IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Attacking account recovery — SIM swap
Maya never loses her password and never falls for a phishing page. It does not matter. An attacker phones her mobile carrier and asks to move her number to a new SIM. Minutes later every text-message code goes to the thief's phone. Your goal: see why recovery is the weak door, and how to make it strong.
- An account is only as strong as its weakest recovery route.
- SMS codes, security questions and the help desk are common weak doors.
- The email account is the master key, so protect it most.
- Make recovery phishing-resistant, loud and slow.
The weakest link is not the login
We work hard on the front door: passkeys, MFA and adaptive risk. Then we add an account recovery path: "Forgot password?" and "Lost your device?" We often make it weaker than the login, for fear of locking people out. Attackers know this.
Your account is only as strong as its weakest recovery route. A phishing-resistant login guarded by an SMS reset is an SMS-strength account.
Three phone calls, one trick
Many recovery attacks are only phone calls. The thief does not pick a computer lock. They talk to a person who can open it.
- A call to the carrier. The caller poses as Maya and asks for a new SIM. This is the SIM swap. Her number, and every text code, moves to the thief. Her own phone suddenly shows no signal. That is the first sign.
- A call to the help desk. The caller poses as an employee and asks for an MFA reset. The next lesson, Fake help-desk calls, covers this one.
- A call to Maya. A fake "bank officer" says her account is in danger and asks for the OTP. The basics lesson covers this one.
All three use a confident voice, a good reason and hurry. You cannot fix a human voice. So you remove the choice, with rules that no voice can bend.
The attacker's shortlist
| The route | Why it works | How you close it |
|---|---|---|
| SIM swap against SMS codes | Moving the number sends every text code to the attacker. | Stop using SMS for recovery. Prefer passkeys and offline codes. Ask your carrier for a PIN on number changes. |
| Security questions | "Mother's maiden name" and "first pet" are easy to find or guess. | Retire them. They are shared secrets that are not secret. |
| Help-desk social engineering | A convincing caller talks an agent into a manual reset. | Verify on a channel you choose (see the next lesson). |
| Email takeover | Whoever owns the mailbox can reset everything that sends a link to it. | Protect the email account most of all. It is the master key. |
Closing the back door
You cannot remove recovery. People really do lose their phones. So raise every route to the same bar, because attackers need only the lowest one:
🔑 Phishing-resistant recovery
Enroll a second passkey. Give out offline recovery codes: one-time strings Maya prints and keeps in a drawer. Both work after a lost phone and never touch SMS. SMS is fine as a nudge, but never the only wall.
⏳ Step up, wait, tell
Treat recovery as high risk. Ask for step-up proof. Add a cooling-off delay. Tell Maya on every channel, so she can shout "not me!"
This time Maya dropped SMS and enrolled offline codes and a backup passkey. The attacker swaps her SIM and gets nothing. They call the help desk. The agent sends a push to Maya's real device. Maya taps Deny. Zara gets an alert. Same attacker, no back door.
Go deeper: What the standards say about SMS
NIST SP 800-63B-4 calls SMS and voice codes "restricted" authenticators. The service must offer an alternative. It should also check for signs like a recent SIM change.
MITRE ATT&CK lists the number attack as technique T1451, SIM Card Swap, in its mobile matrix. Its advice includes non-SMS authentication and a carrier PIN for account changes.
Go deeper: A real campaign
CISA advisory AA23-320A (November 2023, updated July 2025) describes the group known as Scattered Spider. Its methods match this lesson. The group phoned help desks to get passwords reset and MFA moved to a device it controlled. It sent repeated push prompts until someone approved. It also persuaded carriers to move phone numbers to SIMs it held. CISA's first advice is phishing-resistant MFA (FIDO/WebAuthn or PKI-based). It says this is not susceptible to push bombing or SIM swap attacks.
Go deeper: In India: SIM swaps and fake officers
A September 2022 instruction from the Department of Telecommunications asks operators to bar SMS, in and out, for 24 hours on a new SIM issued after a swap. This gives you a day to notice. It does not stop a caller who talks a person into a reset.
If your phone loses signal for hours while others nearby have it, act fast. Call your carrier from another phone. Then call your bank on the number on your card. Report cyber fraud on 1930 or at cybercrime.gov.in. Payment authentication rules are in the rules lesson.
🧪 Interactive lab — enable JavaScript to play with this one.
The strongest recovery route is another phishing-resistant factor. Grade your WebAuthn and passkey setup, including backup keys, with Passkey Check.