How does SIM swapping work as a fraud technique and who does it target?

SIM swapping, also called SIM hijacking, exploits the account management systems of mobile network operators. Most carriers allow customers to transfer their number to a new SIM when they lose a phone or switch devices. This process requires some form of identity verification — but the verification standards vary enormously, and scammers have developed techniques to pass them.

Social engineering of mobile carrier staff is the most common approach. A scammer calls the carrier's customer service line, claims to be the account holder, and provides personal details to pass verification — details often gathered from data breaches, social media, or earlier phases of the fraud. If successful, the carrier transfers the number. Within minutes, the scammer receives all SMS messages sent to that number, including two-factor authentication codes for banking apps, email accounts, and social media.

Targeting is deliberate. SIM swap fraud requires effort and carries more legal risk than phishing, so it is typically deployed against high-value targets: people with significant cryptocurrency holdings, active stock trading accounts, or accounts with payment credentials attached. An attacker who knows a specific individual holds valuable digital assets will invest in the verification hurdles.

The downstream impact is rapid. With access to SMS-based authentication, the attacker resets passwords on financial accounts, drains crypto wallets, and may access email to identify further high-value targets. All of this can happen within an hour of a successful swap, long before the real account holder notices their phone has lost service.