Can a SIM card lock be circumvented?

Question

1. If so, how would one go about that, and realistically, how long would it take?
2. Is there something we can do proactively to make this more difficult?

This seems more relevant than ever since we would not want anyone to gain access to our phone number and any associated accounts, and more and more services, even financial ones seem to force their user to rely on phone number-based identities and authentification.

Note: Assume that we have no reliable way to deactivate our SIM remotely as it is prepaid.

Answer 1

SIM cards are secure element (SE) which is tamper-resistant amd tamper-evident by design. The PIN code is stored in SE's isolated storage inaccessible from outside. SIM only responds if entered PIN is right or wrong. Three incorrect PIN attempts disable PIN verification. To reset PIN and PIN tries, 8-digit PIN Unlock Code(PUC) is required which also has 3 tries. Three incorrect PUC attempts disables SE permanently.

You can obtain PUC from your network operator. Some network operators prints PUC at the back of the envelope SIM card comes in. Someone impersonating you can also obtain PUC from your provider. SIM swap attacks are much more common and new SIM with your phone number won't have PIN lock either.

Either way, your phone number can be compromised and reused to reset passwords of your associated accounts. Protecting SIM alone to protect your accounts cannot be an intuitive solution. You don't own your number. You only take it on lease. You should use TOTP based 2 factor authentication and set email as primary association with your accounts.