Checklist
How to harden account recovery against SIM swap
Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.
How to harden account recovery against SIM swap Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account. Source: https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/ (Cleartext, verified 2026-09-24)
Before you start #
- A map of every recovery and contact-change path, including support-agent tools
- Logs of recovery attempts with outcome and channel
Steps #
0 of 7 steps done
01 Map every recovery path
Include self-service reset, support-agent resets, email change, phone-number change and device re-registration. Attackers use whichever is weakest.
02 Remove SMS-only recovery for high-value accounts
An SMS code alone should never be enough to reset credentials on an account that holds money or has a passkey.[1]
03 Prefer an existing strong credential
Let users recover with another registered passkey or a device you already trust, before any fallback.[2]
04 Check for a recent SIM change before trusting the number
Query a carrier SIM Swap API, where available, and step up or delay recovery if the SIM changed recently.[3]
05 Add a delay and notify the old channels
When a phone number or email changes, notify the previous contact details and hold sensitive actions for a cooling-off period.
06 Lock down support-agent tools
Agents who can change contact details or reset credentials need the same checks as self-service, plus logging and review.
07 Monitor recovery like login
Alert on bursts of recovery attempts, recoveries from new devices and recoveries followed quickly by payee or limit changes.
Progress is saved in this browser only.
Done when #
No recovery path accepts a phone number as the only proof of identity, contact changes notify the previous channels, and recovery events are monitored.
Evidence #
Related questions #
How can banks defend against SIM swap fraud?
Stop treating an SMS code as proof of identity for high-risk actions such as password resets, new payees and contact-detail changes. Check whether the customer’s SIM changed recently before trusting the number, offer phishing-resistant sign-in such as passkeys, and send alerts about sensitive changes to a channel the attacker doesn’t control.
Full answerAre synced passkeys phishing-resistant?
Yes. A passkey is bound to the website it was created for, so the browser won’t offer it to a look-alike phishing site, and there is no code to read out. NIST SP 800-63B-4 accepts synced passkeys at AAL2. The new risk moves to the account that syncs them, which needs strong protection of its own.
Full answerWhat is a SIM swap attack?
A SIM swap is when a criminal gets a mobile carrier to move a victim’s phone number to a SIM or eSIM they control, by impersonating the customer, bribing an insider or taking over the carrier account. The attacker then receives the victim’s calls and texts, including one-time passcodes and password-reset codes.
Full answerCite this checklist #
Answers change. Include the verification date when you quote this page.
Plain text
Cleartext. “How to harden account recovery against SIM swap” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/
Markdown link
[How to harden account recovery against SIM swap](https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/) (Cleartext, verified 2026-09-24)
Changelog #
| Date | Revision | Change |
|---|---|---|
| Rev. 1 | First published. |