SIMSwaps

SIM swapping, also known as SIM hijacking, is a social engineering fraud in which an attacker convinces a mobile carrier to transfer a victim’s phone number to a SIM card controlled by the attacker. Once the attacker controls the number, they can receive calls and text messages, including verification codes, enabling access to accounts that rely on the number for authentication.

Attackers typically gather personal information about the victim and exploit weaknesses in carrier procedures, often posing as the customer, providing identifying details, or persuading staff to authorize a SIM transfer. With the number under their control, the attacker can reset passwords and bypass SMS-based two-factor authentication, allowing access to email, bank accounts, social media, and cryptocurrency wallets.

Consequences can include financial loss, identity theft, and exposure of sensitive information. The prevalence of SIM swaps is difficult to quantify, but the method has been used against high-value targets and crypto holders, among others, in notable cases reported by media and security researchers.

Prevention measures include using non-SMS two-factor authentication such as authenticator apps or hardware security keys, enabling port-out blocking or a carrier-level SIM-swap protection, and setting a strong, unique PIN or password on the mobile account. Users should also enable SIM lock, limit the sharing of personal data, and monitor accounts for unusual activity, including sudden loss of service.

If a SIM swap is suspected, victims should contact the carrier immediately to suspend transfers, secure all affected accounts, change passwords, enable account alerts, and consider credit or identity monitoring. Legislation and carrier policies vary by jurisdiction, and awareness remains important for mitigation.