What Is SIM Swapping? How to Protect Your Phone Number

What is SIM swapping? It is a scam in which a criminal convinces or pays someone at your wireless carrier to transfer your phone number to a SIM card in the criminal’s possession. From that moment, your calls and text messages go to the criminal’s phone instead of yours. Because so many accounts send login codes and password reset links by text, a stolen number can quickly become a stolen bank, email or cryptocurrency account.

This guide explains how SIM swapping works, how it differs from a related scam called port-out fraud, the warning signs to watch for and the steps federal agencies recommend to protect your number. It draws on guidance from the Federal Trade Commission (FTC), the FBI and the Federal Communications Commission (FCC).

What is a SIM, and what does “swapping” mean?

SIM stands for Subscriber Identity Module. It links your wireless service and phone number to the phone you carry. Moving service to a new SIM is a legitimate request, for example when a phone is lost or damaged, which is exactly the story the FTC says scammers tell carriers.

The scam abuses that legitimate process. The FCC describes SIM swapping as what happens when “a bad actor convinces a victim’s wireless carrier to transfer the victim’s service from the victim’s cell phone to a cell phone in the bad actor’s possession.” The FCC notes that these scammers take over accounts “without ever gaining physical control of a consumer’s phone.”

How does a SIM swap scam work?

According to the FBI, criminals mainly use three techniques to get a carrier to move a victim’s number:

• Social engineering. The criminal impersonates the victim and tricks the carrier into switching the number to a SIM card the criminal holds. The FTC gives a typical script: the scammer calls the carrier, says the phone was lost or damaged, and asks the carrier to activate a new SIM on a new phone.
• Insider threat. The criminal pays off a carrier employee to make the switch.
• Phishing. The criminal tricks carrier employees into downloading malware that is then used to break into carrier systems that carry out SIM swaps.

To pass a carrier’s identity checks, criminals often rely on personal details they have already gathered. The FTC warns that a thief who finds your full name, address or phone number on public sites could use that information to answer security questions. That is one reason SIM swapping often follows other scams, such as a phishing text or a data breach. Our guide on recognizing phishing emails and texts covers those first-stage tricks.

What can a criminal do with your phone number?

Once the swap goes through, the FBI says, the victim’s calls, texts and other data are diverted to the criminal’s device. The criminal can then use “Forgot Password” or “Account Recovery” options on the victim’s email and other online accounts linked to that number. When those services send a one-time code or reset link by text, it lands on the criminal’s phone. The criminal enters the code, resets the password and takes control of the account.

The FTC lists the kinds of damage that can follow. A scammer with your number could:

• Log in to accounts that use text messages as a second login step
• Get into your bank account and steal money
• Take over your email or social media accounts and change the passwords to lock you out
• Open new cellular accounts in your name or buy new phones using your information

How common is SIM swapping?

The most detailed federal figures come from a February 2022 public service announcement by the FBI’s Internet Crime Complaint Center (IC3). The FBI’s SIM swap warning reported that IC3 received 320 complaints related to SIM swapping from January 2018 to December 2020, with adjusted losses of about $12 million. In 2021 alone, it received 1,611 SIM swapping complaints, with adjusted losses of more than $68 million.

Those numbers count only incidents that victims reported to IC3, so they are a floor rather than a full picture. They do show how quickly the scheme grew: in one year, complaints were roughly five times the total for the previous three years combined.

SIM swapping vs. port-out fraud

Port-out fraud reaches the same goal by a different route. In a SIM swap, the criminal stays with your current carrier and moves your number to a new SIM. In port-out fraud, the FCC explains, the criminal, posing as you, opens an account with a different carrier and then arranges for your number to be transferred, or “ported out,” to that new account.

Warning signs your number may have been hijacked

The FTC points to two main red flags:

• Your phone suddenly stops working, with no data, no text messages and no calls.
• You get an unexpected notification from your carrier that your SIM card has been activated on a new device.

