SIM swap account drain

A high-value customer reports their account was drained overnight. Logs show: a successful password reset via the 'SMS recovery' flow, then a withdrawal to a new external address, all from a new device. The customer never got the SMS codes. Your fraud dashboard shows a small but rising cluster of identical sequences over the past day, all targeting accounts with phone-based recovery enabled, all completing the SMS OTP step successfully despite the victims reporting no codes received. The phone-number-on-file was unchanged in your system. How do you triage, contain, and remediate this SIM-swap-driven account-takeover pattern?