SIM swap attacks, explained

How does a SIM swap work?

A phone number belongs to an account at the carrier, not to a piece of plastic. A SIM swap exploits the process carriers use to move a number to a new SIM or eSIM, for example when a customer loses their phone. The attacker gets the carrier to do that move for them, using one of three routes:

• Social engineering: calling or visiting a store while impersonating the customer, often with personal details from data breaches.
• Insiders: paying a carrier or retail employee to make the change.
• Account takeover: logging into the customer’s carrier account online with stolen credentials.

Once the number moves, the victim’s phone loses service and the attacker’s device starts receiving their calls and texts.

Why is it so damaging?

Phone numbers became the default recovery and verification channel for email, banking and crypto accounts. An attacker holding the number can request password resets and receive the one-time passcodes that confirm them. That is why SIM swaps often end in drained bank or crypto accounts within hours.

What are carriers now required to do?

In November 2023 the FCC adopted rules requiring US wireless carriers to use secure methods to authenticate a customer before moving their number to a new device or provider, to notify customers promptly of SIM change and port-out requests, and to offer account locks.^[1] See Tradecraft’s explainer on the FCC’s SIM-swap rules.

How can banks and apps defend against it?

• Stop treating an SMS code as proof of identity for high-risk actions like password resets or adding a payee.
• Check for recent SIM changes before trusting the number. Carrier network APIs can report whether a number’s SIM changed recently.
• Offer phishing-resistant options such as passkeys, so the phone number isn’t the key to the account.