2
  1. If so, how would one go about that, and realistically, how long would it take?
  2. Is there something we can do proactively to make this more difficult?

This seems more relevant than ever since we would not want anyone to gain access to our phone number and any associated accounts, and more and more services, even financial ones seem to force their user to rely on phone number-based identities and authentification.

Note: Assume that we have no reliable way to deactivate our SIM remotely as it is prepaid.

0
4

SIM cards are secure element (SE) which is tamper-resistant amd tamper-evident by design. The PIN code is stored in SE's isolated storage inaccessible from outside. SIM only responds if entered PIN is right or wrong. Three incorrect PIN attempts disable PIN verification. To reset PIN and PIN tries, 8-digit PIN Unlock Code(PUC) is required which also has 3 tries. Three incorrect PUC attempts disables SE permanently.

You can obtain PUC from your network operator. Some network operators prints PUC at the back of the envelope SIM card comes in. Someone impersonating you can also obtain PUC from your provider. SIM swap attacks are much more common and new SIM with your phone number won't have PIN lock either.

Either way, your phone number can be compromised and reused to reset passwords of your associated accounts. Protecting SIM alone to protect your accounts cannot be an intuitive solution. You don't own your number. You only take it on lease. You should use TOTP based 2 factor authentication and set email as primary association with your accounts.

1
  • And to state the obvious when you rely on email verification; don’t use your your work email address for non work related sign ups as typically you will lose access to that account when your employment ends. – HermanB Jan 13 at 8:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.