SIM Swapping Attacks: How They Work and How to Prevent Them (2026 Guide)

This analysis is based on FBI statistics, cybersecurity research, and official carrier documentation published between 2020–2026.

Imagine this: You're sitting at home, your phone in your hand, when suddenly the signal vanishes. The "No Service" message appears where your bars used to be. You assume it's a temporary network glitch—until you try to log into your email and realize your password no longer works. Your bank account? Locked. Your cryptocurrency? Gone. All of this happened not because you clicked a malicious link or shared a password, but because someone convinced your phone company to give them control of your number.

This is SIM swapping, one of the most devastating and fastest-growing forms of account takeover today. Unlike the complex technical hacks portrayed in movies, SIM swapping relies on something far simpler: social engineering. With nothing more than a phone call and a few pieces of stolen information, attackers can hijack your number, intercept security codes, and take over your most sensitive accounts—often in under an hour.

The scale of this threat is staggering. According to the FBI's Internet Crime Complaint Center (IC3), SIM swapping complaints increased dramatically from 320 incidents between 2018 and 2020 to 1,611 complaints in 2021 alone, with adjusted losses exceeding $68 million. And these are just the reported cases. High-profile victims have included technology executives, cryptocurrency investors, and even the CEO of Twitter.

This guide explains exactly how SIM swapping works, why it's so effective, and—most importantly—what you can do to protect yourself.

Part 1: What Is SIM Swapping?

SIM swapping, also known as SIM porting fraud, SIM splitting, or simjacking, is a type of attack where a criminal convinces your mobile carrier to transfer your phone number to a new SIM card that the attacker controls. Once the swap is complete, the attacker's phone becomes the new destination for all your calls and text messages.

This includes:

• One-time passcodes (OTPs) for account logins
• Password reset links sent via SMS
• Multi-factor authentication (MFA) tokens
• Two-factor verification codes
• Banking alerts and transaction confirmations

The fundamental problem is that phone numbers were never designed to serve as security credentials. They were designed as routing addresses—ways for the telephone network to direct calls and messages to the right device. Treating them as proof of identity was a convenient hack, not a security feature.

When attackers gain control of your number, they effectively hold the keys to your digital life. Because countless services use phone numbers for verification, a successful SIM swap can allow an attacker to bypass even strong security controls and gain full access to your email, bank accounts, social media, and more.

Part 2: How SIM Swapping Works—Step by Step

Although specific techniques vary, most SIM swap attacks follow a predictable pattern. Understanding this process is the first step toward defending against it.

Step 1: Reconnaissance and Data Collection

The attack begins long before the attacker contacts your carrier. First, they gather as much personal information about you as possible. This typically includes:

• Your full name
• Date of birth
• Home address
• Phone number
• Email addresses
• Social Security number (or last four digits)
• Answers to common security questions (mother's maiden name, pet's name, etc.)

Where does this information come from? Attackers have multiple sources:

• Phishing scams: Emails or text messages that appear legitimate trick victims into entering personal information on fake websites.
• Data breaches: Personal information exposed in corporate data breaches is readily available for purchase on the dark web.
• Social media stalking: A surprising amount of information is publicly shared on social media—birthday posts, location check-ins, photos of pets whose names might be security answers, and family connections.
• Public records: Many details like your address and family members are available through public databases.

Step 2: Social Engineering the Carrier

Armed with this stolen information, the attacker contacts your mobile carrier. They might call customer service, visit a retail store, or use online chat support.

Posing as you, they present a convincing story:

• "I lost my phone and need a replacement SIM."
• "I bought a new phone and need to activate it."
• "My SIM card is damaged and not working."
• "I'm traveling internationally and need to transfer my number."

The attacker provides the personal information they gathered as "proof" of identity. If the carrier's verification procedures are weak—and they often are—the representative approves the request.

In some cases, attackers use more sophisticated techniques. They may bribe carrier employees (insider threat) to perform SIM swaps for multiple targets. They might also use phishing to deploy malware on carrier systems that can automate SIM swaps at scale.

Step 3: Number Takeover

Once the carrier completes the transfer, your original SIM card is deactivated. Your phone immediately loses service, showing "No Service" or "SOS Only."

