There is a moment, somewhere between an attacker sweet-talking a call centre agent and a victim’s phone going dead, where every layer of two-factor authentication your bank trusts becomes worthless. SIM swap fraud targeting UK banks’ 2FA systems is not a theoretical edge case, it is a running operation, executed dozens of times a day, and the networks carrying it out on attackers’ behalf are O2, Vodafone, and EE. Not intentionally. But effectively, yes.
I’ve spent time digging into how this actually works end-to-end, and the picture is grimmer than the press releases from either the banks or the telcos suggest. The vulnerability is structural. It has been known for years. And nobody with the power to fix it has done so in a way that actually holds.
What a SIM swap actually is
Your phone number is, functionally, a credential. Banks treat it as a second factor, they send an OTP via SMS, you enter it, you’re in. The assumption baked into that flow is that only you control the SIM registered to that number. SIM swapping breaks that assumption by convincing a mobile network’s systems, or a human agent, to transfer your number to a SIM card the attacker controls.
Once the swap goes through, your phone loses signal. The attacker’s handset starts receiving your calls and texts. From that point, every SMS-based 2FA code, every “forgotten password” reset, every bank OTP goes to them. The victim usually doesn’t know anything has happened until they try to make a call and find their number is dead.
How attackers build a profile before they ever call
The call to the network is usually the last step. Before that, the attacker has already assembled enough personal data to pass whatever identity verification the operator uses. This is not difficult in 2026. Electoral roll data is commercially available, and as I covered previously in how UK electoral roll data flows into commercial data broker pipelines, the open register loophole means your name, address, and enough linking data to reconstruct a profile is sitting in databases you’ve never heard of.
Add a basic phishing run, a fake O2 “account security” page, a spoofed EE billing notification, and you can harvest account credentials, the last four digits of a payment card, a date of birth. Criminals targeting high-value accounts sometimes combine this with a vishing call to the victim first, pretending to be the bank’s fraud team, extracting answers to security questions while they’re at it. By the time they ring the network, the social engineering has already happened twice before the main event.
The porting authorisation gap at UK operators
The formal process for moving a number between networks is called porting, and there is a related but distinct in-network process for replacing a SIM. Both have authentication requirements. Both have been routinely bypassed.
In-network SIM swaps at O2, Vodafone, and EE can be initiated by calling customer services, visiting a store, or through online account portals. The verification requirements differ between channels and, critically, between individual agents. Store-level verification has historically been the weakest link, staff are trained to be helpful, they have targets around call handling time, and the data an attacker presents (ID, account number, partial postcode) usually passes a human check designed to catch forgetfulness rather than fraud. Academic researchers at University College London tested 10 UK network operators’ authentication processes in a structured study a few years back; the results were not flattering, with multiple operators susceptible to partial-data attacks.
Online account portals have their own problem. If an attacker has already phished the victim’s network account credentials, they can initiate a SIM swap entirely self-service, with no human in the loop at all. Vodafone’s MyVodafone portal, for instance, has historically allowed SIM changes with only account login plus the last four digits of a payment card. Both of those things are regularly compromised together in credential stuffing runs.
Why SS7-based 2FA is still a disaster
SS7 (Signalling System No. 7) is the protocol stack that underpins routing for calls and SMS across global mobile networks. It was designed in the 1970s for a world where only a handful of trusted telcos had access to the network. Today, hundreds of operators worldwide have SS7 access, and the trust model has not been updated to reflect that reality.
The attack surface here is separate from SIM swapping but produces the same outcome. An attacker with SS7 network access, achievable by paying for access through a rogue operator, compromising a legitimate one, or in some jurisdictions by simply buying it, can intercept SMS messages destined for any number without ever interacting with O2 or EE. They just reroute the delivery silently at the protocol level. I wrote previously about how the UK’s 999 location infrastructure relies on this same stack in how UK mobile networks handle emergency location data. The systemic trust placed in SS7 is a thread running through critical infrastructure and consumer banking alike.
