The attack begins with a phone call to your mobile operator, made by someone who is not you. Armed with personal details harvested from breaches and social media, the caller convinces — or bribes, or simply finds a careless agent — the carrier to move your number to a SIM they control. Your phone goes dead. Their phone lights up with your calls and, far more valuable, your text messages: the one-time codes that banks, email providers and exchanges send to prove it is really you. Within the hour, passwords are reset and accounts are emptied.
SIM-swap fraud has victimised executives, celebrities and thousands of ordinary savers, and consumer agencies including the US Federal Communications Commission have tightened rules requiring carriers to verify identity more rigorously before porting numbers. The uncomfortable truth is that SMS was never designed as a security channel; it became one by accident, because everyone had a phone. Every account that treats your number as proof of identity inherits the security of a call-centre conversation.
The Defences That Actually Work
The strongest single step is to move important accounts off text-message codes onto authenticator apps or hardware security keys, which are tied to a device rather than a number. Next, set every protection your carrier offers: account PINs and port-out freezes exist at most major operators but are rarely on by default — consumer guidance from the Federal Trade Commission walks through enabling them. Use a private, non-public email address for financial accounts, since email is the master key that resets everything else, and treat unexpected “no service” on your phone as a fire alarm: if your number dies without explanation, call your bank first and your carrier second. More protective guides are collected in our security section.
Why It Persists
The Insider Problem
A fraction of SIM-swap cases never involve persuasion at all: they involve employees. Investigations in several countries have uncovered carrier staff and contractors paid by criminal groups to execute swaps from inside the system, defeating every script-based verification the call centre can run. That reality is reshaping carrier security from the inside — swaps increasingly require in-person identification or hardware-verified account access, employee actions on high-risk accounts are logged and audited, and some operators have removed the ability of retail staff to perform swaps entirely. For customers, the lesson reinforces the article’s core advice: any defence that ultimately depends on a carrier employee saying no is a defence with a price on its failure. The protections that hold are the ones the criminal cannot talk his way past — cryptographic authenticators, hardware keys and accounts that treat the phone number as a contact detail rather than a key.
The recovery window is where the money is saved or lost. Banks and exchanges that monitor for the classic post-swap sequence — password reset, new device, withdrawal — can freeze the pattern in minutes, and the institutions with the best loss figures are those that treat a SIM change as a risk event in itself, imposing cooling-off periods on sensitive actions for a day or two after any number change. Customers can create the same friction deliberately: withdrawal allowlists, delayed transfers to new payees, and a standing instruction that large movements require a voice call to a known number. Friction, so long the enemy of good design, is the victim’s best friend — every hour of delay is an hour in which the fraud can be noticed, reported and unwound.
SIM swapping survives because it exploits the seam between institutions: the carrier controls the number, the bank trusts the number, and neither owns the whole risk. Regulation is narrowing the seam, and banks are slowly demoting SMS. Until they finish, the defence is the layered one above — cheap, unglamorous and, unlike a phone number, actually under your control. An hour of setup is a poor trade for an emptied account only if you make it before the attack, which is rather the point.