SIM Swap Attack
How a SIM swap attack takes over your phone number
A SIM swap attack happens when someone convinces your mobile provider to assign your current phone number to a SIM card they already own. This SIM is a small chip that connects your phone to the network and identifies the number as yours. When the switch is made, all calls and text messages meant for you, including one-time passwords from banks or exchanges, go straight to the attacker instead.
Most attackers combine this trick with passwords picked up from data breaches or phishing. They try to log into your bank or exchange account and trigger a text code, knowing it will now reach them. The process often uses social engineering (where someone manipulates a person or staff member into giving away useful details). For more on phishing, see how to recognise phishing about money.
Warning signs your SIM may have been swapped
- Your phone unexpectedly says “no service”, “SOS only”, or that your SIM is unregistered, even though you usually get a signal where you are.
- You get texts or emails from your mobile provider about a SIM change or number transfer you never asked for.
- You can't log into some accounts, or you receive password reset codes and emails that you haven't requested.
- Your bank, exchange, or wallet service gets in touch about a new device or a transfer you know nothing about.
If you see signs like these, don't wait. Contact your mobile provider using another device and have them freeze any changes right away. Notify your bank and any exchange or crypto wallet provider immediately, and take the actions listed in what to do if you have been scammed.
How to prevent a SIM swap attack
- Ask your mobile provider to set a security PIN or porting password on your account. Keep this code different from any banking or commonly used passwords.
- Don't depend on text messages alone for logging in to your financial services. If your bank or exchange offers them, use an authenticator app, passkey or a hardware security key. See more details in the guide to two-factor authentication methods.
- Limit posting your phone number and personal info in public places, as attackers may harvest it to answer security questions or impersonate you.
- If you get an unexpected call or message asking to confirm any personal info (even if it seems to come from the real carrier), treat it with caution and don't give out details without checking first.
Frequently asked questions
Can a SIM swap happen without someone stealing my phone?
Yes, SIM swaps can happen without anyone taking your actual phone. Criminals often use stolen personal details, phishing or they pressure mobile provider staff to transfer your number. That’s why setting a PIN on your mobile account and using logins that don’t depend on text messages are important, even if your phone never leaves your pocket.
Is SMS two-factor authentication still safe?
SMS two-factor authentication is safer than nothing, but it’s still considered the weakest common method. SIM swaps let attackers intercept these codes. For anything involving money, it’s wise to use an authenticator app, passkey or hardware key if you can. Check what your provider offers and switch if possible.