SIM Swap

SIM Swap

A SIM swap (also called a “port-out” or “SIM hijack”) is when an attacker convinces your mobile carrier to transfer your phone number to a SIM card or eSIM they control. Once they have your number, they receive all your SMS, voice calls, and — critically — every SMS-based 2FA code, password-reset link, and bank verification call. Within minutes they can reset email, banking, crypto, and social accounts that rely on phone-number recovery.

High-impact, fast-moving attack

A SIM swap typically takes 2–10 minutes from port to first account compromise. The attacker has prepared the credential reset workflow in advance and is automating against multiple services in parallel. If you suspect a swap is in progress, call your carrier’s fraud line immediately — even a 5-minute delay can mean total account loss.

At a glance

Field	Value
Vector	Social engineering of mobile carrier customer service, or insider abuse at the carrier
Target	Anyone whose phone number protects valuable accounts — crypto holders, executives, journalists, OSINT researchers, activists, journalists’ sources
Adversary types	Criminal crews (crypto theft, banking fraud), nation-state actors (espionage), targeted-harassment groups (doxxing, swatting prep)
Prerequisite	Knowledge of your phone number, name, and usually a piece of identity info (DOB, address, last-4 SSN — all of which are typically in data broker records)
Detection lag	Near-zero — your phone loses service within seconds — but exploitation lag is also near-zero.

How it works

flowchart TD
    A[Attacker collects target's<br/>name, phone, DOB, last-4 SSN<br/>from data brokers + breaches] --> B[Calls carrier or visits store]
    B --> C{Pretext}
    C -->|"Lost my phone,<br/>need to activate new one"| D[Carrier rep ports number<br/>to attacker's SIM/eSIM]
    C -->|Insider at carrier<br/>paid to port| D
    D --> E[Victim's phone loses<br/>cellular service immediately]
    E --> F[Attacker resets passwords<br/>via SMS codes<br/>across email, banking,<br/>crypto, social accounts]
    F --> G[Drain funds, exfiltrate data,<br/>impersonate, sell access]
    style G fill:#fee,stroke:#900,stroke-width:2px

The attack works because mobile carriers use weak identity verification at scale. Customer service reps are trained to be helpful and resolve “lost phone” calls quickly. Insider abuse is also a recurring problem — multiple investigations have documented carrier employees paid to perform swaps.

Indicators of compromise

In approximate order of how the attack unfolds:

1. Sudden loss of cellular service (“No SIM,” “SOS only,” or “Searching…”) with no obvious cause. WiFi may still work — this is the key tell.
2. Texts/emails from your carrier about a port-out, SIM activation, or “welcome to a new line” — even if you didn’t request anything.
3. Texts/emails from services saying your password was changed, MFA device was reset, or login from a new device.
4. You can’t log into your own accounts — passwords don’t work because they were just changed.
5. Contacts report receiving texts or calls from your number that you didn’t send.
6. Friends/family receive messages asking them to send money, click links, or share codes — purportedly from you.

Prevention

In priority order. The first three are the highest-impact:

1. Move every important account off SMS-2FA

This is the single most important defense. SMS is broken as a security factor — phishing, SIM swap, and SS7 interception all defeat it. Replace SMS-2FA with:

• Passkeys wherever supported (banking, Google, Microsoft, Apple, GitHub). See MFA & Passkeys.
• Hardware security keys (YubiKey, Titan) — phishing-resistant FIDO2.
• Authenticator app TOTP (Aegis on Android, Raivo/Tofu on iOS, 1Password/Bitwarden built-in). Better than SMS, but still phishable.

Keep SMS-2FA only on accounts where it’s the only option, and prefer to delete those accounts.

2. Set a port-out PIN with your carrier

Every major US carrier supports an extra port protection PIN / Number Transfer PIN that’s required before the number can move. It is separate from your account PIN and must be requested explicitly.

• Verizon: My Verizon → Account → Number Lock OR call *611
• AT&T: Wireless passcode + Account passcode (set both); also enable “Account Lock”
• T-Mobile: T-Mobile app → Profile → Account Settings → enable Port-Out Protection (also called “NOPORT”)
• Google Fi: Account → Security → Enable Number Transfer PIN
• MVNOs (Mint, US Mobile, Visible, etc.): Check the specific carrier’s account settings; some inherit from their parent network

Verify periodically that the protection is still active — carrier UIs and policies change.

3. Use an eSIM and disable physical-SIM transfers

eSIMs are bound to your device’s secure element and are significantly harder to swap fraudulently. Some carriers (T-Mobile, Verizon) let you disable physical-SIM transfers entirely if you’re on eSIM. Do this if available.

