A type of account takeover fraud that targets a weakness in short message service (SMS)-based two-factor authentication (2FA) and two-step verification by tricking a target’s mobile carrier into transferring someone’s wireless service to a device controlled by an illicit actor.