Is hacking email with simjacking a concern if you don't have 2FA for the email?

Question

I've been doing some reading on simjacking lately, mainly around how one may be compromised. One common tidbit I read is that you can access your email and your other financial services if you have 2FA for those services. E.g.: here is one quote:

Once the swap is complete, messages containing codes for those two-factor authentication systems we now all have can be intercepted, and fraudsters can hop into your email, social media or mobile banking accounts.

(Source: https://www.vice.com/en/article/3kx4ej/sim-jacking-mobile-phone-fraud)

I completely understand social media and mobile banking accounts could be compromised: if my mobile banking and/or social media accounts are set up to send the security code to my mobile device, and you simjack that device, then the fraudster can receive the code and log into your accounts.

However, assuming your email does not use your mobile number as recipient for 2FA (e.g. if you use TOTP, or if you have a back-up email address to send codes to), does simjacking actually give access to email? I can't seem to connect those two dots -- and I am not sure if I am missing something.

Thank you.

Answer 1

If an SMS alone was sufficient for login, that would make it 1FA instead of a component of 2FA/MFA, wouldn't it? There's probably a password, too, protecting the account. In this case, an attacker must both steal the password and simjack the mobile subscription for the SMS.

However, a real problem is that some services use SMS based authentication both for 2FA and password recovery. This is what makes simjacking a powerful weapon. If both factors are controlled by the possession of a mobile number, I wouldn't count it as 2FA (two-factor authentication), but merely a two-phase authentication.

On the other hand, if you use Time-based One-time Password (TOTP), instead, and if you can't recover both your password and your TOTP using your mobile subscription, you are pretty immune to simjacking.