SIM Swapping

SIM swapping is a type of fraud in which a criminal gets a victim's mobile phone number transferred to a SIM card or eSIM that the criminal controls. Once the number moves, calls and text messages meant for the victim arrive on the criminal's phone, including the one-time codes that banks, email providers and crypto exchanges send to confirm logins and password resets. The attack is a leading route to account takeover (ATO) and has been used to steal large sums in cryptocurrency.

The related scheme of port-out fraud moves the number to a different carrier rather than to a new SIM at the same one. Both exploit the fact that a phone number was never designed as a secure identity credential, yet many services treat possession of it as proof of who someone is. Regulators, including the US Federal Communications Commission (FCC), have responded with rules for carriers.

Suppose your bank sends a confirmation letter to your home whenever someone tries to change your password. Now imagine a fraudster phones the post office, pretends to be you, and has all your mail redirected to their address. The bank keeps sending letters, but they now land on the fraudster's doormat.

A SIM swap is that mail redirection for your phone. The criminal convinces the phone company that they are you, or pays an employee to help, and your number moves to their SIM card. Your phone suddenly loses signal, and every security code sent by text goes to them. With those codes and some personal details, they can reset passwords and empty accounts within hours.

A typical attack has three stages:

1. Reconnaissance. The attacker collects the victim's name, phone number, address, date of birth and account details from a data breach, phishing, social media or data brokers. Crypto holders are often found through public posts or wallet addresses.
2. The swap. The attacker contacts the carrier by phone, online or in a shop, impersonates the victim and asks for the number to be moved to a new SIM, often answering knowledge-based authentication (KBA) questions with stolen data. Some groups instead bribe or recruit carrier employees, a form of social engineering aimed at insiders.
3. Account takeover. With the number active on their device, the attacker requests password resets and receives each one-time password (OTP) by text. They then change recovery details, withdraw funds or send crypto out of exchange accounts and hot wallets, where transfers cannot be reversed.

Because crypto transfers are final and can be moved quickly through mixers or other platforms, crypto investors and exchange users have been frequent targets. A self-custodied crypto wallet secured by a seed phrase is not directly exposed by a SIM swap, but any exchange or email account protected by text codes is.

• FBI figures. In a February 2022 public service announcement, the FBI's Internet Crime Complaint Center reported receiving 1,611 SIM swapping complaints in 2021 with adjusted losses of more than $68 million, up from 320 complaints and about $12 million across 2018 to 2020.
• Jack Dorsey, 2019. In August 2019 attackers took over the Twitter account of the company's own chief executive after his phone number was compromised, then posted through a feature that allowed tweeting by text message. Twitter later suspended that feature.
• Michael Terpin. The crypto investor said he lost about $24 million in cryptocurrency after a SIM swap in 2018 and sued his carrier, AT&T, in a case that drew attention to carriers' role.
• US SEC, January 2024. On 9 January 2024, the X account of the Securities and Exchange Commission (SEC) posted a false announcement that bitcoin exchange-traded funds had been approved, briefly moving the price of Bitcoin (BTC). The SEC later said an unauthorised party had taken control of the phone number linked to the account through a SIM swap, and that multi-factor authentication had been switched off on the account months earlier. An Alabama man pleaded guilty in 2025 to his part in the attack.

On 15 November 2023 the FCC adopted a Report and Order to protect consumers from SIM swap and port-out fraud, amending its customer proprietary network information and number-porting rules. The rules require wireless carriers to use secure methods to authenticate a customer before changing a SIM or porting a number, to notify customers promptly when such a request is made, to let customers lock their accounts against changes, to train staff, and to keep records of SIM change requests. In July 2024 the FCC granted part of an industry request for more time, so full compliance would not be required until a further federal review of the record-keeping requirements was finished and a compliance date announced.

Outside telecoms, financial regulators have pushed firms toward stronger authentication. Rules such as Europe's strong customer authentication (SCA) require more than one factor, and many firms treat text messages as the weakest acceptable option. Disputes over losses from SIM swaps on bank accounts can also raise questions under consumer-protection rules such as Regulation E.

The most effective defence is to stop relying on text messages for security. Authenticator apps, hardware security keys and passkeys give multi-factor authentication (MFA) that a SIM swap cannot intercept. Users can also set a carrier account PIN or port-out lock, limit the personal details they share online.

Warning signs include a phone that suddenly shows "no service" or "SIM not provisioned" and unexpected messages about account changes. Victims should contact their carrier from another phone, then their bank and exchanges, and report the crime. Firms can reduce exposure through fraud detection that checks whether a phone number has recently changed SIM before trusting it, a signal some carriers make available to banks.

• FBI Internet Crime Complaint Center: SIM swapping public service announcement (2022)