treating SMS codes as identity. Remove SMS as a recovery path first, then as a login factor, and replace it with phishing-resistant methods like passkeys, email magic links, or device biometrics.
More Info
Alerts
The FRPA alert system distinguishes us from other groups by gathering and providing information to law enforcement, retailers AND financial institutions.
more information
Resources
Your electronic library to help in fighting financial fraud for all of our partners.
more information