You're not sending the message to the phone, you're sending it to the sim, in the clear. Si I pop this some in my flip phone and receive the code.

Hmm, but you do need to know the PIN code for the SIM card in order to register on the GSM network and receive the SMS? Or am I missing something?

I've changed my PIN to something quite long, so hopefully an attacker cannot just pop the SIM card out of my iPhone and use it on another device.

SIM PIN codes seem to have gone out of fashion. Neither my UK SIM nor my US SIM, both bought within the last two years, had a PIN code out of the box. Of course it's possible to set one but that's buried somewhere deep in the phone's settings, so most people probably don't set one.

I didn't even know it's possible to have no PIN code on a SIM card!

Operators in Finland always give you PIN cards with a preset code like 0000 or 1234, and tell you to switch it in their quick start instructions. I'm sure many people leave it as it is, though. Almost no-one seems to know you can actually set it to be more than 4 digits.

This looks like an area that phone operating systems could fix – by making it easy to change your PIN, and encourage using more than 4 digits for it.

Is there anything to stop one from brute-forcing the PIN? It's just numbers, what's the upper limit for length.

Ah, http://www.techrepublic.com/article/pro-tip-protect-your-and... suggests that you have 3 attempts, then there's a separate system (PIN Unlock Key, PUK) which a comment notes gives 10 attempts.

I'm wondering if you can read the data straight off the card via some physical means, attack that to get the PIN?

I'm guessing in most cases it's much easier to socially engineer the service provider customer support, rather than attack the SIM hardware.

You're probably right depending on the scale you're trying to crack the cards at - went digging and found http://www.theregister.co.uk/2015/08/06/researchers_crack_si... which was pertinent and interesting to me.

To really make things a hassle for thieves, you could lock your SIM card through Settings, no?

Don't they (Apple at least) give you an option to send the code to your phone number, or to your iCloud/iMessage ID?

How can you log in to your account from anywhere after your phone is stolen?