Field guideNo. 02
SIM swap incident response: the first hour and the first week
When a customer’s phone number is hijacked, every account that trusts it is exposed. A response playbook for fraud and security teams: signals, containment, recovery and the fix that stops a repeat.
The short answer
How should a bank respond to a suspected SIM swap?
Treat the account as compromised until proven otherwise: stop trusting the phone number, revoke sessions, hold new payees and contact-detail changes, and reach the customer through a channel that isn’t the hijacked number. Then help them reclaim the number from their carrier, review everything that changed during the exposure window, and re-enroll them with a method that doesn’t depend on SMS.
If you read nothing else
- A SIM swap moves the number, not the phone: the attacker receives the victim’s texts and calls.
- Contain first: stop trusting SMS for this customer before you investigate.
- Don’t verify the customer over the phone number that was just hijacked.
- US carriers must now authenticate before a SIM change or port-out, notify the customer and offer account locks.
What you are responding to
A phone number belongs to an account at the carrier, not to a piece of plastic. In a SIM swap, a criminal gets the carrier to move a victim’s number to a SIM or eSIM they control, by impersonating the customer, paying an insider, or logging into the customer’s carrier account.[5] From then on, the victim’s calls and texts, including one-time passcodes and password-reset links, go to the attacker.
That is why the damage lands on you, not only on the carrier. Any account that trusts an SMS code, or lets a customer recover access by text, is exposed from the moment the number moves.
Step 1 Recognize the signals
| Signal | What it may mean | First move |
|---|---|---|
| Customer reports their phone suddenly lost service in normal coverage | Their number may have been moved | Treat the account as compromised until verified |
| Password reset by SMS soon after a SIM change | Attacker using the hijacked number | Block the reset and verify outside SMS |
| New-device sign-in, then a contact-detail change or new payee | Takeover moving to cash-out | Hold payments and changes |
| New-device sign-in while the customer is on an inbound call | Code relay by a bot or caller | Hold and contact the customer in-app |
Carrier network APIs can tell you whether a number’s SIM changed recently. The CAMARA project defines a common SIM Swap API that operators can expose.[4] If you can query it, query it before trusting the number for anything high-risk.
Step 2 Contain the account
Containment comes before investigation. For the affected customer:
- Stop trusting the phone number: suspend SMS and voice codes and SMS-based recovery for this account.
- Revoke active sessions and remembered devices added recently.
- Hold outbound payments and new payees pending verification. [YOUR POLICY: hold scope and length]
- Freeze contact-detail changes, so the attacker can’t swap in their own email or number.
Step 3 Reach the customer on a channel the attacker doesn’t hold
The number is the compromised thing, so don’t call or text it to verify the customer. Use a channel the attacker is unlikely to control: the bank’s app on a device already registered to the customer, a verified email address you have reason to trust, or an in-branch check. [YOUR PROCESS: approved out-of-band channels]
Tell the customer plainly what you’ve seen, what you’ve paused, and that the bank will never ask them for a code.
Step 4 Help the customer get the number back
The customer has to reclaim the number from their carrier. In the US, the FCC’s 2023 order requires wireless carriers to authenticate customers securely before a SIM change or port-out, to have procedures for failed authentication attempts, to notify customers of SIM change and port-out requests, and to offer account locks.[1][2]
- Point the customer to their carrier’s fraud line and ask them to turn on a port-out PIN or account lock once they have the number back.
- Ask for the time of the SIM change if the carrier will share it. It defines your exposure window.
- Check the current compliance status before citing it: the FCC waived the original July 2024 compliance date while the rules went through federal review.[3]
Step 5 Recover the account and review the exposure window
- Set the window from the SIM change (from the carrier or a SIM Swap API) to the moment you contained the account.
- Review every change in that window: payees, contact details, devices, credentials, payments and card activity.
- Reverse or recall what you can, following [YOUR PROCESS: payment recall and reimbursement].
- Re-enroll the customer with a method that doesn’t depend on the phone number, such as a passkey.
- Meet your reporting duties. [CHECK: suspicious-activity and incident reporting obligations in your jurisdiction]
Step 6 Close the gap that let it work
A SIM swap only pays if a phone number is treated as proof of identity. After the incident, fix the pattern, not only the account:
- Remove SMS as the only factor for recovery and new-payee setup.
- Add a SIM-change check to the risk engine before trusting a number.
- Offer passkeys so the number stops being the key to the account. See our passkey rollout field guide.
Who owns this
| Activity | Fraud ops | Security eng. | IAM eng. | Support | Compliance | Product |
|---|---|---|---|---|---|---|
| Detection rules and signals | A/R | R | C | I | I | C |
| Containment | A/R | C | R | C | I | I |
| Customer contact and verification | A | I | C | R | C | C |
| Exposure-window review | A/R | R | C | I | C | I |
| Regulatory reporting | C | I | I | I | A/R | I |
| Closing the gap | C | R | R | I | C | A |
What to tell the customer
- Their number may have been moved to another SIM, and you have paused risky activity to protect them.
- They should contact their carrier to reclaim the number and turn on an account lock or port-out PIN.
- You will never ask them for a one-time code by phone or text.
- What you have reversed, what you are investigating, and when you will update them.
Questions readers ask
How do I know if I’ve been SIM swapped?
The most common sign is that your phone suddenly loses service and can’t make calls or send texts, while you are somewhere with normal coverage.
Does an eSIM prevent SIM swapping?
No. The attack targets the carrier’s process for moving a number, and an eSIM profile can be moved just as a physical SIM can.
Does a carrier account PIN help?
Yes. A port-out PIN or account lock makes it harder for someone to move your number, though it doesn’t protect against an insider at the carrier.
Should the bank call the customer to verify them?
Not on the number that may have been hijacked. Use a channel the attacker is unlikely to control, such as the bank’s app on a device already registered, or an in-person check.
Sources
- Federal Register Protecting Consumers from SIM Swap and Port-Out Fraud (2023-12-08)
- FCC Report and Order FCC 23-95
- FCC Order on compliance date (DA 24-649)
- Linux Foundation CAMARA project
- KrebsOnSecurity SIM Swapping (category)
Changelog
- : First edition, assembled from Tradecraft’s sourced explainers. Awaiting editorial verification.
Cite this
Tradecraft. “SIM swap incident response: the first hour and the first week.” Tradecraft, September 24, 2026. https://glide-tradecraft.pages.dev/field-guides/sim-swap-incident-response/
Read next
Explainer
SIM swap attacks, explained
A criminal persuades, tricks or bribes a mobile carrier into moving a victim’s phone number to a SIM they control. From then on the victim’s calls and texts, including one-time passcodes, go to the attacker.
Explainer
The FCC’s SIM-swap rules: what carriers now have to do
The FCC’s 2023 order (FCC 23-95) requires US wireless carriers to authenticate customers securely before moving their number to a new SIM or provider, to notify customers of SIM change and port-out requests, and to offer account locks. It does not regulate how banks or apps use SMS codes.
Buyer’s guide
SIM swap detection: a buyer’s guide
The most direct signal comes from the mobile operator: a SIM swap check reports whether the SIM tied to a number changed recently, and number verification confirms a request comes from that SIM. The CAMARA project standardizes both APIs. Banks combine them with their own device and session signals, and use them before trusting a number for recovery, new payees or high-risk payments.
Take the checklist
Checklist
SIM swap: the first hour
Containment and verification steps when a customer’s number may have been hijacked.