SIM swap

A SIM swap, also called SIM hijacking or a port-out attack, happens when a criminal persuades a mobile carrier to transfer a victim’s phone number onto a SIM the attacker controls. Most cases rely on social engineering against call centres or retail staff, sometimes aided by stolen personal data or a bribed insider. Once the number moves, every SMS one-time code, password-reset link, and recovery call flows to the attacker instead of the account owner.

Why it matters

Cryptocurrency holders are disproportionately targeted because control of a phone number can unlock email, exchange logins, and any account defended only by SMS codes. The FBI’s Internet Crime Complaint Center has reported substantial cumulative losses. Regulators have pushed carriers toward stronger authentication and port-out alerts, but the strongest individual defence is to move critical accounts off SMS entirely, onto authenticator apps or hardware security keys. Attackers often act within minutes of a successful swap, using the intercepted codes to reset passwords and lock the victim out, so noticing a sudden, unexplained loss of mobile signal and contacting the carrier immediately can limit the damage.

Common misunderstanding

People often assume two-factor authentication makes an account safe regardless of the method. SMS-based codes are a weak second factor precisely because they depend on a phone number that a carrier can reassign. Phishing-resistant factors such as FIDO2 security keys are not exposed to carrier compromise and resist SIM-swap takeover. Assuming any second factor is equally protective is the mistake that leaves phone-based accounts exposed.

Related terms

See two-factor authentication, custodial wallet and KYC.