SIM Swapping: How Phone Numbers Get Stolen

Your phone number was never designed to be an identity document. It's a routing address in a network built for voice calls - Yet somewhere along the way, banks, email providers, and crypto exchanges all decided that possession of a number proves you're you. SIM swapping is the attack that collects on that mistake. Without touching your phone, installing any malware, or ever contacting you, an attacker convinces your carrier to move your number onto their SIM card. From that instant, every call and text meant for you - Including one-time login codes and password-reset links - Arrives on a criminal's handset. The FBI's Internet Crime Complaint Center logged 1,611 SIM-swapping complaints in 2021 alone, with reported losses of roughly $68 million, and the technique has featured in everything from drained crypto fortunes to the 2019 hijacking of Twitter CEO Jack Dorsey's own account.

How the attack actually works

A SIM swap is social engineering aimed at your carrier, not technology aimed at your phone. The playbook:

1. Research. The attacker assembles your identity kit: full name, number, address, date of birth, last-four of SSN - Most of it available from data-breach dumps and data brokers. Phishing or a fake "carrier survey" call may fill gaps. Targets are often pre-selected: crypto holders doxxed by forum posts, or victims whose credentials an infostealer already harvested.
2. The swap. They contact your carrier - Support line or retail store - Impersonating you: "Lost my phone, need my number moved to this new SIM." Verification questions get answered from the research file. Alternatively, they skip persuasion entirely: criminal groups have paid retail employees to run swaps directly, and court cases have documented insiders processing dozens for a few hundred dollars each. A variant, the port-out scam, moves your number to a different carrier altogether under the same pretense.
3. The harvest. Your phone drops to "No Service." Theirs lights up as you. They immediately trigger "Forgot password?" flows on your email, banking, and exchange accounts, receiving every SMS verification code. High-value attacks are rehearsed and fast - Accounts fall in minutes precisely because the attacker knows their window closes when you notice your dead phone and reach the carrier.

The elegance, from a criminal's perspective, is that every security system works exactly as designed. The codes were delivered - To the wrong "you."

Why one stolen number unlocks so much

The blast radius comes from how many systems treat SMS as proof of identity:

• SMS two-factor codes for logins arrive on the attacker's SIM - Your second factor is now theirs.
• Password-reset texts are worse: for many accounts, control of the number alone (sometimes with an email they've also just reset) suffices to take over - No password knowledge needed. This is the recovery-path weakness in its purest form; our account recovery audit guide maps that terrain.
• Callers and banks using voice verification reach the attacker.
• Contacts receive convincing "it's me, new phone, quick favor" messages from your genuine number.

Cryptocurrency holders sit atop the target list for a cold reason: irreversibility. A fraudulent bank transfer can sometimes be clawed back; a drained wallet cannot. U.S. prosecutions have detailed individual SIM-swap victims losing tens of millions in crypto, and organized rings - Including members of the group behind the 2020 Twitter breach - Treated swaps as their standard entry technique.

The first sign of a SIM swap is silence: your phone shows "No Service" in a place it never does, or texts simply stop arriving. Treat that as a five-alarm emergency, not a network hiccup.

Locking down the carrier side

Regulators have moved - The FCC adopted rules (effective 2024) requiring U.S. carriers to securely authenticate customers before SIM changes and port-outs and to notify you when one is requested - But the practical burden remains on you, and the controls are concrete:

Set the carrier PIN today - Every major U.S. carrier offers one (and postpaid accounts often ship without one until you ask). Make it random, not your birth year or address digits: four to eight digits from a PIN generator, stored in your password manager. The account-takeover protections marketed as Number Lock or Port Freeze add a harder stop above the PIN.

Getting your logins off the phone network

The deeper fix is making your number worthless to steal. SMS was never designed as an authentication channel, and SIM swapping is only its most cinematic failure - Our TOTP vs SMS comparison walks through the full case. Migration order:

1. Email first. It's the master key to your other resets. Move it to authenticator-app codes or, better, a passkey or security key such as a YubiKey; then remove SMS as a fallback.
2. Financial and crypto accounts. Exchanges and banks increasingly support app-based codes and hardware keys - Use the strongest offered, and remove the number from recovery where policy allows.
3. Everything else with value: password manager, cloud storage, social accounts.

App-based TOTP codes are generated on-device from a shared secret and the clock - Nothing is transmitted, so there's nothing for a hijacked number to receive; you can see the algorithm run live in our TOTP generator. Note the codes remain phishable in real time (a fake login page can relay them), which is why hardware-backed FIDO2 factors - Immune both to SIM swaps and to the push-bombing tricks that wear down app approvals - Top every ranking for accounts that matter.

Your number is an address, not an identity

The durable mental shift: treat your phone number like a mailing address - Useful for reaching you, absurd as a password. Publish it if you like, but never let it stand alone as proof of identity anywhere that matters. Numbers get recycled, ported, spoofed, and swapped; secrets you generate and control do not. Pair a locked-down carrier account with authenticator- or key-based factors, keep recovery paths off the phone network, and a SIM swapper who wins your number ends up holding exactly what it was always meant to be: a way to receive phone calls.

FAQ

How do I know if I've been SIM swapped?

The signature symptom is your phone abruptly losing all service - "No Service" or "SOS only" - Somewhere coverage is normally fine, often paired with carrier emails about a SIM change you didn't request, then a cascade of password-reset notices. Restarting doesn't fix it, because the network now routes your number elsewhere. Call your carrier immediately from another phone; minutes genuinely matter.

Can a SIM swap happen without any mistake on my part?

Yes - That's what makes it insidious. The deception targets carrier employees (or recruits them outright), using identity details already circulating from old breaches and data brokers. You can do everything right and still be swapped, which is why the defenses that matter are structural: a carrier PIN and port freeze, and authentication that doesn't route through your number at all.

Is SMS two-factor authentication useless, then?

Not useless - SMS 2FA still defeats the commonest attack, credential stuffing with a bare stolen password, and it's far better than a password alone. But it's the weakest second factor: exposed to SIM swaps, SS7 network attacks, and real-time phishing. Use it only where nothing better exists, and upgrade email, financial, and crypto accounts to authenticator apps, passkeys, or hardware keys.

What is a port-out scam, and how is it different?

A classic SIM swap moves your number to a new SIM on the same carrier; a port-out transfers it to a different carrier entirely, exploiting the number-portability process. The effect is identical - The attacker receives your calls and texts - But port-outs can take longer to unwind across two companies. Carrier "port freeze" or "number lock" features block both; enable them alongside your account PIN.

Does an eSIM protect me from SIM swapping?

Only partially. eSIMs remove one physical avenue - Nobody can walk out of a store with a plastic SIM carrying your number - But the core attack targets the carrier's account-change process, which serves eSIM provisioning just the same. A social-engineered or bribed representative can push your number to an attacker's eSIM as easily as to plastic. The PIN, port freeze, and non-SMS 2FA remain the real defenses.