SIM swapping is a type of account takeover in which criminals get a victim’s phone number transferred to a SIM card or eSIM they control, so they receive the victim’s calls, SMS messages and one-time codes.
How SIM swapping works
The attacker first gathers personal data about the victim – name, date of birth, address, sometimes the last digits of an ID – from data breaches, social media or phishing. Then they convince the mobile operator to move the number:
- by calling or visiting a store and impersonating the customer, claiming a lost or broken phone;
- by bribing or recruiting employees of the operator or its retail partners;
- by abusing number porting to another operator, known as port-out fraud.
Once the swap is complete, the victim’s phone loses service, and the attacker resets passwords for email, banking and crypto exchange accounts using SMS codes. Unlike the SS7 attack, which abuses telecom signalling, SIM swapping exploits people and processes.
Why SIM swapping matters
SIM swapping defeats SMS-based two-factor authentication, so a phone number can become the single key to someone’s digital life. Investor Michael Terpin sued AT&T after losing about $24 million in cryptocurrency in a 2018 SIM swap. In 2019 Twitter’s chief executive Jack Dorsey had his own account hijacked the same way, and in January 2024 the US Securities and Exchange Commission’s account on X was taken over after a SIM swap. In 2023 the US Federal Communications Commission adopted rules requiring carriers to authenticate customers before SIM changes and port-outs. SIM swapping is also a gateway to broader identity theft.
How to protect against SIM swapping
- Set a SIM PIN or port-out protection with your mobile operator, if offered.
- Replace SMS one-time passwords with authenticator apps or hardware security keys.
- Avoid using your phone number for account recovery and limit personal data you share publicly.
- React immediately if your phone suddenly loses service: contact the operator from another phone.