Simultaneously, the attacker's device activates with your phone number. All your calls, texts, and data now go to them. You might assume it's a temporary network outage—by the time you realize what's happened, the attacker is already moving to the next phase.

Step 4: Account Takeover

With control of your phone number, the attacker now has a powerful tool: the ability to receive SMS-based verification codes.

They visit the websites of your most valuable accounts—email, banking, cryptocurrency exchanges, social media—and trigger "Forgot Password" or "Account Recovery" flows. Many services send a verification link or one-time passcode via SMS to "confirm" your identity.

The attacker receives these codes, enters them, and resets your passwords. Within minutes, they can lock you out of your own accounts while taking full control. From there, they can drain bank accounts, steal cryptocurrency, impersonate you to scam your contacts, or sell access to your accounts on criminal forums.

Part 3: The Human Story—Real-World Impact

The statistics tell only part of the story. The human impact of SIM swapping is devastating and far-reaching.

The Cryptocurrency Investor Who Lost Millions

In one high-profile case, a cryptocurrency investor lost $23 million in a SIM swap attack. The attacker convinced the carrier to transfer the victim's number, then used SMS-based verification to reset passwords on cryptocurrency exchange accounts. The entire fortune—accumulated over years—vanished in minutes.

The Twitter Hack That Shook the World

In July 2020, one of the most brazen cyberattacks in history unfolded in real-time. The Twitter accounts of Barack Obama, Joe Biden, Elon Musk, Bill Gates, Kanye West, and dozens of other celebrities simultaneously began tweeting a Bitcoin scam.

The attackers had used SIM swapping as part of their strategy. By hijacking phone numbers, they gained access to internal Twitter administrative tools through social engineering of employees. The scam netted over $117,000 in Bitcoin—but the damage to trust in the platform was immeasurable.

The mastermind behind the attack? A 21-year-old from Liverpool, UK, part of a SIM swapping group that had previously hijacked Twitter CEO Jack Dorsey's own account.

The Security Firm That Got Hacked

Even companies that sell security services aren't immune. In 2023, Kroll—a major security consulting firm handling bankruptcy proceedings for FTX, BlockFi, and Genesis—disclosed that an employee had been SIM-swapped.

The attacker targeted a T-Mobile phone number belonging to a Kroll employee. T-Mobile transferred the number without any authorization from Kroll. The breach exposed personal information of bankruptcy claimants, who then faced targeted phishing attacks from criminals exploiting the stolen data.

As security journalist Brian Krebs noted, "This unfortunate result means that people who had financial ties to BlockFi, FTX, or Genesis now face increased risk of becoming targets of SIM-swapping and phishing attacks themselves."

Ordinary People, Extraordinary Losses

You don't need to be a crypto millionaire or celebrity to be a target. Ordinary people have lost access to email accounts they've maintained for decades, social media profiles built over years, and banking relationships that held their life savings. The attack is democratic in its devastation—anyone with a phone number is potentially vulnerable.

Part 4: The Scale of the Threat

Understanding the magnitude of SIM swapping helps explain why it demands your attention.

FBI Data Tells the Story

The FBI's Internet Crime Complaint Center (IC3) has tracked SIM swapping with increasing concern. From January 2018 to December 2020, IC3 received 320 SIM swapping complaints with adjusted losses of approximately $12 million. In 2021 alone, complaints skyrocketed to 1,611 with losses exceeding $68 million.

This represents a fivefold increase in complaints and a nearly sixfold increase in financial losses in just one year.

The Criminal Ecosystem

SIM swapping isn't just individual hackers working alone. It's part of a broader criminal ecosystem known as "The Com" (short for The Community). Within this ecosystem, "Hacker Com" groups specialize in technical crimes including SIM swapping, ransomware, and cryptocurrency theft.

These groups are often international, technically sophisticated, and motivated by profit. Members sell SIM swapping services to other criminals, with prices for swapping a specific number ranging from hundreds to thousands of dollars depending on the target's value.

The FBI warns that "cryptocurrency theft is the primary motivator for many Com actors," and that members "screen share and brag about profits resulting from cryptocurrency thefts, which sometimes exceed millions of dollars."

