SIM swaps: why app codes beat text-message codes

Text-message codes feel secure: a code arrives on your phone, only you can see it, you type it in. The weakness is not the phone in your hand. It is your phone number, which belongs to a mobile carrier and can be moved to another SIM card. If someone persuades the carrier to move your number to their SIM, every text code goes to them instead of you. This is called a SIM swap, and it is one of the main reasons BuyVCC uses authenticator app codes rather than texts.

How a SIM swap happens

1. Information gathering. The attacker collects details about you: name, phone number, address, date of birth, perhaps the last digits of an account. Data breaches, social media and phishing provide much of this.
2. Contacting the carrier. They call or visit the carrier pretending to be you, claiming a lost phone, and ask for the number to be moved to a new SIM. Sometimes an insider at a store is bribed.
3. The switch. Your phone suddenly loses signal. Their SIM now receives your calls and texts.
4. Account takeover. They request password resets and sign-in codes by text for your email, banking and other accounts, and receive them.

The whole process can take less than an hour. Many victims first notice it as a phone that shows "no service" in a place where it normally works.

Why app codes avoid the problem

Authenticator app codes are generated on your device from a secret stored in the app. They do not travel over the phone network. Moving your number to another SIM does nothing to them. An attacker would need your actual phone, unlocked, or a copy of the secret. That is a much harder target than a phone number.

Text codes are still far better than nothing. If a service offers only texts, use them. If it offers an app, switch.

Protecting your phone number anyway

Even with app codes, your number is used for other things: account recovery, bank calls, delivery updates. Make a SIM swap harder:

• Add a carrier PIN or passcode. Most carriers let you set a PIN required for account changes and SIM swaps. Ask for it explicitly.
• Turn on port-out protection if your carrier offers it, so your number cannot be moved to another carrier without extra checks.
• Remove your phone number as a recovery method on important accounts where an app or recovery codes can replace it.
• Keep your number private where you can. The fewer places it appears publicly, the harder you are to target.

Signs a SIM swap may be underway

• your phone suddenly shows no service or "emergency calls only" where it normally works;
• you receive a message from your carrier about a SIM change you did not request;
• you get password reset or sign-in alerts you did not trigger;
• friends say they received odd messages from your number.

What to do if it happens

1. Contact your carrier immediately from another phone and report a fraudulent SIM change.
2. From a trusted computer, change the password of your main email account first, since it controls resets for everything else.
3. Check important accounts for changes to recovery details, and remove any you did not add.
4. For BuyVCC, sign in, check the security page, regenerate recovery codes and change your password. If you cannot sign in or think card details were seen, open a support ticket.
5. Follow the sign-in alert plan for the remaining steps.

Other weak spots in text-message codes

SIM swaps get the headlines, but they are not the only problem with codes sent by text. Messages can be read on a locked phone if previews are shown on the lock screen, so anyone who picks up the phone can see a code without unlocking it. Texts often sync to tablets and computers signed in to the same account, which spreads codes across more devices than you might expect. Some phishing pages also trick people into reading a text code aloud or typing it into a fake form, and because text codes usually stay valid for several minutes, an attacker has time to use them. Finally, text messages depend on signal. Travelers abroad, people in rural areas and anyone with a flat battery can find themselves unable to sign in at the worst moment.

If you must keep text codes on some accounts, turn off message previews on the lock screen, review which devices receive your texts, and never share a code with anyone who contacts you, however official they sound. A genuine company will never call you to ask for the code it just sent.

Why we chose app codes

Every BuyVCC account must set up an authenticator app at registration. The code is needed to sign in, and a fresh one is needed to reveal card details, which hide again after a minute. A stolen password is not enough, and a stolen phone number is useless. Recovery codes cover a lost phone, and a support reset with checks covers the rare case where both are lost. Choosing an authenticator app helps pick one, and account setup in ten minutes shows the setup screens.

Quick answers

Can I receive BuyVCC codes by text instead?

No. App codes are required for all accounts because of the risks described here.

Is an app code safe if my phone is stolen?

Lock your phone and the authenticator app. A thief would need to unlock both. Use recovery codes to move your accounts to a new device quickly.

See how it works and pricing.