4. Decouple recovery from your phone number

Audit every account’s “account recovery” / “forgot password” settings:

• Remove your phone number as a recovery option where you can
• Replace with a hardware-key-protected recovery email account (e.g., a dedicated email with passkey-only login)
• For services that require a phone number on file, consider using a VoIP number (Google Voice, MySudo) that isn’t tied to your carrier — VoIP numbers can’t be SIM-swapped
• See MFA & Passkeys for recovery-flow hardening

5. Minimize your public phone-number exposure

The attacker needs your number plus some identity scraps. Reduce what’s available:

• Run the data removal & opt-out process to scrub broker records
• Don’t post your real number on social media, GitHub, conference badges, or open OSINT-visible places
• Consider a dual-number setup: your real carrier number for SMS-only-as-last-resort, and a VoIP number for everything else

6. Carrier account hardening

• Use a long, unique account password
• Set a strong, non-guessable account PIN (not a birthday, not the last 4 of your SSN)
• Enable any “alert me on changes” features (Verizon’s Account Activity alerts, T-Mobile’s Account Takeover Protection)
• Keep your contact email on the carrier account different from your “high-value” personal email

If you’re hit

Move in this order. Don’t stop to investigate — that comes later.

Minute 0–5

1. Call your carrier’s fraud line from a different phone (landline, partner’s phone, VoIP). Ask them to:
   • Reverse the port
   • Lock the account
   • Note the incident in the account file
2. From a trusted device (not the swapped phone): log into your email first — it’s the recovery path for everything else. Change the password and MFA. Revoke all sessions.
3. Then your password manager / authenticator app — if those are compromised, every secret is exposed.

Minute 5–60

4. Log into financial accounts (banking, brokerage, crypto exchanges). Change passwords, revoke sessions, freeze withdrawals if possible.
5. Check transaction history. Anything you didn’t authorize? Report immediately — most banks have a short window for fraud reversal.
6. Log into social accounts. Change passwords. Revoke OAuth grants. Check for messages sent by the attacker.
7. Notify your contacts via a different channel — attackers often impersonate the victim to extract money or codes from friends and family during the window.

Hour 1+

8. Run the Cyber Incident Response Guide in full.
9. Report:
   • IC3.gov — federal SIM-swap investigations
   • Your carrier’s fraud team (file the case number)
   • Your bank’s fraud team for any unauthorized transactions
   • FTC identity theft — initiates federal recovery
   • Local police — needed for some insurance and fraud-reversal processes
10. Credit freeze at all three bureaus (Equifax, Experian, TransUnion). Free, takes ~10 minutes, prevents new-account fraud as the attack expands.
11. Re-audit every account for unauthorized changes (added recovery emails, forwarding rules, OAuth grants).
12. Once you have your number back, set the port-out PIN immediately — attackers re-target swap victims.

Detection / purple team

If you’re securing a team or family:

• Tabletop exercise: walk a willing participant through “your phone just lost service — what do you do?” Measure time-to-first-correct-action. Most people freeze.
• Audit the recovery configuration of every team member’s critical accounts quarterly. Phone numbers should be removed from recovery flows where possible.
• Carrier compliance: confirm everyone on a managed plan has the carrier port-protection PIN enabled.
• Detection signals: many organizations can integrate carrier-side fraud alerts; for high-value individuals, dedicated SIM-swap monitoring services exist (Efani, Pradeo, T-Mobile Premium Plan’s “Account Takeover Protection”).

MITRE ATT&CK mapping

Technique	Description	This attack
T1451 SIM Card Swap	Mobile-specific technique entry	The core technique
T1078 Valid Accounts	Use of compromised credentials	Post-swap account takeover
T1556.006 MFA: Multi-Factor Authentication	Subverting MFA	SMS-2FA becomes attacker-controlled
T1589.001 Gather Victim Identity: Credentials	Identity recon	Data broker / breach data used to social-engineer carrier

Sources

• FBI — SIM Swapping
• CISA — Mobile Communications Best Practice Guidance
• NIST SP 800-63B — Restrictions on Out-of-Band Authentication — SMS deprecation rationale
• Krebs on Security — SIM Swapping Coverage — long-running investigative reporting on the criminal ecosystem
• FCC — Protect Yourself from SIM Swap Scams

Related

• Account Takeover Catalog
• Signal/CMA Account Takeover (RIS) — adjacent pattern using verification codes
• MFA & Passkeys — phishing- and SIM-swap-resistant authentication
• Data Removal & Opt-Out — reduce attacker’s identity-recon surface
• Cyber Incident Response Guide — full response playbook
• Phishing — Defender’s Guide