Yep, and this is because sim-jacking is actually less profitable than just finding records of people’s _past_ phone numbers and signing up for a voip service that supports sms for that number. And many of the voip providers just don’t do any kind of fraud prevention.

Source: I work at a place that is a natural target for this kind of thing.