Two-factor authentication was supposed to make your accounts safer. And it does — unless the second factor is a text message, and an attacker has already taken control of your phone number.
SIM swapping is the attack that breaks SMS-based 2FA. It does not require hacking a server, stealing a device, or writing a line of code. It requires convincing a mobile carrier employee to reassign your phone number to a SIM card the attacker controls. Once that happens, every text message meant for you — every verification code, every account recovery link, every one-time password — goes to them instead.
The consequences for cloud accounts and personal file storage are direct: your cloud photos, documents, and personal files become accessible to whoever controls your phone number, regardless of how strong your passwords are.
How SIM Swapping Works
The attack has two main variants, and both exploit the same structural weakness: mobile carriers must be able to transfer a phone number to a new SIM card, because legitimate reasons exist for this — getting a new phone, replacing a damaged SIM. The process requires verifying the account holder’s identity, and those verification processes can be defeated.
Social engineering. The attacker calls the carrier’s customer service line posing as the victim. They have gathered enough personal information — name, address, account number, last four digits of a Social Security number — from public records, data broker sites, or previous breaches to pass identity verification. The carrier representative, following legitimate protocol, transfers the number.
Insider access. In some documented cases, attackers have bribed carrier employees directly to perform the transfer. The victim has no way to protect against this variant through their own behavior.
Once the transfer succeeds, the attacker’s SIM receives the victim’s calls and texts. The victim’s phone shows no signal — often the first sign something is wrong, if they notice it at all.
Why SMS-Based 2FA Breaks Instantly
Modern account security relies heavily on a second factor to prove you are you, even if someone has your password. For many services, that second factor is a text message — a code sent to your registered phone number.
When an attacker controls your phone number, they control that second factor. The sequence plays out quickly:
- Attacker initiates a password reset on your email account
- Verification code goes to the attacker’s phone (your number, their SIM)
- Attacker enters the code, resets your email password
- With email access, they initiate password resets on every service linked to that email address
- Cloud storage, photo services, document storage — all fall in sequence
The attack does not require knowing any of your passwords at the outset. Control of the phone number is sufficient to trigger password resets that replace them all.
The Numbers Behind the Threat
SIM swapping is no longer a niche attack. In the UK, reported SIM-swap cases rose over 1,000% in a single year, from under 300 incidents to nearly 3,000. In the United States, the FBI has tracked tens of millions of dollars in losses attributable to SIM-swap fraud.
Security research from Mandiant noted that voice phishing — one of the primary methods for obtaining the personal information used in SIM swap attacks — overtook email phishing as the leading social engineering vector in cloud-related compromises, reaching 23% of cloud incidents examined.
Individual cases have been dramatic. In one documented incident, a perpetrator impersonated platform support representatives to obtain access codes from thousands of users, compromising hundreds of accounts and stealing private images. Celebrities, cryptocurrency holders, and executives have been targeted specifically because of the value of what their accounts contain.
But ordinary people are targeted too, usually because attackers have automated the process of identifying which phone numbers belong to accounts with recoverable assets — and personal photo archives, journal entries, and private documents have clear value to anyone willing to exploit them.
What Attackers Actually Access
The downstream targets once an attacker has email access vary based on what the victim has connected to that address, but for personal file and photo storage, the path is straightforward.
Cloud photo services — where years of personal photos, family records, and location data are stored — are typically linked to the same email address as everything else. Document storage and file backup services follow the same pattern. Any service where you have used “sign in with Google” or “sign in with Apple” through the compromised email extends the attacker’s access further.
Beyond files and photos, attackers gain access to:
- Linked financial accounts
- Stored payment information
- Communication history in linked messaging services
- Health data synced from wearables or health apps
- Notes, journals, or personal records stored in linked services
The attack surface is, in practice, every account associated with the phone number and the email it can be used to compromise.
How to Protect Yourself
The most direct protection is to remove SMS as a 2FA option wherever possible and replace it with alternatives that cannot be hijacked via SIM swap.
Authenticator apps — such as Google Authenticator, Authy, or the built-in TOTP feature in many password managers — generate time-based codes on your device. They do not rely on your phone number; they use a secret key stored in the app. Swapping your SIM does not give an attacker access to these codes.
Hardware security keys are FIDO2-compliant devices that require physical possession to authenticate. No SIM swap, no phishing link, no social engineering can substitute for having the key in hand.
Passkeys are the newer generation of phishing-resistant authentication, stored securely on your device and verified through biometrics or a PIN. Like hardware keys, they are tied to the physical device, not to a phone number.
Carrier-level protections add friction to the SIM swap process itself. Most major carriers offer the option to set a PIN or passcode required before any account changes, including SIM swaps. Some carriers offer “port freeze” features that block number transfers for a set period. These are not impenetrable, but they raise the bar significantly for casual attackers.
A separate email address for sensitive accounts. Using a dedicated email address — one that is not widely known and is not used for public-facing registrations — for high-value accounts like cloud storage reduces the blast radius if a primary email account is compromised.
Auditing Your Accounts Now
It is worth reviewing which of your accounts still use SMS as a 2FA option. Most major services offer authenticator app alternatives, and many now support passkeys. The review is straightforward: go to the security settings of each important account and check what authentication methods are active.
For cloud storage and photo services specifically, the question is: if someone controlled your email right now, what could they access, reset, and lock you out of? The answer to that question is the scope of your SIM swap exposure.
Switching to an authenticator app takes a few minutes per account. It is one of the highest-value security improvements available for the effort required, and it eliminates the most common path attackers use to bypass two-factor authentication.
Protecting What Is Inside Your Accounts
Strong authentication prevents unauthorized access from the outside. What is inside your account — how your files and photos are protected at rest — is a separate layer that matters independently.
Storage providers that encrypt files at rest, not just in transit, ensure that even if someone gained server-level access, your files would not be immediately readable. For personal photo and file storage, encryption at rest is worth verifying before choosing a service.
daftei encrypts all files in transit using TLS 1.3 and at rest using AES-256. The combination of strong external authentication on your account — using an authenticator app or passkeys rather than SMS — and AES-256 encryption at rest covers both the account access layer and the data layer against the most common attack patterns, including SIM swapping.
The practical standard for protecting personal cloud files is not complicated: use authentication that does not route through your phone number, and store files with a service that encrypts them independently of your account credentials.
One More Step: What Happens if You Lose Access
Any serious security setup includes a recovery plan for when the primary authentication method is unavailable — device lost, hardware key misplaced, authenticator app not accessible.
Most services offer recovery codes — one-time-use backup codes generated when you set up 2FA. These codes bypass your primary 2FA method, which means they need to be stored as carefully as the 2FA itself.
A printed copy in a physically secure location, or storage in an encrypted note in a different service from the one being secured, are both reasonable approaches. The goal is that recovery is possible for you while remaining impossible for an attacker who only has your phone number.
Building in a recovery path ensures that improving your SIM swap resistance does not create a new failure mode: locking yourself out permanently when something unexpected happens to your primary device.