Your phone number is one of the most powerful keys to your digital life. It receives your bank’s verification codes, resets your email password, and confirms your identity across dozens of services. Now imagine waking up to find that your number no longer belongs to you — and someone else is receiving all of those codes.
That is SIM swapping, and it has drained millions from victims’ bank accounts and crypto wallets. Here is how the attack works and how to make sure it never happens to you.
What Is SIM Swapping?
SIM swapping (also called SIM hijacking) is a form of identity theft where an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. They do not need your phone. They do not need to be near you. They just need to persuade — or bribe — one customer service representative.
Once your number is ported to the attacker’s SIM, every call and text meant for you goes to them instead. Your phone goes dead, and theirs comes alive as you.
The attacker’s goal is almost never the phone number itself. It is everything the number unlocks: password-reset codes, SMS two-factor authentication, and bank verification calls. Within minutes of the swap, they can reset your email password, then use the email to reset everything else — a domino chain that ends with empty accounts.
How a SIM Swap Attack Works, Step by Step
Step 1: Information gathering. The attacker collects your personal details — full name, date of birth, address, phone number — from data breaches, social media, phishing, or data-broker sites. Carrier security questions are often things like these, which is exactly why the details are so easy to find.
Step 2: Impersonation. Posing as you, the attacker contacts your carrier’s support line or visits a store. They claim they lost their phone and need the number activated on a new SIM. Some attackers use forged IDs; others simply bribe corrupt carrier employees — a disturbingly common shortcut.
Step 3: The swap. The carrier deactivates your SIM and activates the attacker’s. Your phone loses service. You might assume it is a network outage.
Step 4: Account takeover. The attacker requests password resets on your email, bank, and crypto accounts. The verification codes arrive on *their* phone. They log in, change passwords and recovery options, and lock you out.
Step 5: The theft. Money is transferred out, crypto wallets are drained, and sometimes the attacker even sells access to your accounts. The whole process can take under an hour.
High-profile victims have lost millions in cryptocurrency in single attacks, but ordinary people with bank accounts and email are targets too — the attack is cheap to attempt and devastating when it works.
Warning Signs of a SIM Swap
- Your phone suddenly loses service — “No Service” or “Emergency Calls Only” with no explanation, especially when others around you have signal.
- Unexpected texts from your carrier about a SIM change, port-out request, or account modification you did not make.
- You cannot log in to accounts you could access yesterday — passwords mysteriously changed.
- Alerts about password resets or new logins you did not initiate.
- Your bank or carrier contacts you about suspicious activity.
If your phone loses service unexpectedly, do not wait to see if it comes back. Contact your carrier immediately from another phone — every minute of delay is a minute the attacker spends inside your accounts.
Why SMS Two-Factor Authentication Is the Weak Link
SIM swapping works because so many services treat a text message as proof of identity. SMS was never designed for security: messages travel unencrypted across carrier networks, and the entire system trusts whoever currently holds the number.
This does not mean two-factor authentication is useless — it still blocks the vast majority of attacks, like credential stuffing and phishing. But SMS-based 2FA has a known bypass, and SIM swapping is it. Upgrading your second factor is the single most effective defense.
How to Protect Yourself from SIM Swapping
Set a PIN or passcode on your carrier account. Most carriers let you add a PIN required for any changes, including SIM swaps. This is the highest-value five minutes you can spend today. Call your carrier or check their app for “account PIN,” “port-out PIN,” or “transfer PIN.”
Ask about a port freeze or number lock. Several carriers offer a feature that blocks number porting entirely until you explicitly lift it.
Stop using SMS for two-factor authentication. Switch to an authenticator app (like Google Authenticator or Authy) or, better yet, a hardware security key. Authenticator codes live on your device, not your phone number — a SIM swap cannot touch them.
Use a separate email for sensitive accounts. Keep your banking and primary email on an address you never publish, and protect it with app-based 2FA.
Limit what you share publicly. Your full birthday, address, mother’s maiden name, and phone number are the raw materials of impersonation. Data-broker sites sell dossiers on most adults — consider using a removal service.
Be skeptical of “urgent” carrier calls or texts. Attackers sometimes pose as the carrier to extract your PIN. Always call the carrier back on their official number.
What to Do If You Have Been SIM Swapped
- Contact your carrier immediately from another phone and reclaim your number. Ask them to note the fraud and add maximum security to the account.
- Secure your email first — it is the master key. Change the password and check recovery options from a clean device.
- Change passwords on banking, crypto, and other sensitive accounts.
- Call your bank and report the fraud; ask about reversing unauthorized transfers.
- File a police report — you will need it for disputes with banks and carriers.
- Place a fraud alert with credit bureaus, since the attacker has your personal details.
- Review every account for changed settings, new devices, or forwarding rules the attacker may have left behind.
SIM swapping succeeds because phone companies were built for customer convenience, not identity security. Until that changes, the defense is in your hands: lock down your carrier account, move off SMS verification, and treat an unexplained loss of signal as the emergency it might be.
About the Author
