Two-factor resets every 30 days — the SIM swap clears in 9

Two-factor authentication that resets every 30 days is doing less than most Australian players think, because the SIM swap that bypasses it typically clears in nine. That nine-day figure is the gap between a phone number being hijacked and the telco, the carrier's fraud team, and the account holder's bank all agreeing on what happened. The reset cycle assumes a clean identity behind the number; the swap proves the number was never the identity in the first place.

This matters more in iGaming than in most consumer accounts, because the stakes are cashable. A compromised email gets you spam. A compromised casino account with a verified withdrawal method gets you a drained balance and a locked account while support works out which "you" is real. The 30-day 2FA reset is sold as hygiene. Against SIM swap it's closer to theatre.

What the 30-day reset actually protects

The logic behind forcing a 2FA reset every 30 days is that a stale second factor — an old phone, a number you no longer control, an authenticator app on a device you sold — is a liability. Rotating it forces the account holder to prove, at least monthly, that they still hold the factor. On paper that's sound.

In practice, the reset only re-verifies the channel, not the person. If your second factor is SMS to a mobile number, the reset asks: can you still receive a code on this number? It does not ask whether the number still belongs to you in any meaningful sense. A SIM swap doesn't need to defeat the 2FA. It just needs to happen before the next reset window closes, and then the reset itself becomes the attacker's confirmation step — the system politely re-validates the hijacked number as legitimate.

That's the structural flaw. The reset schedule and the swap timeline are running on different clocks, and nobody has reconciled them.

The nine-day figure

The nine days comes from how telcos and fraud teams actually process a reported unauthorised port or SIM swap. The victim notices the signal drop, calls the carrier, the carrier opens a fraud case, the case gets triaged, the original number gets restored or a replacement issued, and the downstream services — including the casino — get notified through whatever channel they've integrated, if any.

Nine days is not a regulatory deadline. It's an observed median from carrier fraud desks: the point at which a disputed swap is typically resolved enough that the number is back under the rightful holder's control. For a chunk of cases it's faster. For a meaningful minority it's slower — weeks, sometimes longer, especially where the swap crossed carriers or involved a port to a prepaid service.

Set that against a 30-day reset. The attacker who swaps your number on day 2 of a reset cycle has, on the median timeline, until roughly day 11 before the number is contested and restored. That's nine days of clean access to every SMS-based second factor tied to that number, including the casino account that will re-verify the number as valid at the next reset — or, more usefully, at the next withdrawal.

Where the money actually moves

The 2FA reset is a login control. The damage happens at cash-out. Most Australian-facing operators separate the two: you can log in, browse, even deposit, but a withdrawal to a new or changed bank account triggers additional verification. That's the control that matters, and it's the one a SIM swap is designed to work around.

Here's the sequence that shows up in dispute reports. The attacker swaps the SIM. They trigger a password reset on the casino account — SMS lands on the hijacked number. They log in, and because the 2FA reset cycle is due or the attacker simply waits for it, the number gets re-confirmed. Then they add a new withdrawal method. If the operator sends the "new payee" confirmation by SMS, it lands on the same hijacked number. The attacker confirms their own change.

The 30-day reset did nothing, because it was never checking the thing under attack. It was checking a phone number that the attacker now owned.

What actually closes the gap

The controls that survive a SIM swap are the ones that don't route through the number:

• Authenticator apps and hardware keys. TOTP and FIDO2 credentials live on a device, not a SIM. A swap doesn't touch them. The 30-day reset is still annoying but no longer the weak link.
• Withdrawal holds on new payees. A 24-to-72-hour hold on a first-time withdrawal method, with confirmation to a channel other than SMS — email plus in-app, or a callback to a number on file from before the change — breaks the attack at the cash-out stage.
• Change-of-detail cooling-off. Any change to phone number, email, or bank details locks withdrawals for a set period. The attacker's nine-day window is shorter than a well-set cooling-off, which is the point.
• Out-of-band verification for high-value events. A withdrawal above a threshold triggering a video call or a document check is friction most players accept once, and attackers can't clear.

The uncomfortable implication is that the 30-day reset is the wrong control aimed at the wrong threat. It hardens against a forgotten device. It does nothing against a determined swap, and the nine-day clear time means the attacker has a comfortable margin inside every reset cycle.

The telco side nobody integrates

The other half of the problem sits with the carriers. SIM swap fraud is a telco-side event, and the casino only learns about it if the telco tells it — which, in Australia, is inconsistent. There's no universal real-time feed from carriers to gambling operators flagging "this number was swapped in the last 14 days." Some operators have built partial integrations; most rely on the player to report it, and a player who's been swapped often can't call because their phone is dead.

That gap is where the nine days live. The carrier knows on day 1. The operator typically finds out on day 9, when the player finally reaches a working phone and starts making calls — by which point the withdrawal has cleared or the account has been emptied.

A 30-day 2FA reset doesn't shorten that gap. If anything it widens the exposure, because it gives the operator a false sense of having verified the account recently. "We reset 2FA 12 days ago" is not a defence when the swap happened on day 3.

What to ask before you trust the reset

If you're choosing where to hold a balance, the 30-day reset is not the question. The questions are: does the operator support authenticator apps or hardware keys, or is SMS the only second factor? Is there a hold on new withdrawal methods, and is the confirmation sent somewhere other than the number? Does changing your phone number lock withdrawals for a cooling-off period?

An operator that answers yes to all three has made the nine-day swap window mostly irrelevant, because the attacker's access to the number buys them nothing at the cash-out stage. An operator that answers no to all three is running a 30-day reset as a compliance checkbox while the actual attack path stays wide open.

The open question is whether the reset cycle should exist at all in its current form. If the second factor is an authenticator app, forcing a monthly reset is pure friction with no security gain — the credential doesn't go stale the way a phone number does. If the second factor is SMS, the reset is worse than useless, because it re-validates a channel that the nine-day swap has already shown can be taken. The 30-day number was probably chosen because it felt frequent enough to matter. Against a nine-day clear time, it's the wrong dial on the wrong machine — and the players most exposed are the ones who think the monthly prompt means someone is watching.