Does restoring a phone number resolve a SIM-swap incident?
Restoring the number resolves one part of the incident. Review accounts that used it for recovery or authentication and check their activity separately. Number control, an account reset, and subsequent account use are different events that need different evidence.
The employee’s phone has no service. An account owner receives a password-reset notification. The telecom administrator and the security team each see a different part of the problem.
A phone number can connect a carrier account to several business recovery workflows. If control of that number changes, the response needs to identify those dependencies. Getting service back is one work item; finding out what happened to connected accounts is another.
Two changes can move control of a number
A SIM replacement moves service to another SIM or eSIM under the carrier’s process. A port-out transfers a number to another carrier. Both have legitimate uses. The security issue is whether the person requesting the change is authorized.
The FBI describes SIM-swap schemes involving impersonation of a subscriber, compromised carrier processes, or malicious insiders. Once an attacker controls the number, they may receive calls or text messages used in recovery workflows. The outcome depends on what the affected account accepts and what other checks apply. FBI: SIM-swap schemes
This is different from someone merely spoofing the number shown on caller ID. In this article, the concern is actual control of communications delivered to the number. For a suspicious inbound call without evidence of a carrier change, use the callback verification guide.
How a phone-number takeover led to the SEC account hack
The SEC reported that its X account was compromised on January 9, 2024. In its January 22 update, it said the attacker obtained control of the associated phone number through the carrier and then reset the X account password. It also said MFA had been disabled before the incident and that staff had not identified evidence of access to SEC systems, devices, data, or other social accounts. That was the scope of the SEC’s January 22 statement. SEC: incident statements
In May 2025, the Justice Department reported a sentence for Eric Council Jr. in connection with the incident. Its account described fraudulent identification used to impersonate the subscriber and obtain the number, followed by unauthorized posting by co-conspirators. DOJ: May 2025 sentencing
The case connects three separately observable events: a carrier-side change, an online account recovery, and use of the recovered account. It does not show that an attacker defeated an enabled MFA challenge on that X account. Calling the whole incident an “MFA bypass” would hide the documented configuration and recovery dependency.
One number, separate outcomes
- Carrier change
Who controls the number now? Record carrier confirmation and time.
Possible consequence; verify separately
- Connected account
Did recovery or authentication succeed under the service’s policy? Check the account event.
Possible consequence; verify separately
- Account use
Which action happened? Check application activity.
Restoring the line does not prove that connected accounts are contained.
Map the number before an incident
For a company-managed line, identify its carrier-account administrator and its assigned user. Then ask application owners which business services list that number for password recovery, authentication, or support verification. Include business social-media accounts that might sit outside the central identity inventory.
Use a restricted dependency register with these fields: line identifier, business owner, carrier-account owner, connected service, purpose of the number, alternative recovery route, and date last checked. Avoid placing full recovery secrets or authentication codes in the register.
A number used only for routine contact creates a different dependency from a number that can receive a password-reset code. The purpose column prevents a long contact list from being mistaken for a list of accounts that can be recovered by SMS. Our recovery trust-boundary guide explains how to trace the decision that turns a contact method into authority.
Ask the carrier what your business plan protects
Carrier controls have different scope. T-Mobile’s transfer guidance describes Port Out Protection as restricting transfers to another carrier and says it must be added to each line individually. It lists business plans among the eligible account types. Those details describe that feature, not a universal guarantee that every change to a SIM or eSIM is blocked. T-Mobile: Port Out Protection
A consumer screenshot is therefore not sufficient evidence for a corporate account. Ask your carrier which protections apply to the actual plan, which operations they restrict, who can remove them, and how exceptional recovery is verified. Keep the provider’s answer and the date in the service record. Product names, eligibility, and supported paths can change; verify the current arrangement for the line you are reviewing.
Also ask application owners which authentication and recovery methods remain dependent on the line. Stronger sign-in methods do not tell you what happens during recovery. Review the supported alternatives with the relevant service owner rather than assuming that changing one setting removes every phone-based path.
An outage is a signal to investigate
Loss of service has ordinary causes, so it does not prove a SIM swap. The FBI nevertheless advises watching for changes in SMS connectivity. Contact the carrier using an established route, and ask it to determine whether an unauthorized change occurred. FBI: signs and response
In parallel, have the security team review the known dependent accounts. Preserve available reset notifications and activity records through approved channels. Do not send recovery codes into a general incident chat, or depend on the disputed number to verify the affected person’s identity.
Close each part of the incident separately
The telecom owner needs to confirm the line’s recovery. Each application owner needs to review the affected service’s recovery settings, authentication methods, sessions, and activity. The incident lead should reconcile those results rather than closing the incident as soon as cellular service returns.
Do not use possession of the disputed number as the sole verification route for the affected employee. An unavailable activity history remains an investigation gap; it does not establish that an account went unused. Use the containment checklist to assign remaining session and recovery checks.
