Background
Fiona Brunton runs a small bids and tender writing agency, producing time-critical tenders for recruitment agencies. It’s a lean operation — just her and four subcontractors. Like a lot of small businesses, she’d have told you she wasn’t the kind of target cybercriminals bother with.
On Monday 19th June — a day she describes as “burned into my memory” — it started with a flood of spam: two to three thousand emails in an afternoon, far more than the handful she’d normally get from having her email address on her website. She contacted Francis at Security Everywhere, who already looked after her cyber security, and booked an appointment for the next day to review her email and spam settings.
Then came a text from her mobile provider, EE: a request had been made to move her number onto a new SIM, and could she confirm it wasn’t her. She rang back immediately and said it was fraudulent and must not go ahead. EE told her the account was flagged and the number would not be ported.
The Risk
Unsettled, Fiona spent that evening changing the passwords on every business and personal account she could think of — banking, credit cards, everything. The next morning, after no sleep, she called EE again to ask for extra security beyond a text-message one-time code. She was told nothing more could be done, since she’d already changed her password.
Later that day, a second wave of spam arrived — and in among it, three consecutive emails from her credit card provider requesting balance transfers totalling £13,500, on a card with only a £10,000 limit. The fraudster had contacted the provider directly and had the limit raised first.
Fiona tried her banking apps and couldn’t get into either her business or personal accounts. To check what was happening, she rang her own mobile from her landline: it rang, but her handset stayed silent. A text from her husband never arrived either. Her number had been ported — the fraudster was now receiving her calls and texts on their own handset.
A data subject access request to EE later revealed what had happened. The fraudster had made several failed attempts to access her account that day before succeeding, and a note on the account explicitly said the port must not go ahead and that it was fraudulent. A different EE agent processed the port anyway once the original 24-hour hold had expired, without reading those notes. As Fiona put it: “I think actually what happened is the fraudster contacted them again after the 24 hours had elapsed and said the number’s not been ported, and they went ‘oh whoops, sorry, there you go’ — without reading the preceding notes.”
This is the exact weak point behind SMS-based two-factor authentication. Once someone else controls your phone number, they can trigger a “forgot password” reset on your bank account, receive the one-time SMS code meant for you, and log straight in. As Fiona put it: “When someone else has got access to your phone, it’s game over on everything.”
What We Did
Fiona called EE to get the number blocked, but hit a catch-22: EE’s own security process required a one-time code sent by text — straight to the fraudster’s phone. She only got through because her husband’s number was also registered on the business account, so the verification code could go to him instead. EE then blocked the number, cutting it off for both the fraudster and Fiona.
She immediately called her bank, Lloyds. Their fraud team suspended digital banking while the fraudster was still actively in her account — something Lloyds told her was highly unusual, since most victims only discover a breach after the fact. In that window, the fraudster had downloaded a bank statement from her personal account and used the 16-digit card number referenced in a payment to attempt the same balance-transfer attack directly against the credit card provider. That attempt succeeded, before the phone was blocked and the accounts locked down — roughly an hour after it began.
What followed was a three-week fight with EE. It took around four days just to get her number ported back, and repeated promises of a manager callback went nowhere. At one point, an EE technical adviser read her own password back to her over the phone instead of asking proper security questions. Fiona eventually emailed EE’s chief executive’s office directly — finding the address online herself — and finally got a serious response: EE released her from her remaining contract and offered £150 in compensation. She also reported it to the police via 111; the call handler had never heard of SIM-swap fraud but still sent an officer to her office the same day.
With Security Everywhere’s help, Fiona made three changes:
- Moved to a new mobile provider that verifies with a PIN set at account opening, rather than relying on SMS alone.
- Added a SIM lock — a PIN required whenever the SIM restarts in any handset — to her new phone.
- Adopted password manager software, so every account has its own long, random password instead of variations on the same few.
The Result
No money was taken from Fiona’s bank account — Lloyds froze it in time. The £13,500 balance transfer on the credit card did go through, but that loss fell to the card provider rather than to Fiona personally.
She has since moved bank and mobile provider, locked down her accounts, and — in her own words — is “not looking over my shoulder neurotically anymore,” even though she knows another attempt could come at any time.
Client Quote
“It wasn’t because I was a stupid person, it wasn’t because I was lazy — it was just a thing that happened out of my control. Please, please just don’t let it be you next time.”
— Fiona Brunton
Why This Matters for Regulated B2B Sectors
SIM-swap attacks exist specifically to intercept SMS one-time codes. Once a fraudster controls your number, any account protected only by a text-message code can be reset and taken over — exactly as happened here.
Regulated sectors that still lean on SMS-based verification for banking, email, or client systems carry this exact exposure. Client funds, case files and confidential data sit behind the same weak link.
Small and micro businesses are not below the radar. Fiona ran a business of one plus four subcontractors and, in her own words, was “the absolute perfect target” — a public email address and a named mobile number were enough to start.
And provider-side security isn’t guaranteed. This case shows a telecoms operator’s own agent overriding a documented fraud flag. Businesses need their own layers — authenticator apps, SIM locks, unique passwords — rather than relying solely on a supplier’s process.
If your team — especially anyone handling client funds, tenders, or confidential case files — is still relying on SMS codes as your only second factor, it’s worth a closer look. We’d be glad to talk through where the gaps might be, no pressure, no obligation. Book a free Security Check.
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