The FBI also advises people to be aware of any changes in text message connectivity. Any of these signs deserves a fast response, because the FTC notes that criminals can collect your text codes before you realize your number is gone.

How to protect yourself from SIM swapping

The FTC and FBI recommend several habits that make the scam much harder to pull off.

Lock down your wireless account

Set up a PIN or password on your cellular account. The FTC says this can help protect your account from unauthorized changes and suggests checking your carrier’s website for how to do it. Keep that PIN private. The FBI warns against giving your account information to anyone who calls asking for your password or PIN. If a caller claims to be from your carrier, hang up and call the customer service number you already know.

Move away from text message codes

Text message codes are better than no second step at all, according to the FTC, but they are the method a SIM swap defeats. In its two-factor authentication guidance, the FTC says an authenticator app is safer because its codes are not exposed to a SIM card swap, and it calls security keys the strongest option because they do not use credentials that hackers can steal. The FBI similarly recommends strong methods such as biometrics, physical security tokens or standalone authentication apps. Start with your most sensitive accounts: bank, credit cards, email, social media, tax filing and payment apps. Our explainer on how password managers work covers strong, unique passwords, which the FBI also recommends.

Share less about yourself

Limit the personal information you post online, including your full name, address and phone number, the FTC advises. The FBI adds a specific warning: do not advertise information about financial assets, including cryptocurrency holdings, on social media or forums.

Treat unexpected requests with suspicion

Do not reply to calls, emails or texts that ask for personal information. Contact the company directly using a phone number or website you know is real. The FTC also warns never to share a verification code with someone if you did not contact them first, no matter what story they tell.

What to do if you are a SIM swap victim

Speed matters. Both the FTC and the FBI lay out a similar recovery plan:

1. Call your carrier right away to take back control of your phone number.
2. Change your passwords once you have your number back.
3. Check your accounts for unauthorized charges or changes and report any to the bank or company. The FBI suggests asking financial institutions to place an alert on your accounts for suspicious logins and transactions.
4. Report the crime to the FBI’s Internet Crime Complaint Center at ic3.gov and to local law enforcement.
5. Visit IdentityTheft.gov if you think the scammer has your Social Security, credit card or bank account number. The FTC site gives step-by-step recovery plans.

If your personal details were exposed, you can also block new credit accounts in your name. Our guide on placing a credit freeze walks through that process with the three credit bureaus.

What wireless carriers are required to do

On Nov. 15, 2023, the FCC adopted new rules to protect cell phone accounts aimed at SIM swapping and port-out fraud. The rules revised the agency’s Customer Proprietary Network Information (CPNI) and Local Number Portability rules. According to the FCC, they require wireless providers to adopt secure methods of authenticating a customer before redirecting a phone number to a new device or provider, to immediately notify customers whenever a SIM change or port-out request is made on their accounts, and to take additional steps to protect customers from these scams.

The FCC described the rules as baseline requirements and warned that data breaches can raise the risk of these scams by exposing information that makes it easier to steal a cell phone account.

For ongoing coverage of major U.S. stories, including large scams and data breaches, follow the LiveNewsWorld U.S. News Live center.

The bottom line

SIM swapping turns your phone number into a master key for your online life. A criminal who persuades or pays someone at a carrier to move your number can receive your text codes and reset your passwords without ever touching your phone. The best defenses are simple: put a PIN on your wireless account, switch your most important logins from text codes to an authenticator app or security key, share less personal information online and act within minutes if your phone loses service without explanation.

Sources

• FBI Internet Crime Complaint Center, Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public (PSA I-020822-PSA, Feb. 8, 2022)
• Federal Communications Commission, FCC Adopts Rules to Protect Consumers’ Cell Phone Accounts (news release, Nov. 15, 2023, FCC 23-95, WC Docket No. 21-341)
• Federal Trade Commission, SIM Swap Scams: How to Protect Yourself (consumer alert, Oct. 23, 2019, consumer.ftc.gov)
• Federal Trade Commission, Use Two-Factor Authentication To Protect Your Accounts (consumer advice, consumer.ftc.gov)