A phone number is an authentication factor a carrier holds

Inherited archive entry · retained from the earlier edition. Its factual, legal and policy claims have not all been reverified for 19 September 2026. Research scope.

What the FBI's advisory measured

The FBI's 8 February 2022 public service announcement, titled 'Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public', records that reported SIM-swapping losses rose from about $12 million across 320 complaints between January 2018 and December 2020, to more than $68 million across 1,611 complaints in 2021 alone. The advisory describes three ways a carrier gets compromised on a victim's behalf: social engineering of the victim or the carrier directly, bribery of a carrier employee, or malware delivered through phishing. Once a swap succeeds, the advisory states, 'the victim's calls, texts, and other data are diverted to the criminal's device', which lets an attacker intercept password-reset messages and one-time codes sent by SMS.

Why a phone number is a weak authentication factor

A phone number is not a secret and was never designed as one; it functions as an authentication factor only because a carrier's internal process decides which physical SIM, and therefore which device, currently answers to it. That decision sits with the carrier's customer-service and porting systems, not with the account holder or with the service relying on SMS for a code. Any account that resets a password or approves a login by texting a code to that number is delegating part of its security to whichever employee, script, or attacker interacts with the carrier next. The FBI's recommendation to prefer 'biometrics or security tokens' over SMS follows directly from this: those factors do not route through a third party's customer-service desk.

What regulation has, and has not, changed

The Federal Register notice for the FCC's rule, adopted in 2023, requires wireless carriers to adopt secure customer-authentication methods before redirecting a number to a new device, a SIM swap, or a new carrier, a port-out, and to notify customers promptly when either happens. It addresses the carrier side of the weakness the FBI described. It does not reach the separate design choice, made by banks, exchanges and other services, to keep SMS as an available or default second factor; that choice remains with each service, not with the carrier or the regulator.

Questions to carry forward

• Does an account offer an authentication method that does not route through a phone carrier at all?
• Would the account holder be notified directly, and promptly, if a SIM swap or port-out occurred?
• Has the service kept SMS as a fallback option even after a stronger factor has been enabled?

A carrier's customer-service process is now part of the security boundary of every account that trusts a phone number. The FBI's figures describe the scale of that exposure; the FCC's rule addresses one part of it, at the carrier, and leaves the choice of relying on SMS at all to each service and its users.