SIM Swap Attack Incident Response Checklist for Regional EMS Medical Direction Offices

A SIM swap can instantly divert calls and text-based codes to an attacker, enabling SMS-Based Authentication Bypass and rapid account takeover. This checklist is tailored for Regional EMS Medical Direction Offices so you can act decisively, protect clinical operations, and maintain Security Compliance Documentation within your Incident Response Plan EMS.

Immediate Response to SIM Swap

Identify and contain (first 0–15 minutes)

• Confirm loss of cellular service or unexpected device behavior on the affected number using an alternate line, radio, or secure VoIP.
• Escalate via your Incident Response Plan EMS: notify IT/security lead, Medical Director, privacy/compliance officer, and communications coordinator.
• Move critical communications to preapproved alternatives (radio, landline, encrypted messaging, or VoIP) and inform dispatch/partner agencies of the temporary channel.
• Power down the affected handset and quarantine it through MDM if enrolled; preserve it for forensics.
• Initiate emergency password resets for high‑risk accounts tied to the number (email, identity provider, EHR, state registry) from a known‑good device.

Stabilize access (15–60 minutes)

• Remove the phone number from account recovery paths; switch 2FA to authenticator apps or hardware keys for admins and medical leadership.
• Revoke active sessions, OAuth tokens, and app passwords for cloud services; force reauthentication for privileged roles.
• Enable temporary message holds or forwarding on official channels to prevent missed clinical notifications.
• Begin Account Compromise Mitigation playbooks for email, collaboration, and EHR systems.

SIM Swap Attack Detection signals to broadcast to staff

• Sudden “No Service” while others on the same carrier are unaffected.
• Unfamiliar 2FA prompts, password reset notices, or login alerts.
• Contacts reporting odd texts or calls from your number.

Carrier Notification Procedures

Call the carrier’s fraud/enterprise support from a safe line. State you are responding to an Unauthorized SIM Transfer affecting an EMS medical direction number and request priority handling due to operational impact.

• Request immediate reversal of the SIM change/port and a port‑out freeze (no‑port/NOPORT) on all EMS numbers and administrator lines.
• Set or strengthen account PINs, port‑out passcodes, and verbal passwords; require in‑person verification for future changes where available.
• Ask the carrier to block SIM swaps and number changes for a defined window and to add fraud notes visible to all support tiers.
• Record the case number, timestamps, actions taken, and support agent identifiers for Security Compliance Documentation.
• If the number cannot be restored promptly, activate your contingency number plan (preissued eSIM/SIM or secondary DID) and update call trees.

Securing EMS and Personal Accounts

Prioritize business‑critical systems

• Email/identity provider: reset credentials, rotate recovery codes, and enforce phishing‑resistant MFA on privileged accounts.
• EHR/clinical apps: invalidate sessions, check audit logs for after‑hours or unusual IPs, and require step‑up authentication at next login.
• Scheduling, CAD/dispatch interfaces, state registries, file storage, and messaging: rotate secrets, review admin changes, and verify notification routes no longer rely on SMS.

Harden device and cloud access

• Use MDM to lock or wipe the affected device if compromise extends beyond the SIM; require device compliance before granting access.
• Apply conditional access to block logins from geographies or ASN ranges not used by your agency.
• Reissue “break‑glass” accounts with hardware‑key MFA and offline recovery codes stored in sealed envelopes or a secure vault.

Address staff personal accounts used for recovery

Instruct impacted staff to secure any personal email or cloud accounts listed as recovery for agency systems. Replace SMS with stronger factors, remove the compromised number, and enable alerts for password and recovery changes.

Upgrading Two-Factor Authentication Methods

Replace SMS wherever possible with Multi-Factor Authentication Alternatives that resist SIM-based attacks and phishing. Make this a permanent control, not just a post‑incident fix.

• Primary: FIDO2/WebAuthn hardware keys or platform passkeys for admins, medical directors, and dispatch supervisors.
• Secondary: TOTP authenticator apps with number‑matching or push approval bound to managed devices.
• Recovery: single‑use codes stored offline; require two approvers to access them.
• Policy: disallow SMS for privileged roles and remove it as a fallback once alternatives are active.
• Monitoring: alert on factor changes, new device enrollments, and recovery method edits.

Document the change as a control against SMS-Based Authentication Bypass and update vendor configurations, user guides, and onboarding checklists accordingly.

Financial Institution Communication

If the number touches agency banking, grants management, or procurement platforms, treat financial controls as potentially exposed until proven otherwise.

• Contact each institution’s fraud team to add high‑risk flags, callback passwords, and out‑of‑band verification requirements.
• Temporarily raise transaction alerts and lower thresholds for wires, ACH, and card‑not‑present activity.
• Review payee changes, card tokenizations, and pending transfers; require dual approval for any changes for at least 30 days.
• Consider credit bureau fraud alerts and freezes for affected individuals if personal data may be misused.

Incident Documentation Practices

Strong Security Compliance Documentation protects your agency and speeds future response. Capture a precise timeline, people involved, systems affected, and corrective actions taken.

• Preserve artifacts: carrier case records, audit logs, MDM telemetry, email security alerts, screenshots, and user statements.
• Record all credential resets, factor changes, and policy updates with timestamps and approvers.
• Conduct a risk assessment to determine whether regulated data or operations were materially impacted; coordinate with privacy/compliance.
• Perform an after‑action review highlighting SIM Swap Attack Detection gaps, social‑engineering vectors, and process weaknesses.
• Update the Incident Response Plan EMS with lessons learned, revised contact trees, and carrier controls.

Staff Training and Awareness Programs

Make prevention routine. Train staff to recognize social‑engineering tactics that precede a SIM swap and to escalate quickly when something feels off.

• Quarterly micro‑lessons: indicators of Unauthorized SIM Transfer, safe factor management, and how to report anomalies.
• Role‑based drills: simulate number loss for the Medical Director or on‑call physician and run the full checklist end‑to‑end.
• Job aids: wallet cards or posters with emergency contacts, alternate comms, and first five actions.
• Metrics: track time‑to‑detect, time‑to‑carrier‑freeze, and time‑to‑MFA‑upgrade; brief leadership quarterly.

Conclusion

By acting fast, locking down the carrier, upgrading MFA, and documenting every step, you contain damage and reduce future risk. Bake these controls into daily operations so Account Compromise Mitigation becomes standard practice—not an exception after an incident.

FAQs.

What immediate steps should EMS offices take after a SIM swap attack?

Confirm loss of service, activate your Incident Response Plan EMS, move to approved alternate communications, quarantine the device, and start emergency password resets on critical systems. Contact the carrier’s fraud team from a safe line and request a reversal plus a port‑out freeze.

How can EMS offices secure their accounts post-SIM swap?

Remove the phone number from recovery paths, revoke all sessions, rotate passwords and recovery codes, and switch to hardware keys or authenticator apps. Audit admin activity in email, identity, EHR, and registries, then enforce conditional access and device compliance before restoring full access.

Why is disabling SMS-based 2FA important after a SIM swap?

SMS can be intercepted after a SIM swap, enabling SMS-Based Authentication Bypass even if passwords are strong. Replacing SMS with phishing‑resistant factors like FIDO2 hardware keys or passkeys closes the core weakness the attacker exploited.

How should staff be trained to recognize SIM swap attacks?

Teach signals such as sudden loss of service, unexpected 2FA prompts, and carrier change notices. Run role‑based drills, provide simple reporting paths, require verbal callbacks for sensitive requests, and reinforce policies that prohibit SMS as a fallback for privileged accounts.