SIM swap: how a phone number stops being yours
Nothing is hacked. The number is moved by the company that owns it, on a request that looked legitimate — and your phone losing signal is the only warning you get.
Tag
#Two-factor authentication
The OTP code you were told to read out
The message arrives from the right number, because they caused it to be sent. Why the request itself is the answer, and the one method that cannot be spoken aloud.
Your recovery options are the real password
Account takeovers rarely start with a guessed password. They start with a recovery email or phone number nobody had checked in years — and the change is designed not to be noticed.
SMS codes, authenticator apps, passkeys: which actually stops account takeover
All three are called two-factor authentication and they are not equivalent. Two of them can be phished in real time; one cannot, for a structural reason worth understanding.