A Note on Prevalence

It's worth acknowledging that SIM swapping represents a small fraction of overall cybercrime. The Microsoft Digital Defense Report notes that less than one-third of one percent of identity attacks use SIM swapping, compared to 99 percent for breach replay, password spray, and phishing. SIM swapping represents less than 0.2 percent of the 880,000 complaints the FBI receives annually.

However, this doesn't mean the threat is negligible. As one security analyst noted, "No one should avoid SMS as an important security step based on unfounded fears that it's meaningfully insecure." But for high-value accounts—email, banking, cryptocurrency—the disproportionate impact of successful SIM swaps makes protection essential.

Part 5: The Warning Signs—How to Know If You're Being Swapped

SIM swapping doesn't happen in complete silence. There are warning signs, and recognizing them quickly can mean the difference between stopping an attack and suffering catastrophic losses.

Immediate Red Flags

• Sudden loss of cellular service: Your phone shows "No Service," "SOS Only," or signal bars disappear entirely, while other devices around you have normal service. This is the most common first sign.
• Inability to make calls or send texts: You try to call someone and the call fails. Text messages won't send.
• Notifications of account activity you didn't initiate: Password reset emails, login alerts from unfamiliar locations, or two-factor authentication codes you didn't request start appearing.
• Locked out of online accounts: You try to log into email, banking, or social media and your password no longer works. Recovery options fail because the verification codes go to the attacker's phone.
• Your carrier confirms a transfer: If you manage to contact your carrier through another device, they may inform you that your number was recently activated on a different SIM or device.

What to Do Immediately

If you suspect a SIM swap is in progress or has already occurred, speed is everything.

Step 1: Contact your carrier immediately. Use another phone—a landline, a family member's phone, anything available—to call your mobile carrier's customer service. Explain that you suspect SIM swapping and demand they freeze your account and reverse the transfer. Be prepared to prove your identity with information only you would know.

Step 2: Change passwords on critical accounts. If you still have access through another device or remembered sessions, immediately change passwords for your most important accounts: email, banking, cryptocurrency, social media.

Step 3: Move to stronger authentication. As you regain access to accounts, switch from SMS-based verification to authenticator apps or hardware security keys.

Step 4: Contact financial institutions. Call your bank, credit card companies, and any other financial platforms to place fraud alerts and freeze accounts if necessary.

Step 5: File official reports. Report the incident to the FBI's Internet Crime Complaint Center at ic3.gov and the Federal Trade Commission at identitytheft.gov.

Step 6: Enable credit monitoring. Consider placing a fraud alert or credit freeze with major credit bureaus to prevent identity fraud.

Part 6: How to Protect Yourself—The Defensive Playbook

Preventing a SIM swap is far easier than recovering from one. These protective measures create layers of defense that make you a much harder target.

1. Set Up a Carrier PIN or Port Lock (Your Most Powerful Defense)

This is the single most effective step you can take. Contact your mobile carrier and request a PIN, password, or port lock on your account. This creates an additional verification step that anyone—including you—must provide before changes can be made to your account.

Choose something strong and unique. Avoid obvious choices like your birth year or sequential numbers, which attackers can often guess or find online. Store this PIN somewhere safe—not in your phone, but in a password manager or written down in a secure location.

Here's how to set this up with major US carriers:

• Verizon: Sign in to your account at the Verizon website or through the My Verizon app. Navigate to Account Overview > Profile & Settings > SIM Protection, and turn it on for each device on your plan. Then enable Number Lock, which prevents unauthorized swaps of your mobile number.
• AT&T: Use the myAT&T app to enable Wireless Account Lock. This prevents unauthorized account changes, billing updates, and wireless number transfers. You'll need to disable it temporarily to make changes yourself.
• T-Mobile: Sign in to your T-Mobile account online or through the T-Life app. Go to Profile > Settings > Security > SIM Protection and enable it for any numbers you want to protect.

2. Avoid SMS-Based Authentication Wherever Possible

SMS is convenient but fundamentally insecure for authentication. Whenever an account offers alternatives, use them instead.

