Your Phone Is the Weakest Link in Your Financial Security

Every major financial account you own — brokerage, bank, 401(k), crypto if you have it — can be accessed by someone who controls your phone number for fifteen minutes. If you haven’t thought about what else is quietly collecting your data, that’s worth a read too.

That’s not a theoretical threat. SIM swap fraud — where an attacker convinces your carrier to transfer your number to a SIM card they control — has been used to drain brokerage accounts, empty crypto wallets, and access tax accounts. The FBI received 1,075 SIM swap complaints in 2023 resulting in $48 million in losses. That number is almost certainly undercounted.

The mechanism is straightforward. Attacker calls your carrier. Claims to be you. Provides your name, last four of your SSN, billing address — all available from the data breach databases they’re shopping on Telegram. Carrier transfers the number. Attacker now receives every SMS two-factor code sent to that number. They request password resets on your accounts. They’re in.

SMS Two-Factor Is Not Security

This is the thing the financial industry still hasn’t fully communicated: SMS-based two-factor authentication is the weakest form of 2FA available. It’s better than no 2FA. It is not meaningfully better than a strong password if an attacker is specifically targeting you.

The upgrade is straightforward. Authenticator apps — Google Authenticator, Authy, 1Password’s built-in TOTP — generate time-based codes that live on your physical device. They can’t be intercepted via SIM swap because they’re not transmitted over the phone network. A hardware key like a YubiKey goes further: it requires physical possession of the device to authenticate. No SIM swap touches it.

Most major brokerages support authenticator apps. Fidelity does. Schwab does. Vanguard recently added it. If your brokerage only offers SMS 2FA, call and ask when authenticator app support is coming. Then decide whether the answer is acceptable.

Lock Your SIM Before Someone Else Does

Every major US carrier offers a SIM lock or port freeze. AT&T calls it a port protection feature. T-Mobile has it in account settings. Verizon lets you add a PIN required for any account changes. These aren’t advertised — you have to go looking for them.

Set a unique carrier PIN that isn’t your birthday, last four of your SSN, or any number that appears in your personal data. Store it in your password manager. This doesn’t make SIM swap impossible — carrier employees can still be socially engineered — but it adds a friction layer that routes attackers toward easier targets.

The other move: remove your phone number from financial accounts wherever you can. Banks and brokerages use it for password resets even when you haven’t set it as a 2FA method. Check each account’s security settings. If a phone number is listed, evaluate whether it needs to be there.

What the Attack Actually Looks Like

It doesn’t announce itself. You’ll notice your phone loses service — no signal, calls going straight to voicemail. You’ll try to figure out if it’s a network outage. By the time you call your carrier and realize what’s happened, the attacker has had 20 to 40 minutes with your accounts.

The first sign is often an email notification: “Your password has been changed.” Or a text to your now-compromised number that you’ll never receive: “Your account was accessed from a new device.”

Set up account activity alerts on every financial account you own. If you’re still using SMS for two-factor on your password manager itself, the password manager post covers how to harden that layer too. Email notifications for logins, transfers, password changes. They’re in the security settings of every major bank and brokerage. Most people never turn them on. They’re the difference between knowing about an attack in real time and finding out three days later when you check your balance.

Thirty minutes of setup across your carrier account, your financial accounts, and your authentication method closes most of the exposure. The people who get cleaned out are almost always the ones who hadn’t done it.