What Is SIM Swapping, and How Do You Prevent It?

Your phone number was never designed to be a security credential, yet millions of accounts treat it as one. A SIM swap (also called SIM hijacking or a port-out scam) is the attack that exploits that mistake. A criminal convinces your mobile carrier to move your phone number onto a SIM card they control. From that moment, your calls and text messages arrive on the attacker’s device, not yours. Any one-time code, password-reset link, or login prompt sent by SMS now lands in the wrong hands. For anyone holding cryptocurrency on an exchange, this is one of the most direct paths to a drained account, because the phone number is often the master key that unlocks email, which in turn unlocks everything else.

What a SIM swap actually is

Every mobile line is tied to a subscriber identity module — the SIM. Carriers can reassign your number to a new SIM at any time; that legitimate feature exists so you can replace a lost or upgraded phone. A SIM swap abuses this process. The attacker contacts your carrier posing as you, or bribes or tricks an employee, and requests that your number be activated on their SIM. When it works, your own phone silently loses signal while the attacker’s phone starts receiving your texts and calls.

The attacker rarely needs to break any cryptography. They need personal details — your name, address, date of birth, the last four digits of a card, answers to security questions — most of which leak from data breaches, social media, or phishing. This is fundamentally a social-engineering and identity-theft attack against the carrier, not a technical hack of your wallet.

Why crypto holders are prime targets

SMS-based two-factor authentication (2FA) was widely adopted because it is convenient. It is also the weakest common second factor. Once an attacker owns your number, SMS 2FA does not protect you — it actively helps the attacker, because password-reset flows and login codes flow straight to them. On a custodial exchange, that can mean full account takeover and withdrawal. The distinction matters: with a self-custody wallet, your keys are not tied to a phone number, which is one more reason to understand custodial versus non-custodial custody. A SIM swap against an exchange login is an account-takeover problem; a SIM swap cannot, by itself, extract a seed phrase you hold offline.

The FBI’s Internet Crime Complaint Center (IC3) has tracked the rise directly. In a public service announcement, IC3 reported that from January 2018 through December 2020 it received 320 SIM-swap complaints with roughly $12 million in losses, then 1,611 complaints in 2021 alone with losses exceeding $68 million. The jump reflects how lucrative account takeover became once attackers realized phone numbers were the soft underbelly of online security.

The warning signs of an active swap

A SIM swap is one of the few attacks with an unmistakable physical symptom: your phone abruptly loses service — no bars, no calls, no data — even though you are in a normal coverage area and others around you are connected. Treat sudden, unexplained loss of cellular service as a possible attack in progress, not just a network glitch. Other signals include:

• Notifications that your SIM or eSIM was changed, or that your number was ported, when you did nothing.
• Being locked out of email or exchange accounts, or receiving password-reset messages you did not request.
• Unexpected “your login code is…” texts appearing on a device that shouldn’t be receiving them.

If your phone goes dark, act within minutes. Attackers move fast because the window before you notice is their advantage.

Regulation is catching up, but slowly

In November 2023 the U.S. Federal Communications Commission adopted rules specifically targeting SIM-swap and port-out fraud. Effective July 8, 2024, wireless providers must use secure methods to authenticate a customer before transferring a number to a new SIM or a new carrier, must notify customers of SIM-change and port-out requests, and must offer account-lock features. These rules reduce risk but do not eliminate it — employees can still be socially engineered, and rules vary by country. Your own account hardening remains the decisive factor.

How to prevent a SIM swap

Prevention has two layers: making your phone number harder to steal, and making your number worthless to steal by removing it from your security stack. The second layer is more powerful. If no important account can be reset or logged into using an SMS code, then taking your number buys the attacker very little.

Harden the carrier account

Call your carrier and add a number-transfer PIN or port-freeze — a separate secret required before any SIM change or port. Do not reuse a PIN you use elsewhere. Ask whether the carrier can flag your account as high-risk for social engineering.

Get your number out of your logins

This is the core defense. Replace SMS 2FA with an authenticator app or, better, a hardware security key everywhere it is offered. Our guide on how to set up 2FA for a crypto account walks through the right order. The broader security hub covers the surrounding habits.

If it has already happened

Speed matters. Contact your carrier from another line to reclaim the number, then race to secure the accounts an attacker would target first — email above all, then exchanges and financial accounts. Change passwords, revoke active sessions, and switch any account off SMS 2FA. If funds or accounts are affected, follow a structured response; see wallet compromised: what to do. Report the crime to IC3 (ic3.gov) and, in the U.S., to the FTC at reportfraud.ftc.gov. Be alert afterward for follow-up fake support scams, where criminals pose as your carrier or exchange to finish the job or to sell you bogus “recovery.”

The mindset that keeps you safe

Assume your phone number is public and eventually stealable, because for practical purposes it is. Design your security so that losing your number is an inconvenience, not a catastrophe. Move high-value accounts to phishing-resistant authentication, keep long-term crypto in self-custody with keys stored offline, and never store a seed phrase anywhere a phone-based attacker could reach it — a point covered in how people lose seed phrases. The attacker’s whole business model depends on your number being a skeleton key. Take that key away and the attack collapses.

How attackers pick and profile their targets

SIM swaps are rarely random. Attackers often identify people who are likely to hold cryptocurrency — by their public activity in crypto communities, their job, or leaked exchange-breach data — and then assemble a dossier from open sources and previous data breaches. They gather the exact details a carrier uses to verify identity: full name, address history, date of birth, account number, and answers to common security questions. This is why treating any single fact as “secret enough” for account recovery is a mistake; most of it is already for sale. The defense is to base account security on something the attacker cannot look up, such as a carrier PIN you set yourself and a second factor that lives on a device in your hand.

It also explains why over-sharing is a risk. Publicly boasting about holdings, posting screenshots that reveal balances, or linking a real-world identity to an on-chain profile all raise your value as a target. Keeping a low profile is a genuine, if unglamorous, security control.

What SMS 2FA does and does not protect

It helps to be precise about the boundary of the threat. A SIM swap converts your phone number into the attacker’s, so anything that can be accessed or reset with that number is at risk. But it does not magically grant knowledge of your passwords, nor does it expose secrets that never touch the phone network.

The takeaway is that the damage from a SIM swap is proportional to how much of your security depends on your phone number. Shrinking that dependency is the whole strategy, and it is entirely within your control regardless of what your carrier does.

Reporting, and why it still matters after the fact

Even when funds cannot be recovered, reporting a SIM swap serves a real purpose. It creates an official record that can support disputes with your carrier or bank, it feeds the aggregate data that regulators and law enforcement use to justify stronger carrier rules, and it can occasionally aid investigations when attacks are linked. In the United States, file with the FBI’s Internet Crime Complaint Center at ic3.gov and with the Federal Trade Commission at reportfraud.ftc.gov, and include specifics: your carrier, the date and approximate time your service dropped, which accounts were accessed, and any losses. Notify your carrier’s fraud department in writing so there is a timestamped record, and alert your bank and any affected exchange so they can watch for follow-on activity. In other countries, report to the equivalent national cybercrime or consumer-protection body. None of this undoes the theft, but it strengthens the wider system that makes the next swap harder to pull off.

Sources

• Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public — FBI Internet Crime Complaint Center (IC3)
• FCC Announces Effective Compliance Date for SIM Swapping Item — U.S. Federal Communications Commission
• How to Recognize and Avoid Phishing Scams — U.S. Federal Trade Commission
• NIST SP 800-63B: Digital Identity Guidelines, Authentication — National Institute of Standards and Technology