The GSMA, which governs mobile standards, published guidelines years ago on SS7 filtering. Not every operator has implemented them fully. Ofcom has noted SS7 vulnerabilities in its signalling security work, but the regulator has no direct power to compel specific technical implementations at speed. The result is that banks continue to send OTPs over a channel with documented intercept vulnerabilities.
What the banks actually know (and aren’t fixing)
This is the part that genuinely frustrates me. Banks are well aware SMS OTP is a weak second factor. The Payment Systems Regulator’s data on authorised push payment fraud cites account takeover as a significant upstream contributor, and SIM swap is a primary route into account takeover. Behind closed doors, the major UK banks have pushed Ofcom and the Home Office for mandatory real-time SIM swap notification APIs from the networks, something that would let a bank check whether a SIM swap occurred in the last 24 hours before processing a high-value transfer.
Vodafone, O2, and EE do provide some version of this notification capability to select banking partners. The problem is it is not universally adopted, not consistently implemented, and not applied to every authentication step. A bank might check it before a new payee is added but not before an account login. The coverage is patchy. And smaller challengers building on Banking-as-a-Service platforms often have no access to the API at all.
The NCSC has recommended moving away from SMS-based OTP towards authenticator apps and push notifications for years. The practical reality is that a bank cannot unilaterally drop SMS 2FA without abandoning customers who don’t own smartphones capable of running an authenticator app, or who lack the technical confidence to set one up. And so SMS persists, leaking value to attackers the entire time.
What actually stops a SIM swap
Port freezes, sometimes called SIM lock or number lock, are a consumer-accessible defence at the network level. EE, O2, and Vodafone all allow you to place a bar on your account that requires an additional PIN or in-store visit before any SIM change. Virtually none of the fraud victims I’ve read about in Action Fraud reports had enabled this, mostly because they didn’t know it existed and the networks don’t exactly advertise it.
At the bank end, the most robust protection is moving to FIDO2 passkey authentication entirely, removing SMS from the flow. I covered the state of passkeys as a technology in this broader context before, and the trajectory is right, but the migration timeline at UK retail banks is measured in years, not months. HSBC, Lloyds, and NatWest have all begun rolling out app-based push approval flows that are SIM-swap-resistant, but the legacy SMS fallback remains active for most account types.
In the meantime, the attack surface on Android banking apps facing overlay and accessibility abuse means even authenticator apps have their own threat model. There is no single perfect layer. The point is that SMS OTP combined with brittle telco identity verification is the worst of the available options, and UK banks’ 2FA still relies on it at scale.
Enable a SIM lock on your account with your network today. Switch to an authenticator app wherever your bank allows it. And understand that if your phone goes dead unexpectedly, your first call (from a different phone) should be to your bank, not your network.
Frequently Asked Questions
How does a SIM swap attack actually work in the UK?
An attacker collects enough personal data about a target, name, address, date of birth, account details, then contacts the victim’s mobile network and convinces them to transfer the number to a new SIM. Once the swap completes, the attacker receives all SMS messages, including bank OTP codes, allowing them to reset passwords and authorise transfers.
Which UK mobile networks are most vulnerable to SIM swap fraud?
O2, Vodafone, and EE have all had documented cases involving SIM swap fraud. The vulnerability is structural rather than specific to one network: in-store and phone-based verification processes rely on data that is often already compromised by the time an attacker makes contact. Online self-service portals with weak authentication are a particular risk vector.
Is SMS two-factor authentication safe for UK banking?
SMS 2FA is significantly weaker than authenticator apps or hardware keys. Both SIM swapping and SS7 interception allow attackers to receive OTP codes without ever touching the victim’s phone. If your bank offers an authenticator app or push-based approval, switch to it immediately and treat SMS OTP as a last resort.
How can I protect myself from SIM swap fraud in the UK?
Contact your mobile network and ask them to place a SIM lock or port freeze on your account, requiring a PIN or in-store visit before any SIM change is processed. Also switch from SMS-based OTP to an authenticator app wherever your bank allows it, and use strong unique passwords for both your bank and your network account.
Leave a Reply