How a SIM Swap Took Over His Phone Number in 61 Minutes

A SIM swap lets an attacker take over your phone number without ever touching your phone, and from there they can reset any password that sends a code by text. Mark Kreitzman of Efani lived through it. Someone at a phone store moved his number to another device, and in 61 minutes the attackers got into his bank, email, cloud, and crypto accounts. A strong password didn't help, because they clicked "forgot password" and the code came to them.

In this episode, I talked with Mark Kreitzman of Efani, a mobile carrier built to stop SIM swaps. Mark started his career at AT&T and has worked in telecom and mobile ever since, with a focus on cybersecurity since around 2002. He spent two years at Global Crossing, the company behind much of the undersea fiber optic cable, and worked at two security startups that were bought by Microsoft and Cisco.

Mark was working on his own crypto startup and driving through the desert between Tucson and Phoenix when his phone stopped working. He drove about 50 to 55 minutes to his parents' house, and as soon as his phone joined their Wi-Fi, six password reset messages came in. Someone at a phone store had pointed his account at a different phone. For 61 minutes, whoever held that phone got his calls and texts, used them to reset passwords, and then moved the number back. The carrier wouldn't tell him which store or city made the change, and Mark said they have no legal requirement to.

What stuck with me is how simple the attack is. When you buy a new iPhone and the store moves your number over, that's a legal SIM swap. Attackers do the same thing to a phone in their own hand, often with help from an insider who's been bribed or who sells customer data. Since your email is usually your login, they can try it at a list of banks and crypto companies and reset each account by text. Mark put it this way: "They don't care if you have a phone manufactured by the NSA because your mobile service isn't even pointing at that phone." A SIM swap is a change in the network, so the security on your device never comes into play.

Mark said the big carriers have done the math. They spend their money getting you in the door, and moving a number out involves no humans at all, so they accept a certain level of fraud instead of paying for the staff it would take to stop it. Efani reverses that. It runs as a mobile virtual network operator on AT&T or Verizon, so the coverage is the same. Efani holds the account, so a phone store can't make changes to it. It collects only payment and verification details, and any request to move a number out goes through human verification by phone, text, and email if needed. Mark said Efani also carries an insurance policy that covers up to $5 million in SIM swap losses, and it's never been used. Efani grew out of a setup its founder, now the CEO, built for his own family after being SIM swapped about three times. Mark joined him about 100 to 120 days after his own attack.

We spent a good part of the conversation on AI and security. Mark has built more than 30 security scans, and he showed how cheap scanning has become. On a $7 a month server, he can scan about 1,000 company domains in 4.2 seconds, which means an attacker with the same tools can find the weakest targets in minutes. When he ran his API key scan on his own AI-built project, it found two keys sitting in a public folder on the web server. In a scan of 10 companies, he found 64 staging sites, the test versions of apps where security often gets skipped. In my experience, coding is the easy part now. Deciding how data should flow and what needs protecting still takes a person.

Phishing came up through a scare I had a few months ago. Right before a 10-hour flight, I got a real email from AWS saying my $2.50 budget alert had hit $108 million. I didn't click anything, and I found other people on X with the same alert, so it turned out to be an error on Amazon's side. Mark's point was that this is the exact panic attackers try to create with fake emails. That's why companies need SPF, DKIM, and DMARC set up on their email domain, so nobody can send mail that looks like it came from them. A few days before we recorded, one of our clients was missing these, and adding them to DNS took a few minutes. Mark said a few minutes of fixes like these can close about 80% of the security gaps he sees, and many businesses still haven't made them.

My takeaway is that your phone number is a key to a lot more than your phone. Look at which of your important accounts can be reset with a text message. If you run a business, check your email domain settings and run a security review on anything you built with AI before someone else finds the holes. You can learn more about Efani at efani.com.