SIM-swap attacks
Criminals steal your phone number to intercept codes and take over accounts.
What it is
A SIM swap is when a criminal convinces your mobile carrier to move your phone number onto a SIM card they control. Your phone loses signal, and every call and text — including the security codes that protect your accounts — now goes to the attacker. They use those codes to reset passwords and drain bank or crypto accounts.
How it happens
The attacker first gathers your personal details — often from data breaches, social media, or an earlier phishing message. Then they contact your carrier posing as you, claim your phone was lost or damaged, and request the number be moved to a new SIM. Weak identity checks by the carrier let the swap go through.
Warning signs
- Your phone unexpectedly loses all signal and cannot make calls or texts.
- You stop receiving expected calls or messages for no clear reason.
- Notifications that your account details or password were changed.
- Your carrier emails you about a SIM change you did not request.
Who it targets
Anyone can be hit, but attackers focus on people worth the effort: those with cryptocurrency, valuable social-media handles, or online banking. Because the attack relies on your leaked personal data, people whose details appear in breaches are at higher risk.
How to protect yourself
- Add a PIN or port-out passcode to your mobile account — ask your carrier how.
- Move two-factor authentication off SMS and onto an authenticator app or security key.
- Never announce your phone number publicly or link it to sensitive accounts unnecessarily.
- Keep your personal information out of public profiles and off data-broker sites.
- Treat any unexpected loss of signal as an emergency worth checking immediately.
If it happens to you
- Call your mobile carrier from another phone immediately and ask them to reverse the swap and lock the account.
- Log in to your email and bank from a trusted device and change the passwords.
- Contact your bank to freeze accounts and watch for fraudulent transfers.
- Report the crime to your national fraud or cybercrime service.