SMS 認証がダメな理由

Some subscribers may be unable to use PSTN to deliver out-of-band authentication secrets in areas with limited telephone coverage, particularly without mobile phone service. Accordingly, verifiers SHALL ensure that alternative authenticator types are available to all subscribers and SHOULD remind subscribers of this limitation of PSTN out-of-band authenticators before binding one or more devices controlled by the subscriber.

Most security controls within your business can be improved, such as passwords, training, and access permissions. However, SMS-based two-factor authentication (2FA) is different, because your business can’t make it stronger. The codes are only as secure as your phone number, and your mobile carrier controls who that number belongs to. Its weakest point is the carrier’s customer support agents.

A SIM swap relies more on preparation than technical skill. First, the attacker collects enough personal information to pass the carrier’s identity checks, such as their full name, date of birth, and answers to common security questions.

With this profile, the attacker contacts the carrier and poses as the customer. They give a reason for the request, such as a lost phone, a damaged SIM, or an upgrade. The goal is always to get the support agent to activate the number on a new SIM.

Once the swap is complete, the attacker moves fast. Password resets for many accounts, such as business email, banking, and software-as-a-service (SaaS) tools, often rely on SMS. The attacker triggers resets on the most valuable accounts first, intercepts each code, and locks the real owner out. This often happens before the employee realizes why their phone has no signal.

The employee’s device isn’t hacked. The attacker doesn’t need common methods such as malware, brute force attacks, or phishing. The carrier simply reassigns the number, using its normal process, to someone who has no right to it.

The weak point is the carrier’s identity checks; something your business has no control over.

The numbers show how fast this has grown. Cifas, the UK’s fraud prevention service, recorded a 1,055% rise in unauthorized SIM swaps in 2024, from 289 reported cases to nearly 3,000. Its Fraudscape 2026 report shows a further 38% increase in 2025, driven by easy access to stolen personal data and more automated attacks.

Mobile phone accounts now make up most account takeover cases, according to the Cifas Fraudscape 2026 report. A phone number has become the recovery key for almost everything else.

• Email administration: Email is the recovery route for almost everything else. An attacker with your email admin account can reset their way into the rest of your systems.
• Finance and payroll platforms: These accounts can move money.
• Domain registrars and cloud consoles: These control your websites and infrastructure.
• Everything else: Lower-risk tools can move on a slower schedule.

The first hour is critical. The attacker is working through account recovery one account at a time, and every minute gives them more access. Act fast:

1. Contact the carrier from another phone or through its online support. Report the unauthorized swap and ask them to freeze and recover the number.
2. Secure the accounts the number protects, starting with email. Change passwords from a trusted device and sign out of all active sessions.
3. In the UK, report the incident to Action Fraud, the national reporting center for fraud and cybercrime. Reports support investigations and push carriers and banks to tighten their checks.

Your business can also reduce the risk on the carrier side. Most carriers offer extra protections, such as a SIM lock, port freeze, or account PIN, that add a check before any transfer.

The lasting fix is to make sure a phone number can’t unlock your business accounts.

Email SHALL NOT be used for out-of-band authentication because it may be vulnerable to:

• Access using only a password
• Interception in transit or at intermediate mail servers
• Rerouting attacks, such as those caused by Domain Name System (DNS) spoofing

Confirmation codes that are sent to validate email addresses or are issued as recovery codes (see Sec. 4.2.1.2) are not authentication processes and not affected by the above prohibition.