• Authenticator apps (TOTP) like Google Authenticator, Microsoft Authenticator, or Authy generate six-digit codes locally on your device. They don't rely on your phone number and work offline. Even if an attacker SIM-swaps you, they won't receive these codes.
• Hardware security keys like YubiKey or Google Titan provide phishing-resistant authentication. They require physical possession of the key and won't respond to fake websites. These are the gold standard for high-value accounts.
• Passkeys and platform authenticators are the newest evolution, using your device's built-in biometrics for cryptographic authentication without codes at all.

The website 2fa.directory is an excellent resource for checking which authentication methods your accounts support.

3. Use Strong, Unique Passwords for Every Account

SIM swapping is often used to capture your 2FA codes, but attackers still need your password to access accounts. If your password is weak or reused across multiple sites, you're making their job easier.

Use a password manager to generate and store strong, unique passwords for every account. This ensures that even if one account is compromised in a data breach, attackers can't use those credentials elsewhere.

Protecting your email account is especially critical—most password reset flows assume your email is secure, so compromising your email gives attackers access to everything else.

4. Limit Your Digital Footprint

Most SIM swap attempts start with stolen personal information. The less you share publicly, the harder it is for attackers to impersonate you.

• Be careful what you post on social media. Avoid sharing your birthday publicly, the names of pets (common security questions), your home address, or details about your family. Review privacy settings to limit who can see your information.
• Think twice before sharing personal details online. Even seemingly harmless information can be pieced together with other data to build a convincing impersonation.
• Consider using different email addresses for banking, social media, and other accounts so that one breach doesn't compromise everything.

5. Recognize and Resist Phishing Attempts

Phishing is often the first step in SIM swapping—attackers use fake messages to gather the personal information they need.

• Be wary of unexpected requests for account details, verification codes, or personal information. If a message creates urgency—"Your account will be suspended!"—that's a red flag.
• Don't click links in unsolicited messages. Type web addresses yourself or use saved bookmarks.
• Verify through separate channels. If you receive a suspicious request that appears to come from your carrier or a known contact, call them using a number you know is legitimate.
• Check for spoofing signs. Look closely at email addresses for slight changes that make fraudulent addresses appear legitimate.

6. Enable Account Alerts and Review Regularly

Set up notifications for account changes, new device logins, and password resets. The sooner you know something's wrong, the faster you can respond.

Regularly review your carrier account for suspicious activity, such as changes to your account information or unfamiliar devices listed.

7. Consider Google Voice or VoIP Numbers

For accounts that require SMS verification but don't offer better options, consider using a Google Voice number or other VoIP service. These numbers can't be SIM-swapped because they're not tied to a physical SIM card.

However, not all services accept VoIP numbers for verification, and some codes simply won't arrive. Test this approach with less critical accounts first.

Part 7: The Role of Mobile Carriers—What They Must Do

While individuals bear responsibility for their own security, mobile carriers play an essential role in preventing SIM swapping.

New FCC Requirements

The threat has gained attention from regulators. Following high-profile attacks and recommendations from the Department of Homeland Security's Cyber Safety Review Board, the Federal Communications Commission (FCC) announced new requirements for wireless carriers.

Beginning July 2024, carriers must take additional measures to authenticate customer identity before transferring phone numbers to new SIM cards or devices. These rules aim to make it significantly harder for hackers to trick providers into performing unauthorized transfers.

What Carriers Should Be Doing Now

Responsible carriers should already be implementing:

• Employee education: Regular training on SIM swapping techniques and how to recognize fraudulent requests.
• Strict verification protocols: Clear procedures for authenticating customers before making account changes.
• Insider threat monitoring: Systems to detect and prevent employees from performing unauthorized SIM swaps for criminals.
• Customer tools: Features like PINs, port locks, and account freezes that give customers control over their own security.

The Accountability Question

There's ongoing debate about whether carriers should bear financial liability for SIM swap losses. Some argue that carriers never agreed to secure access to accounts, so they shouldn't be liable. Others counter that when a carrier's employee is tricked into transferring a number without proper verification, the carrier should share responsibility.

As one commenter on KrebsOnSecurity noted, "You'd be amazed how quickly this problem would be solved if the mobile companies AND the companies using SMS 2FA were held liable for all losses."

