If I was to use a phone's data connection to access a website, and then pop that sim card into another phone to access the same website, could the website tell that I am the same user?
Not that I am aware of.
- Websites receive the information the web browser provide
- The web browser of the phone devices is an app that has not the permission to get the SIM data of the mobile device (unless it was an malicious app)
- Information of the device apart from cookies does include the User Agent, but that string of information that not include that kind of information.
- You can not relay on IP addresses, your phone provider may use DHCP/nat and the phone could use a different phone provider network (roaming)
I would suggest using client side certificates, when the phone is changed remove the certificate and when user is no longer trusted revoke it.