SIM Swap Scams

A SIM swap — also called SIM hijacking or port-out fraud — is an attack in which a criminal convinces your mobile network operator to transfer your phone number to a new SIM card that they control. Once they hold your number, they can receive all SMS messages and calls sent to it — including one-time passcodes and authentication codes used by banks, email providers, and cryptocurrency platforms. Your accounts are then only as secure as your phone number, which the attacker now controls.

SIM swaps are not a hack of your phone or network in the technical sense. They are a social engineering attack on the mobile carrier's customer service process. The attacker uses personal information about you — sourced from data breaches, social media, or phishing — to impersonate you convincingly enough that the carrier transfers your number.

The attack can happen very quickly. From the moment the swap succeeds, the attacker begins requesting password resets to your email and financial accounts, which are confirmed by the SMS codes they now receive. Victims often become aware only when their phone loses service — the first sign the swap has occurred.

The attacker first collects personal information about you: your full name, home address, date of birth, the last four digits of your national insurance or Social Security number, your account number with the carrier, or answers to common security questions. This information may come from data breaches, your social media profile, or a targeted phishing attack.

Armed with this information, they contact your mobile carrier's customer service — by phone, chat, or in a retail store — and request a SIM card transfer, claiming they have a new phone and need their number moved. The carrier's identity verification process is passed using the personal details the attacker collected.

Once the number is on their SIM, your phone loses signal. You can no longer make or receive calls or messages. Meanwhile, the attacker receives all SMS codes sent to your number and begins requesting password resets for your most valuable accounts — email, banking, cryptocurrency exchanges, social media.

The time between a successful swap and complete account compromise can be minutes. Victims who notice the signal loss and investigate may already have had accounts drained by the time they reach their carrier.

SIM swaps succeed because mobile carriers cannot perfectly verify identity over the phone or in chat. Customer service agents are trained to be helpful and to resolve account issues efficiently — which creates a window for social engineering. An attacker with enough personal information can pass identity checks that are sufficient for legitimate users but inadequate against a determined adversary who has done their research.

SMS-based authentication was added to many platforms as a second factor, but it is only as strong as the carrier's identity verification. Once the attacker holds the phone number, every platform that treats SMS codes as proof of identity is compromised simultaneously.

The attack is fast. The window between a successful swap and account compromise may be too short for a victim to intervene, even if they notice the signal loss immediately.

Your mobile number has been transferred to a new SIM. If you did not make this request, contact our support team immediately.

A password reset has been requested for your [account]. If you did not request this, contact support immediately.

Your account was accessed from a new device. If this was not you, click here to secure your account.

If you suspect a SIM swap, the most important step is to contact your carrier as quickly as possible using a different device. Do not wait — the attack proceeds quickly.

To reduce your vulnerability in advance: contact your mobile carrier and ask whether they offer a SIM lock, port-freeze, or additional account PIN that prevents number transfers without an extra verification step. Many carriers offer these features but do not advertise them prominently.

Replace SMS-based two-factor authentication with an authenticator app or hardware key for all financial and high-value accounts. Authenticator apps generate codes on the device itself and are not linked to your phone number — a SIM swap does not affect them.

Search data breach notification services (such as HaveIBeenPwned) to understand whether your email address and associated data have appeared in known breaches.