Glossary
SIM swapping (also called SIM hijacking or a port-out scam) is an attack in which a fraudster transfers a victim’s phone number to a SIM card they control (usually by social-engineering the mobile carrier) so they can intercept SMS messages, one-time codes, and calls meant for the victim. It’s the reason SMS-based authentication is considered weak for high-value accounts.
Once an attacker controls your phone number, they control the SMS codes and password-reset links sent to it, which for many accounts is the key to the kingdom.
The attacker gathers personal information about the victim (often from data breaches or social engineering), then contacts the mobile carrier posing as the victim, claiming a lost or damaged phone, and requests that the number be moved to a new SIM in their possession. If the carrier’s identity checks are weak (and they often rely on knowledge-based questions the attacker can answer from breached data) the number is ported. The victim’s phone loses service, and the attacker begins receiving their calls and texts, including authentication codes.
Countless services use SMS one-time passwords as a second factor or for account recovery. SIM swapping turns that convenience into a vulnerability: the attacker who controls the number receives those codes, resets passwords, and takes over accounts (email, banking, crypto, social media) in cascade. Because the codes arrive legitimately at the (now attacker-controlled) number, the receiving service sees nothing wrong. This is the core reason SMS OTP is discouraged for protecting high-value accounts and recovery flows.
SIM-swap victims can lose access to their accounts and funds rapidly, and crypto and banking accounts have been drained in high-profile cases. Warning signs include sudden loss of cell service for no reason, unexpected "SIM changed" or account-activity notifications, and being locked out of accounts. Because the attack cascades quickly, the window to react is short.
The most effective defense is not depending on the phone number as an authentication anchor. Phishing-resistant, possession-based methods (passkeys/FIDO2) aren’t affected by SIM swaps because there’s no SMS code to intercept. Where SMS can’t be fully removed, layering device intelligence and risk signals helps, a code arriving on a freshly ported SIM, or a login from a new device right after a SIM change, is a strong risk indicator. Carriers also offer port-out protection (PINs and locks) that customers should enable. For businesses, the lesson is clear: don’t let SMS be the sole guard on high-value actions or account recovery.
What is SIM swapping?
An attack that transfers a victim’s phone number to the attacker’s SIM to intercept SMS codes and calls, enabling account takeover.
How does SIM swapping work?
The attacker social-engineers the carrier into porting the victim’s number to a new SIM, often using breached personal data to pass checks.
Why does SIM swapping defeat MFA?
It intercepts SMS one-time codes and reset links, which many accounts rely on for authentication and recovery.
How do you protect against SIM swapping?
Use phishing-resistant methods like passkeys instead of SMS, enable carrier port-out protection, and layer device/risk signals.
What are the warning signs of a SIM swap?
Sudden loss of cell service, unexpected SIM-change or account-activity alerts, and being locked out of accounts.
Related: SMS OTP / SMS 2FA · Account Takeover (ATO) · Multi-Factor Authentication (MFA) · Passkeys · Social Engineering
