# How to harden account recovery against SIM swap

> **In brief:** Account recovery is where SIM-swap and phishing attacks cash out. These steps stop a hijacked phone number from being enough to take over an account.

- URL: https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/
- Last verified: 2026-09-24 by [VERIFIER NAME] (revision 1)
- Publisher: Cleartext, owned by [OWNER ENTITY] (see https://glide-cleartext.pages.dev/about/ownership-and-funding/)

- For: Developers and identity teams
- Time: One to two sprints for the core changes.

## Before you start

- A map of every recovery and contact-change path, including support-agent tools
- Logs of recovery attempts with outcome and channel

## Steps

1. [ ] **Map every recovery path.** Include self-service reset, support-agent resets, email change, phone-number change and device re-registration. Attackers use whichever is weakest.
2. [ ] **Remove SMS-only recovery for high-value accounts.** An SMS code alone should never be enough to reset credentials on an account that holds money or has a passkey.[^1]
3. [ ] **Prefer an existing strong credential.** Let users recover with another registered passkey or a device you already trust, before any fallback.[^2]
4. [ ] **Check for a recent SIM change before trusting the number.** Query a carrier SIM Swap API, where available, and step up or delay recovery if the SIM changed recently.[^3]
5. [ ] **Add a delay and notify the old channels.** When a phone number or email changes, notify the previous contact details and hold sensitive actions for a cooling-off period.
6. [ ] **Lock down support-agent tools.** Agents who can change contact details or reset credentials need the same checks as self-service, plus logging and review.
7. [ ] **Monitor recovery like login.** Alert on bursts of recovery attempts, recoveries from new devices and recoveries followed quickly by payee or limit changes.

## Done when

No recovery path accepts a phone number as the only proof of identity, contact changes notify the previous channels, and recovery events are monitored.

## Sources

[^1]: SP 800-63B-4: Authentication and Authenticator Management. NIST. https://pages.nist.gov/800-63-4/sp800-63b.html
[^2]: NIST cites phishing resistance of synced passkeys in digital identity guidelines update. FIDO Alliance. https://fidoalliance.org/nist-cites-phishing-resistance-of-synced-passkeys-in-digital-identity-guidelines-update/ (secondary)
[^3]: CAMARA project. Linux Foundation. https://camaraproject.org/

## Related questions

- [How can banks defend against SIM swap fraud?](https://glide-cleartext.pages.dev/q/how-can-banks-defend-against-sim-swap-fraud/)
- [Are synced passkeys phishing-resistant?](https://glide-cleartext.pages.dev/q/are-synced-passkeys-phishing-resistant/)
- [What is a SIM swap attack?](https://glide-cleartext.pages.dev/q/what-is-a-sim-swap-attack/)

## Cite

Cleartext. “How to harden account recovery against SIM swap” Last verified 2026-09-24 (rev. 1). https://glide-cleartext.pages.dev/checklists/harden-account-recovery-against-sim-swap/

## Changelog

- 2026-09-24: First published.