SIM Swap Attack

What is a SIM Swap Attack, and how is it different from an ordinary password breach?

A SIM swap attack targets not your password or Private Key, but your phone number itself. Through social engineering (such as impersonating you and contacting your mobile carrier's customer service, claiming your phone was lost or you need a new SIM activated for a device switch), the attacker convinces a support agent to transfer your phone number over to a new SIM card the attacker holds. Once the transfer succeeds, your original phone instantly loses all signal — no calls, no texts get through — while every SMS verification code and password reset link that should have gone to your phone now arrives on the attacker's device instead.

The fundamental difference from an ordinary password leak lies in the scope of the cascade effect: a password leak usually only affects a single account, unless the user reuses the same password across all their accounts. But once a phone number is hijacked, an attacker can use it to reset access to nearly every service that relies on SMS as two-factor authentication or account recovery — email, social media, banking, cryptocurrency exchanges. As long as those services allow an SMS code as credentials for login or password reset, the attacker can use that single attack to sequentially take over a whole chain of accounts, not just lose control of one.

Why does the mobile carrier's customer support process become the opening for this attack, and how does the attacker exploit that weakness?

A carrier's customer support process was originally designed to serve genuine customers who really did lose their phone or need a new SIM. This process is essentially an identity verification mechanism, but the verification method (checking basic personal details like name, date of birth, billing address) has, in an environment where data breaches happen constantly, stopped being information only the real account holder would know. An attacker can piece together a combination of details sufficient to pass customer support verification through previously leaked databases, social engineering additional details out of someone, or simply collecting personal information a victim has shared publicly on social media.

This weakness is hard to fully eliminate because carriers face a structural trade-off: the stricter the verification process, the worse the experience gets for genuine customers who really did lose their phone and need an urgent replacement, driving up complaints and disputes; the looser the verification process, the easier it is for an attacker to break through with a limited set of personal details. Multiple lawsuits and regulatory investigations (such as U.S. Federal Communications Commission rulings on whether carriers adequately fulfilled their obligation to protect customer proprietary network information) all point to the same core problem: carriers' defenses against this kind of attack haven't necessarily kept pace with how fast attackers' social engineering techniques have evolved.

How does a SIM Swap Attack actually unfold, and what does the attacker do once they gain control of the phone number?

A typical flow runs through several steps: the attacker first collects a victim's basic personal details (name, date of birth, address, last four digits of an account, etc.) through leaked databases, social engineering, or publicly available social media information. They then contact the victim's mobile carrier's customer support, posing as the victim, claiming their phone was lost or damaged and needs urgent activation on a new SIM card, using the collected details to pass customer support's identity verification. Once support approves it, the victim's original phone number gets transferred and bound to the SIM card the attacker holds — from that moment on, the victim's phone loses all signal completely, while the attacker's device starts receiving every text and call that should have belonged to the victim.

Once the attacker gains control of the phone number, their subsequent actions are typically very fast: using SMS verification codes, they sequentially reset the victim's email password, social media account passwords, and cryptocurrency exchange account password — any target service that allows SMS to serve as a credential for account recovery or two-factor authentication can be breached one after another. Because most services, upon detecting an "unusual device login," default to sending an SMS verification code to confirm identity — which lands squarely on exactly the advantage the attacker has already secured. A victim's assets can be moved out entirely within just minutes of the attacker gaining control of the phone number, far faster than most users can possibly react.

How can I protect myself from SIM swap attacks, and what should I do if I suspect I've already been attacked?

The most core defense is switching two-factor authentication entirely away from "SMS codes" and over to an "app authenticator" (like Google Authenticator or Authy) or a Hardware Security Key (like a YubiKey) — the codes these methods generate are tied to your device itself and never pass through the carrier's network, so even if your phone number gets hijacked, the attacker still can't obtain that code. Second, proactively contact your mobile carrier and ask whether you can set up a "port-out PIN" or an additional account security password — most carriers offer this feature, but don't proactively prompt users to set it up by default, so you need to request and enable it yourself. Once set, any phone number transfer request must also provide that password to pass verification. Additionally, minimize publicly sharing personal details like your birthday or address on social media — these are exactly the raw materials attackers use to pass customer support verification.

If you suspect you're currently under attack (your phone suddenly has zero signal, receiving no calls or texts at all), the first thing to do is immediately log into every potentially affected important account through another channel (like the web version, or a family member's device), prioritizing your cryptocurrency exchange and email accounts (since email is usually the hub through which other accounts get their passwords reset), switch two-factor authentication over to a non-SMS channel, and simultaneously contact your carrier to confirm your phone number's status and request an immediate freeze or reversal. Your reaction speed directly determines the scale of the loss, which is also why it's worth folding the specific steps for responding to a SIM Swap Attack into the Incident Response Plan you should already have prepared in advance — rather than trying to figure out what to do on the spot once it actually happens.