For now, the burden remains primarily on individuals to protect themselves.

Part 8: Beyond SIM Swapping—The Evolution of Phone-Based Attacks

SIM swapping is part of a broader category of phone number attacks. Understanding related threats helps complete the picture.

Port-Out Scams

Port-out scams involve transferring your number to an entirely different carrier, not just a new SIM on your existing carrier. This can be harder to reverse because it involves multiple companies. The same protections—carrier PINs and port locks—help prevent both types.

Phone Cloning

Phone cloning copies your device's identity, creating a duplicate phone that can make calls and access data. This is technically more complex than SIM swapping and less common today.

SS7 Protocol Attacks

Signaling System No. 7 (SS7) vulnerabilities allow attackers to intercept SMS messages without any contact with your carrier. These attacks target the underlying infrastructure that routes calls and texts between carriers. They're more sophisticated but demonstrate the fundamental insecurity of SMS as an authentication channel.

The Convergence with Other Threats

SIM swapping increasingly combines with other attack methods. Attackers may use phishing to gather information, SIM swapping to intercept codes, then ransomware or extortion as the final stage. The FBI warns that "the intensification of these online conflicts has resulted in the emergence of a new layer of The Com known as In Real Life (IRL) Com, which includes subgroups that aim to facilitate real world acts of violence."

This convergence means that SIM swapping isn't just about financial loss—it can escalate to physical threats and real-world harm.

Part 9: The Future of Authentication—Moving Beyond Phone Numbers

The fundamental problem is that phone numbers were never designed as security credentials. The long-term solution lies in moving beyond them.

The Promise of Passkeys

Passkeys represent the most promising evolution. They use cryptographic keys stored on your device, verified by your biometrics, to authenticate you to services. No codes, no phone numbers, no SMS vulnerabilities. Major platforms including Apple, Google, and Microsoft are committed to this standard.

Hardware Security Keys

For high-value accounts, hardware security keys provide the strongest available protection. They're phishing-resistant, can't be duplicated remotely, and require physical possession of the key.

The Role of Authentication Apps

Authentication apps (TOTP) will remain important as a bridge between SMS and more advanced methods. They're free, widely supported, and not vulnerable to SIM swapping.

What Services Must Do

Service providers bear responsibility for offering and encouraging strong authentication. Every service should:

• Offer TOTP authentication apps as a minimum
• Support hardware security keys for sensitive accounts
• Avoid SMS as a primary verification method
• Educate users about the risks of phone-based authentication

SIM Swapping Prevention Checklist

Related Reading

• Two-Factor Authentication: Why SMS Is No Longer Enough (2026 Guide)
• How Hackers Hack Smartphones in 2026 — And How to Protect Yourself
• How to Secure Your WhatsApp from Hackers: The Complete 2026 Security Guide
• The Rise of AI-Powered Phishing: What You Need to Know in 2026

Conclusion

SIM swapping represents a fundamental vulnerability in how we secure our digital lives. By exploiting the gap between phone numbers as communication tools and phone numbers as identity credentials, attackers have found a way to bypass even strong security measures.

The attack is deceptively simple: gather personal information, trick a carrier employee, intercept verification codes, and take over accounts. No malware, no zero-day exploits, no technical hacking—just social engineering and the trust we place in phone companies.

Yet SIM swapping is also preventable. A carrier PIN makes unauthorized transfers vastly harder. Authenticator apps eliminate the reliance on SMS. Strong, unique passwords limit the damage when credentials are compromised. Careful online behavior reduces the information available for impersonation.

The effort required is modest. A few minutes to set up a carrier PIN, an hour to audit accounts and enable authenticator apps, ongoing awareness of phishing attempts. This small investment provides protection that no amount of reactive response can match.

Your phone number is not your identity. It never was. Treating it as such has created vulnerabilities that criminals exploit every day. By understanding SIM swapping and taking proactive steps to defend against it, you reclaim control over your digital life.

The choice is yours: a few minutes of prevention today, or potentially months of recovery tomorrow. Choose wisely.

Your phone number is a convenience, not a credential. Protect it accordingly.