SIM Swapping Scams: Complete Protection Guide
SIM swapping, also known as SIM hijacking or port-out scamming, is a sophisticated form of identity theft where criminals convince your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can intercept two-factor authentication codes, password reset links, and verification messages, giving them access to your bank accounts, cryptocurrency wallets, email, and social media. According to the FBI's Internet Crime Complaint Center, SIM swapping losses exceeded $68 million in 2021, with individual victims losing between $5,000 and $2 million. The attack typically begins with phishing or data breaches where criminals gather personal information about you—birthdates, addresses, Social Security numbers, account numbers, or answers to security questions. Armed with this information, they contact your mobile carrier posing as you, claiming they need to activate a new phone or replace a damaged SIM card. Many carriers rely on easily obtained or guessed information for verification, making the social engineering attack alarmingly successful. Within minutes of gaining control of your number, attackers race to access your most valuable accounts before you realize what's happening. What makes SIM swapping particularly devastating is its speed and scope. Unlike traditional identity theft that may take weeks to discover, SIM swap victims often realize something is wrong within hours when their phone suddenly loses service. By that time, attackers have already drained bank accounts, stolen cryptocurrency holdings, and locked victims out of email and social media accounts by changing passwords. The average loss of $25,000 reflects the combination of direct financial theft, cryptocurrency losses, and the cascading damage from compromised accounts. High-profile cases have involved celebrities, executives, and cryptocurrency investors losing millions, but everyday consumers are increasingly targeted as criminals refine their techniques.
Common Tactics
- • Criminals gather personal information through phishing emails, text messages, or by purchasing data from dark web marketplaces that sell information from previous data breaches, building a complete profile to impersonate victims.
- • Attackers call mobile carriers multiple times, sometimes targeting less-experienced customer service representatives or calling during high-volume periods when verification procedures may be rushed or overlooked.
- • Scammers exploit insider threats by bribing or recruiting employees at mobile carriers who can directly transfer phone numbers without following proper verification procedures, bypassing security measures entirely.
- • Fraudsters create fake identification documents using stolen personal information and visit carrier retail stores in person, presenting falsified IDs to convince staff to issue a new SIM card with the victim's number.
- • After successfully transferring the number, attackers immediately attempt password resets on high-value targets like email accounts, cryptocurrency exchanges, and banks, using SMS-based two-factor authentication to gain access within minutes.
- • Criminals monitor victims' social media for travel posts, life events, or patterns that suggest when someone might be distracted or less likely to immediately notice their phone service disruption, timing attacks for maximum success.
How to Identify
- Your phone suddenly shows 'No Service,' 'SOS Only,' or cannot connect to your carrier's network despite being in an area with normal coverage, indicating your number may have been transferred to another SIM card.
- You receive unexpected text messages or emails about SIM card changes, phone number transfers, or new device activations from your mobile carrier that you did not initiate or authorize.
- You cannot make or receive calls or texts, and restarting your phone or toggling airplane mode does not restore service, which is distinctly different from typical network outages affecting multiple users.
- You receive notifications about password reset attempts, successful logins from unknown devices, or account changes to your email, banking, or cryptocurrency accounts that you did not request.
- Friends or contacts report receiving strange messages from your phone number, or you see activity on your social media accounts that you did not perform, indicating someone else is using your number.
- Your online accounts suddenly become inaccessible because passwords have been changed, and password reset options that send codes to your phone number no longer work since you no longer control that number.
How to Protect Yourself
- Contact your mobile carrier immediately to add a PIN, password, or verbal passphrase to your account that must be provided before any SIM changes or port-out requests are processed, and ensure it cannot be reset without in-person ID verification.
- Enable app-based two-factor authentication using authenticator apps like Google Authenticator, Authy, or Microsoft Authenticator instead of SMS-based codes, and use hardware security keys for your most critical accounts like email and banking.
- Register your phone number with your carrier's port protection or number lock service, which prevents your number from being transferred to another carrier without additional verification steps that can take 24-48 hours.
- Monitor your mobile account regularly for unauthorized changes, set up account alerts for any modifications, and consider using a separate, unlisted phone number for critical two-factor authentication on financial accounts.
- Limit personal information shared on social media and public profiles, as attackers use birthdates, addresses, pet names, and family details to answer security questions and convince carrier representatives they are you.
- If you experience sudden loss of service, immediately contact your carrier using a different phone or internet connection, simultaneously check your financial accounts for unauthorized access, and file a police report if your number was stolen.
Real-World Examples
A cryptocurrency investor in California lost $890,000 in Bitcoin when attackers convinced his carrier to port his number to a new SIM card at 2 AM. Within 30 minutes, they accessed his Coinbase account using SMS two-factor authentication, transferred all his holdings to external wallets, and changed his email password. He discovered the theft when he woke up to find his phone had no service and all his accounts were locked. Despite reporting it immediately, the cryptocurrency was gone within the first hour.
A small business owner received a text at 11 PM asking to verify a SIM card change she never requested. Minutes later, her phone went dead. The attackers had gathered her information from a data breach and used it to convince a customer service representative to transfer her number. They immediately accessed her business bank account, initiated wire transfers totaling $47,000, and changed the email associated with her account. She discovered the theft the next morning when employees couldn't reach her and customers reported suspicious emails.
A college student's Instagram account with 250,000 followers was stolen through SIM swapping after he posted about his birthday celebration. Attackers used publicly available information including his birthdate, university, and hometown to successfully port his number. They reset his Instagram password using SMS verification, changed the email address, and held the account for ransom demanding $5,000 in Bitcoin. They also attempted to access his bank account but were blocked because he had disabled SMS-based authentication in favor of an authenticator app.