One Phone Call Away From Losing Everything: The SIM Swap Attack Explained

The attack begins not with malware, not with a phishing link, and not with a sophisticated breach of corporate infrastructure. It begins with a phone call — sometimes two or three — to a mobile carrier's customer support line. By the time the call ends, the attacker has rerouted the victim's phone number to a SIM card they control. Everything that flows through that number — two-factor authentication codes, password reset texts, bank alerts — now flows to the attacker instead.

This is SIM swapping, and it has become one of the most financially destructive forms of account takeover in the United States. The Federal Trade Commission received more than 15,000 SIM swap complaints in 2023 alone, a figure that security researchers widely acknowledge represents a fraction of actual incidents. Losses in individual cases have ranged from thousands to millions of dollars.

How the Attack Unfolds

To understand why SIM swapping is so effective, it helps to understand how mobile carriers handle number portability and SIM replacement requests. Carriers legitimately reassign phone numbers to new SIM cards every day — when customers upgrade devices, replace a lost phone, or switch to a new carrier through a process called porting. Customer service representatives are trained to facilitate these requests efficiently. That efficiency is the vulnerability.

A SIM swap attacker typically begins with reconnaissance. Using data purchased from breach databases, harvested from social media profiles, or obtained through prior phishing, the attacker assembles enough personal information about the target to impersonate them convincingly. Full name, billing address, the last four digits of a Social Security number, account PIN, and recent call history are common pieces of the puzzle. Data brokers and dark-web marketplaces have made this information disturbingly accessible.

Armed with that profile, the attacker contacts the carrier — by phone, online chat, or sometimes in person at a retail store — and claims to be the account holder who needs a new SIM card. They provide the personal details they have gathered to pass identity verification. If successful, the representative transfers the number. The victim's phone loses service almost immediately. The attacker's device begins receiving all calls and texts destined for that number.

From that point, the clock is running. The attacker navigates to the target's email provider, bank, or cryptocurrency exchange and clicks "Forgot Password." The reset code arrives as a text message — to the attacker's phone. The password is changed. The account is theirs.

The Cases That Made Headlines

SIM swapping first attracted widespread public attention through a series of high-profile cryptocurrency thefts. In 2018, a college student named Joel Ortiz was arrested after allegedly using SIM swaps to steal more than $5 million in cryptocurrency from dozens of victims, including attendees of the Consensus blockchain conference in New York City. He was ultimately sentenced to ten years in prison — at the time, the longest sentence handed down in a SIM swap case.

In 2021, the Justice Department charged a group of individuals in connection with a scheme that allegedly targeted hundreds of victims across the country, including celebrities and executives, stealing millions in cryptocurrency and personal data. The same year, a 25-year-old was charged in connection with the SIM swap that led to the 2020 Twitter hack, in which attackers seized control of high-profile accounts including those of Barack Obama, Elon Musk, and Joe Biden to run a Bitcoin scam that netted over $100,000 in hours.

These cases are notable not only for their scale but for what they reveal about the attack's accessibility. Many of the perpetrators were young, with no prior technical training. The social engineering component — convincing a customer service representative to make the swap — required persistence and preparation, but not programming expertise.

Why SMS Two-Factor Authentication Is the Weak Link

The broader lesson of SIM swapping is one that security professionals have been communicating for years: SMS-based two-factor authentication, while better than no second factor at all, is structurally vulnerable. Any authentication system that routes codes through the phone network can be circumvented by an attacker who controls the phone number.

This is not a theoretical concern. The National Institute of Standards and Technology (NIST) deprecated SMS as an authentication mechanism in its 2016 digital identity guidelines, citing the risk of interception and SIM swapping. Major financial institutions and technology companies have since added alternative authentication options, but SMS remains the default for many services and the only option offered by others.

Concrete Defenses Every American Should Implement

The attack vector is real, but it is not without effective countermeasures. The following steps represent the current best practices recommended by security researchers and endorsed by the FTC.

Set a carrier account PIN or passcode. All four major US carriers — AT&T, Verizon, T-Mobile, and US Cellular — allow customers to set a separate PIN or passcode that must be provided before any account changes, including SIM transfers, can be processed. This is distinct from your account password and adds a layer that must be defeated before a swap can succeed. Contact your carrier directly or log into your account portal to enable this feature.

Enable number lock or port freeze where available. Some carriers offer an explicit "SIM lock" or "port freeze" feature that prevents your number from being transferred without additional verification steps. T-Mobile's "SIM Protection" and AT&T's "Number Lock" are examples. Activating these features significantly raises the bar for a successful swap.

Migrate away from SMS-based two-factor authentication. Replace text-message codes with an authenticator application — Google Authenticator, Authy, and Microsoft Authenticator are widely used and free. These apps generate time-based codes locally on your device, with no phone network involvement. A SIM swap does not affect them. For the highest level of protection, a hardware security key such as a YubiKey provides FIDO2-based authentication that is effectively immune to remote account takeover.

Audit which accounts still use your phone number for recovery. Log in to your email, banking, and social media accounts and review the two-factor settings. Remove your phone number as a recovery option wherever an alternative exists.

Treat unexpected loss of cell service as an emergency. If your phone suddenly shows "No Service" or "SOS Only" outside of a known dead zone, do not assume it is a network glitch. Contact your carrier immediately from another device. Early detection can limit the damage.

The Carrier Accountability Question

Critics argue that the ultimate responsibility for SIM swap fraud lies with the carriers, whose verification procedures remain inadequate despite years of documented abuse. In January 2023, the FCC proposed new rules requiring carriers to implement more secure authentication procedures before processing SIM change requests and to notify customers immediately when such changes are made. The rulemaking process is ongoing, and advocates continue to push for binding standards rather than voluntary compliance.

Until regulatory requirements catch up with the threat, the burden of protection falls largely on consumers. The defenses outlined above are not difficult to implement. They require perhaps an hour of account review and a few minutes on the phone with your carrier. Against an attack that can drain a bank account or cryptocurrency wallet in the time it takes to drink a cup of coffee, that investment is modest by any measure.