Survey Call Led to SIM Swap Near-Takeover

How the Attack Unfolded

This incident began with an unsolicited phone call from someone claiming to represent the victim's wireless carrier. The caller opened with a customer satisfaction survey and a discussion of loyalty discounts, a low-pressure pretext designed to build rapport before any sensitive request was made. Once trust was established, the caller asked the victim to read back a one-time passcode that had just been sent to their phone. Believing the interaction was routine, the victim complied, unknowingly approving an authentication request initiated by the attacker.

The caller then pursued a second, more damaging request: the account passcode the victim had set up years earlier. Because the call still felt legitimate at that point, the victim disclosed it, providing what the source describes as the final credential needed to access the account. Forensic review later showed the SIM swap enabling call and text interception had actually occurred days before this call took place.

Why the Social Engineering Worked

Several factors combined to make this attack effective:

• The pretext layered a low-stakes survey and discount offer before ever asking for sensitive data, normalizing the request sequence.
• The attacker already possessed personal account details, which made the call feel authentic and reduced the victim's suspicion.
• Requesting the OTP and the passcode as two separate steps spread out the disclosure, so neither request alone seemed like a full account compromise.
• The victim had no immediate way to distinguish a legitimate carrier support call from an impersonation attempt.

What to Watch For

Defenders and everyday mobile account holders should watch for a few consistent warning signs:

• Unsolicited calls asking for authentication information, even when framed as a survey or benefit discussion.
• Any request to read back a one-time passcode. Legitimate providers state they will never ask for this.
• Callers who already know account specifics, which can indicate stolen or breached personal data being used to build credibility.
• Being unexpectedly logged out shortly after authenticating, which can indicate a concurrent session opened by an attacker.

Building Resistance

The most reliable defense is to treat unexpected carrier support calls as suspicious by default: hang up and call back using the official number before sharing any account information. Never share SMS one-time passcodes with anyone who calls, regardless of how legitimate the conversation feels. Secondary credentials such as carrier PINs or account passcodes deserve the same protection as passwords, since they can serve as the final key to a takeover. Finally, because attackers operate within extremely short time windows and can make unauthorized changes quickly, such as canceling a mobile number, any suspected SIM swap or account compromise should be escalated immediately rather than addressed after normal business hours.

How did the attacker get the OTP?

The attacker posed as a wireless carrier representative, opened with a customer satisfaction survey and loyalty discount talk to build trust, then asked the victim to read back a one-time passcode sent via SMS.

What was the final credential the attacker needed?

After obtaining the OTP, the attacker still needed the account passcode the victim had set up years earlier, and the victim disclosed it because the call still seemed legitimate.

How was the SIM swap connected to the call?

Forensics showed the SIM swap had actually happened days before the call, which let the attacker intercept calls and texts and time the social engineering call to complete the takeover.

What should someone do if they suspect a SIM swap or account compromise?

Escalate immediately, since attackers operate within extremely short time windows and can make high-impact account changes such as canceling a mobile number very quickly.