A SIM swap moves your phone number to a SIM controlled by an attacker. If an application sends an SMS one-time password (OTP) to that number, the attacker can receive the code and pass the application's check. The application therefore needs another way to decide whether the person is the rightful account holder.
How does SIM-swap fraud work?
The attacker first targets the carrier account, often by pretending to be the number's owner or using information exposed elsewhere. The carrier moves the number to the attacker's SIM. Service on the owner's phone then stops. Calls and texts for the number reach the attacker. The attacker uses an SMS code from the application to attempt an account takeover.
This path attacks number ownership at the carrier. It does not crack the OTP. The code can be correctly generated, delivered, and checked. It can still reach the wrong person.
What does an SMS OTP prove?
An SMS OTP proves that the person entering it can receive messages at the number associated with that verification. It does not prove that the person is the rightful owner of the application account. NIST, the US standards body, treats PSTN-based authentication as a restricted option. It asks verifiers to consider signals such as SIM changes, device changes, and number porting before relying on it. See NIST SP 800-63B for the assurance framework.
| Proof or action | What it establishes |
|---|---|
| SMS OTP | Control of the current receiving number |
| Previously enrolled authenticator | Control of an independent authenticator, if the application bound it to the account |
| Account recovery | An application decision based on its recovery evidence and policy |
Two SMS deliveries are still one channel. Sending another code does not make a compromised number an independent factor.
What signals should you watch for?
Treat an unexpected loss of mobile service as a possible incident, especially alongside a carrier alert, a changed account detail, or an unrequested password reset. A carrier PIN and account takeover protection can make an unauthorized number change harder. They do not replace application authentication.
If you suspect a swap, contact the carrier through a trusted route and ask it to restore control of the number. Secure affected application and email accounts through a recovery path that does not depend on the compromised number. Do not test this threat by moving a real SIM.
Does changing the delivery channel fix a SIM swap?
No. A different channel can improve delivery. It does not show that the compromised number is safe. Bird's next-channel operation sends a fresh passcode. Earlier passcodes remain valid. Switching away from SMS does not revoke a code already delivered to the attacker. Treat fallback as a delivery choice, not as SIM-swap remediation or an automatic assurance upgrade. Read what OTP means and what two-factor authentication is for the distinction between a code and an independent factor.
How should an application respond?
Use risk signals to decide whether an SMS check is sufficient. A recent SIM or device change, number port, unusual sign-in, or carrier alert can trigger a stronger authenticator or an application-owned recovery flow. NIST's guidance describes these signals as inputs to verifier risk decisions. It does not make every SMS login unlawful.
Keep authentication and recovery separate. A stronger normal login can still be undermined if account recovery accepts only an SMS code after a number takeover. Require independent evidence before restoring access or changing security settings.
How does Bird Verify fit into this flow?
Bird Verify sends and checks passcodes. Your application owns the security decision. Create a verification with the intended recipient, collect the code, and check it with the same recipient. Authorize the login or sensitive action only after the check returns success: true. Message delivery alone is not verification. See the Verify guide, create operation, and check operation.
The recipient's plan determines which channels are available. options.channels can trim or reorder that plan. It cannot add an unavailable channel. If delivery fails, request the next eligible channel only when your risk policy still permits the verification. The next-channel operation advances delivery. It does not detect a SIM takeover or revoke earlier codes. For a channel choice that has already been compromised, use an application-owned recovery decision instead.
A SIM swap changes who receives messages for a number. An SMS OTP can confirm that changed control. Pair it with carrier protections, risk signals, and an independent recovery path when the account warrants it.