SIM Swap: when losing signal means losing the company

The SIM cloning that empties accounts in hours — and that Brazilian courts already treat as strict liability for banks.

Audience: Companies and Operations · Risk level: CRITICAL

Blindfy Intelligence Unit · Technical review by Blindfy

Scenario

A partner notices his phone has no signal. He restarts it, switches devices, no luck. By the time the carrier confirms a "duplicate SIM activation" made by someone else, it is too late: the company account was emptied via Pix using the validation SMS sent to the cloned chip.

How the scam works

Criminals gather the target's personal data (leaks, social media, prior scams) and request a duplicate SIM directly from the carrier — sometimes with inside help. They receive every authentication SMS and use them to reset bank, email and ERP passwords within hours.

Common mistake

Treating the phone number as disposable data. For the bank, it is the second factor. For the criminal, it is the master key.

Impact

Emptied corporate accounts, loss of access to critical systems and compromised internal communications. Brazilian courts (TJDFT) have already held banks liable for SIM Swap under strict liability.

What works

Blindfy monitors the exposure of executives' numbers, audits 2FA configuration (favoring authenticator apps over SMS) and keeps an incident response plan that includes direct carrier contact and bank blocking in under 30 minutes.

Protection checklist

Replace SMS with an authenticator app (TOTP) at every bank
Register a porting password with the carrier
Limit public exposure of executives' numbers
Keep direct contact with the carrier's relationship manager
Set a "prolonged signal loss" alert as a response trigger
Document an emergency bank-blocking plan
Audit 2FA on all critical company systems

Editorial sources

The SIM is the company's invisible vault. Treating it as stationery is a cost you discover too late.

← All risk analyses · Blindfy initial assessment