• We examined the authentication procedures used by five prepaid wireless carriers when a customer attempts to change their SIM card, or SIM swap.
• We found that all five carriers use insecure authentication challenges that can easily be subverted by attackers.
• We reverse-engineered the authentication policies of over 140 websites that offer SMS-based authentication, and rated the vulnerability level of users of each website to a SIM swap attack.
• We found 17 websites on which user accounts can be compromised based on a SIM swap alone.

Responses

• In January 2020, T-Mobile informed us that after reviewing our research, it has discontinued the use of call logs for customer authentication.