Most security teams feel confident with Multi-Factor Authentication (MFA) solutions like Okta, Azure AD, or Duo. However, a SIM swap attack can silently undermine these defenses in under 30 minutes. This became urgent because attackers are increasingly targeting this blind spot, exploiting the ease with which phone numbers can be transferred to burner SIM cards.

The Attack Chain

Step 1: Target Identification

Attackers start by identifying potential targets through social media platforms like LinkedIn. They gather publicly available information such as date of birth (DOB), address, and the last four digits of the Social Security Number (SSN) from prior data breaches.

Step 2: Carrier Compromise

Using the collected data, attackers contact the mobile carrier and request a SIM swap. Many carriers verify this information through automated systems that can be easily fooled with publicly available data.

Step 3: Service Disruption

Once the SIM swap is successful, the target loses mobile service. The attacker now controls the phone number associated with the target’s MFA setup.

Step 4: Account Compromise

The attacker accesses the Okta portal and triggers an SMS OTP or account recovery process. The one-time passcode or recovery code is sent to the attacker’s device, allowing them to establish a session.

Step 5: Silent Breach

The entire process can take less than 30 minutes, without requiring any malware or zero-day exploits. This makes SIM swap attacks a significant threat to enterprise identity security.

Where Okta and SMS Intersect

SMS OTP as Primary Factor

Many Okta deployments enable SMS OTPs because app-based authenticators generate more support tickets. If SMS is an allowed factor, a SIM-swapped number provides a live OTP delivery channel, satisfying the MFA policy and granting access.

Account Recovery Fallback

Even if the primary MFA method uses Okta Verify or TOTP, recovery often falls back to SMS. This single fallback path is sufficient for an attacker to gain unauthorized access.

Downstream Email Compromise

Gmail and Outlook offer SMS-based account recovery. By SIM swapping an employee’s number, an attacker can reset their Google account, gaining control over the email address linked to Okta. This effectively compromises the entire identity chain.

The Carrier Layer Is Outside Okta’s Scope

Okta, Microsoft, and Duo emphasize the importance of phishing-resistant MFA methods. While this advice is sound, the carrier layer remains invisible to these identity platforms. Carriers manage phone numbers independently, making it difficult for identity solutions to detect SIM swaps.

Detecting SIM Swaps with Code

Detecting SIM swaps requires querying carrier data directly. Below are examples of how to implement this check before triggering account recovery or high-risk actions.

REST API (Python)

Here’s a Python function to check for SIM swaps using a hypothetical API:

import requests

def check_sim_swap(phone: str) -> dict:
    """
    Returns swapped (bool), swap timestamp, and current carrier.
    Call before any high-risk action gated by SMS-based auth.
    """
    response = requests.post(
        "https://xhh3tfrhng.execute-api.us-east-1.amazonaws.com/prod/v1/sim-swap",
        headers={"x-api-key": "YOUR_RAPIDAPI_KEY"},
        json={"phone": phone}
    )
    return response.json()

result = check_sim_swap("+14155551234")
if result.get("swapped"):
    print(f"⚠️  SIM swap detected at {result['swap_timestamp']}")
    print(f"   Current carrier: {result['carrier']}")
    # Block account recovery, alert security team
else:
    print("✓ No SIM swap detected — safe to proceed")

MCP Server (for AI Agents)

For AI agents handling user identities, integrate SIM swap detection as a pre-flight check:

pip install relayshield_mcp

from plugins.relayshield.relayshield_game_plugin import relayshield_functions

# Drop into any GAME agent worker — check_sim_swap is ready to call

Gating Detection in Your Stack

Implement a pre-recovery hook to block SIM-swapped numbers:

def okta_account_recovery_hook(user_phone: str) -> bool:
    """
    Pre-recovery hook — block if SIM swap detected in last 24hrs.
    Wire this into your Okta inline hook or recovery flow.
    """
    result = check_sim_swap(user_phone)
    if result.get("swapped"):
        # Log security event, require in-person verification
        security_alert(user_phone, result)
        return False  # Block recovery
    return True  # Safe to proceed

What to Fix Right Now

Audit Factor Enrollment

Identify every Okta user with SMS enabled and assess the risk:

okta list-users --filter "profile.mobilePhone sw contains '+1'"

Disable SMS as Primary Factor

Enforce stronger MFA methods like Okta Verify or TOTP:

okta update-policy --id <policy_id> --name "Require Okta Verify"

Harden Recovery Flows

Eliminate SMS as a fallback option for privileged accounts:

okta update-recovery-settings --no-sms

Add Detection

Integrate SIM swap detection into your account recovery and high-risk action workflows.

Brief Your Help Desk

Train your help desk to recognize and prevent social engineering attempts related to SIM swaps.

The Bottom Line

Enterprise MFA is only as strong as its weakest factor. For many organizations, that weakest factor is a phone number managed by a carrier. This carrier layer is invisible to identity platforms, creating a significant gap in security. By implementing SIM swap detection and auditing MFA configurations, you can close this gap and protect your Okta deployments from silent threats.