Your SMS login code is already a shared secret with whoever sits on the carrier.

That’s a cybersecurity failure hiding in a protocol you never configured.

Enea’s report on SilentAir should close the debate. Operators hijacked mobile network nodes, then intercepted calls and SMS. Taiwanese subscribers were the primary targets. No endpoint popped. No brute-force storm hit your IdP. The text was copied inside a mobile core you don’t patch, log, or include in incident response.

You still mail that number a reset. Help desks still “verify” admins by calling the record in HR. Conditional access still treats a texted code as step-up. The handset is a mailbox with a radio. SilentAir walked into the mailroom.

Cybersecurity still trusts the wrong courier

Most cyber security programs measure the edge they own. Laptops. SaaS tokens. The corporate firewall. SilentAir lives under all of that, in the signaling fabric that delivers the code you treat as proof of presence. Threat detection that never sees abuse of mobile network nodes will keep scoring these logins as healthy MFA.

A stolen OTP is a completed session.

It doesn’t look like credential stuffing. Geo fences stay quiet if the replay is fast. Security hardening that stops at “MFA is on” is a checkbox with a radio behind it.

The same last-mile sloppiness is moving into money and dossiers.

OpenAI began rolling out ChatGPT Wallet so agents can pay with a stand-in card number. American Express, Mastercard, and Visa helped build it. The agent never sees your primary account number, and the merchant is supposed to see a proxy. Someone still approves, recovers, and disputes that charge. If that channel is SMS, a voice call, or an emailed magic link tied to a phone, you bolted a spending rail onto an intercept.

New York City’s council voted to ban surveillance pricing, barring firms from setting individualized prices from personal data. That data is already walking out the door. Apify, a web scraping firm, confirmed an intruder accessed customer accounts and obtained personal information or stored data. Scrapers, brokers, and shopping agents now concentrate the identifiers that make a reset text land on the right SIM.

You can’t buy threat-protection for a carrier that doesn’t work for you. You can stop handing it secrets.

Move MFA off the carrier

Work the identity plane you actually administer. Start with anyone who can change production, approve payments, or reset other people.

Do the painful accounts first. Shared mailboxes and break-glass users are where SMS still hides.

Turn off SMS and voice OTP on your IdP, VPN, cloud consoles, and privileged SaaS this week. Prefer passkeys, FIDO2 keys, or authenticator apps that never fall back to text.

Kill SMS as a recovery path. Help desk must refuse MFA resets over a phone call to the number on file. Use a pre-enrolled hardware key, a manager-attested in-person check, or a ticket that requires a second registered device.

Hunt for silent fallbacks. Many vendors re-enable “text me a code” when a passkey fails or a new browser appears. Inventory those toggles and lock them with policy, not hope.

Tabletop a 72-hour window where every SMS and voice call to VIP numbers is public. Write comms and break-glass steps that don’t use those numbers. Pair that with device trust and short-lived standing privilege so a stolen OTP still dies at the session.

Keep the work alive after the first sprint. Defense in depth on identity means the code can leak and the login still fails. Review quarterly which vendors reintroduced SMS to reduce friction. Your firewall never had a vote in this fight, and it won’t grow one.

Agents inherited the same intercept

ChatGPT Wallet will force merchants to decide whether agent-originated checkouts are even allowed. Some sites may block those purchases without meaning to. Treat accidental blocks as a reminder that agent spend is a new identity, not a convenience feature. If your company buys through agents, cap the wallet, allowlist merchants, and log every stand-in charge somewhere that isn’t a text thread.

Surveillance pricing turns the same personal fields into a bill. An Apify-style grab of customer records becomes a commercial leak the next quarter. Classify phone numbers, home addresses, and loyalty IDs as payment-adjacent secrets. Rotate what you can. Stop putting one-time codes on the one channel every breach dump already includes.

SMS is a broadcast that happens to buzz a pocket.

SilentAir showed the broadcast. Wallet agents and data brokers multiplied the reasons an intercepted profile is worth cash. Retire the courier, then go find every system that still thinks a phone number is a person.

Sources

• SilentAir Hackers Intercept Calls, SMS From Inside Mobile Networks
• ChatGPT Wallet lets agents pay without seeing your card number
• New York City votes to ban surveillance pricing
• Apify Confirms Customer Data Accessed in Cyberattack