Unit 1, Day 4: Account Takeover and SIM Swap
Lesson 4 of 6 in Unit 1, Spot It, Lock It, Recover
- School-year day
- Day 4 of 180
- Time
- 20-minute core + 30-minute extension (50 minutes in all)
Teacher Talk with MystrS. Checked October 27, 2026 (Pacific time). Tags: Cyber.
Existing lessons: /teach-it-this-week/let-your-bank-tap-you/, /cyber/identity-theft-recovery/, /teach-it-this-week/identity-theft-recovery/, /cyber/data-breach-what-to-do/, /cyber/deepfake-code-word/, /cyber/safe-signal/
Goal: Students will be able to:
- Describe account takeover that starts with a stolen login.
- Describe SIM swap or port-out risk for SMS codes.
- Name one way to protect a phone number and one recovery move, using made-up scenarios only.
Materials:
- Projector
- Timeline cards: stolen password vs phone number moved
- Handout: protect / detect / recover
- Exit tickets
Core (20 min)
- Warm-up. Prompt: "Your phone suddenly has no service. Texts for login codes stop arriving. What is one thing you would check first?" Pair share. No real carrier accounts. (3 min)
- Teach (calm, no scare copy). Account takeover: someone else signs in as you; often starts with a reused password, a phished code, or malware; fix path starts with changing the password from a device you trust and turning on stronger MFA. SIM swap / port-out risk: if your mobile number is moved without your OK, SMS codes can go to the attacker; SMS-only MFA is weaker than app or hardware options when a number is hijacked. Protect the number: ask your carrier about a port-out or SIM change PIN. Prefer authenticator apps or passkeys for important accounts when available. Tie to let-your-bank-tap-you for money-request texts. (7 min)
- Activity, Two paths. Case A (password): shopping site breached after password reuse; email signed into. Case B (number): phone loses service; friends get money-request texts from that number. Pairs fill Protect / Detect / Recover (one bullet each). (7 min)
- Exit ticket. Name one way to protect a phone number, and one reason SMS codes can be risky if the number is taken over. (3 min)
Extension (up to 30 min)
- Carrier PIN practice script (made-up account): who they are, request a port-out PIN, say they did not request a SIM change. Practice with a partner. No real calls. (10 min)
- Family signal bridge: preview /cyber/deepfake-code-word/ and /cyber/safe-signal/. Students draft one practice phrase (not their real family code). (10 min)
- Optional money-pressure strips from prior CyberSandberg lessons if timing fits. Keep made-up labels. (10 min)
Check for understanding: Student separates password takeover from number takeover in one sentence each, and names a port-out PIN or similar carrier control plus moving MFA off SMS when possible.
Differentiation and EL / IEP supports:
- EL: timeline with icons (password leaked to inbox taken; number moved to SMS codes diverted).
- IEP / 504: sentence starters on the handout; drawing the two paths OK.
- Advanced: explain why authenticator apps do not rely on the phone number the same way SMS does (awareness).
- Privacy: students do not disclose real carrier names or account numbers.
Standards (from our standards map):
- CSTA 2026: HS-SYS-SE-31; HS-SYS-SE-32; S1-CYB-PP-14
- NICE: PD-WRL-003; OG-WRL-008; PD-WRL-006 (awareness)
- NSPFE: Managing Risk; Fraud awareness when money texts follow a takeover
Certification alignment (ISC2 CC): Domain 3 Identity and Access Management; Domain 2.3 security awareness; Domain 5.2 threat actors and motivations (awareness). Outline: English, Revised 01-2026, effective September 1, 2026. https://www.isc2.org/certifications/cc/cc-certification-exam-outline
Sources
- CyberSandberg /teach-it-this-week/let-your-bank-tap-you/ (SIM swap / money-text framing already source-checked), checked October 27, 2026.
- eCFR: 47 CFR 64.2010(h), SIM swap and port-out protections adopted in FCC 23-95, teacher background; no compliance date is shown, so the lesson gives none, checked October 27, 2026.
- CISA MFA, prefer non-SMS factors when available, checked October 27, 2026.
- FTC IdentityTheft.gov, checked October 27, 2026.
- ISC2 CC Exam Outline, Revised 01-2026, checked October 27, 2026.