simswap

SIM swap, also called SIM splitting or SIM port-out fraud, is a type of social engineering attack in which an attacker convinces a mobile network operator to transfer a victim's phone number to a SIM card controlled by the attacker.

The attacker gathers personal information about the victim—name, address, date of birth, account numbers, and recent communications—through phishing, data breaches, or social media. They then contact the carrier, impersonate the victim, and request a number port to a new SIM.

Once the attacker has control of the victim's phone number, they can receive SMS verification codes and password resets, bypass two-factor authentication, and gain access to online accounts including email, bank accounts, social networks, and cryptocurrency wallets.

Methods include social engineering of customer service, exploiting verification weaknesses, SIM cloning, or abusing eSIM enrolment. Some schemes intercept temporary codes or exploit weak account recovery processes.

Impact can include financial losses, theft of funds, identity theft, damage to credit, and long delays to recover accounts. Victims may experience extended credential and access restoration efforts, with potential secondary fraud.

Prevention and mitigation include enabling port-out or SIM-change locks with the carrier, and using a unique PIN or passphrase for changes. Prefer authenticator apps or hardware keys for 2FA instead of SMS, and enable alerts for phone-number changes. Limit the linkage of critical accounts to a single phone number, and review security settings regularly.

Regulatory and legal aspects: SIM swapping is illegal in many jurisdictions and prosecuted as fraud or computer crime. Law enforcement and industry groups have urged carriers to implement stronger identity verification and customer protections.

Notable cases have drawn attention to the tactic, including incidents where targets such as public figures, crypto companies, or financial services customers suffered significant losses.