One Bar of Signal: The Thirty-Minute SIM-Swap Rehearsal for Small UK Teams

Most small teams treat a mobile number as a contact detail. In practice, it is often the reset button for everything else. Email recovery, banking checks, payroll portals, HMRC logins, Microsoft 365 and Google Workspace verification, even the backup route for your password manager — a single SIM can quietly sit behind all of it.

That is not a reason to panic. It is a reason to rehearse. If the number disappears from someone's handset on a Tuesday morning, you do not want the first conversation about it to be a confused one between the office manager and a call centre queue. You want a short, boring plan that everyone has already walked through once.

So here is a thirty-minute tabletop for teams with no helpdesk, no security team and no appetite for drama.

Why a text message is doing so much work

SIM swapping is not a exotic attack. In simple terms, someone persuades a mobile operator to move your number onto a SIM they control. Sometimes that involves impersonation and a plausible story. Sometimes it involves a compromised account or a careless porting process. The result is the same: calls and texts meant for you start arriving somewhere else.

The uncomfortable bit is how many services still use that number as a trusted fallback. A password reset goes to your email, but the email account may use your phone for verification. The bank sends a one-time code by text. Payroll asks for a mobile number for multi-factor authentication. The recovery route for your authenticator app might be a text message. One number becomes a skeleton key without anyone deliberately designing it that way.

You do not need to eliminate SMS overnight. You do need to know where it is holding the door open.

The thirty-minute tabletop

Set a timer. Grab a whiteboard or a shared document. Keep it light.

0–5 minutes: Name the numbers

List every mobile number used for business purposes. Include the managing director's number, the finance lead's number, the office mobile, the number on the website and any personal numbers that have been volunteered for work recovery. For each one, write down what it can reset or verify. If nobody knows, write 'unknown' — that is a finding, not a failure.

5–10 minutes: Pick one victim

Choose one number, ideally the one with the widest reach. Ask: if this number stopped working right now, what would break first? Email? Banking? Payroll? The card machine? The answer is your practice scenario.

10–20 minutes: Run three injects

Read these out loud, one at a time, and talk through the response.

Inject one: 'The number has stopped receiving texts. Calls go straight to voicemail.'

Inject two: 'A password reset email has arrived for the finance mailbox, but nobody requested it.'

Inject three: 'The bank rings the office to query a payment that was not authorised.'

Do not aim for perfect answers. Aim for a clear order of operations. Who calls the operator? Who checks email sessions? Who tells the team? Who speaks to the bank? Write down the first three actions for each inject.

20–30 minutes: Fix one thing

Pick the smallest useful change you can make this week. It might be turning on an authenticator app for the finance mailbox, printing backup codes and putting them in the safe, or simply writing down which number owns which recovery route. One change is enough.

The first hour if it actually happens

If a number is taken over, calm beats clever. Use another phone — a colleague's, a desk phone, a VoIP line — and call the mobile operator's customer service line. Ask for the fraud or security team if you can get there.

Here is a plain call script you can adapt:

'Hello. My name is [name]. I am the account holder for [mobile number]. I believe my number has been ported or swapped without my consent. I need you to put a block on the SIM and freeze any porting authorisation code requests on this account. Can you confirm what you can do now and what reference number I should use?'

While that is happening, someone else should change the password on the main email account from a device that has not been compromised, then sign out all active sessions. Check the bank and payroll portals for unusual activity. Tell the team through a channel that does not depend on the stolen number — a group chat, a desk phone, a walk to the next desk. Report it to Action Fraud and follow your bank's fraud process.

Do not try to recover the number by arguing with a chatbot. Get a human, get a reference, get the block in place.

The register nobody wants to keep

A simple recovery-number register is one of the least glamorous security documents you will ever create. It is also one of the most useful. Keep it short:

• Number and owner
• What it can recover or verify
• Who else knows it is used for that
• Backup route — authenticator app, backup codes, desk phone
• Last checked date

Review it quarterly. The point is not to create a spreadsheet empire. The point is to stop discovering in the middle of an incident that the office mobile is the only route into the payroll portal.

Move the important resets away from SMS

Once the tabletop is done, start shifting the critical stuff. Use an authenticator app or, better, passkeys where the service supports them. For email administrators and finance systems, use app-based multi-factor authentication and keep printed backup codes somewhere sensible. If you must keep SMS as a fallback, make sure it is not the only fallback.

A mobile number is useful. It is not a strategy. Rehearse the first hour once, write down the call script, and put the register somewhere you will actually find it. That is a very small amount of work for a much calmer Tuesday.