SIM Swapping - How Attackers Hijack Phone Numbers

About 2 min read

SIM swapping is an attack technique in which an attacker impersonates a victim to a mobile carrier and, by getting a SIM card reissued or a number ported, hijacks the victim's phone number. The attacker intercepts the two-factor authentication codes sent via SMS and illicitly manipulates bank accounts or cryptocurrency exchange accounts. In 2024, the FCC enacted new rules to counter SIM swapping, requiring mobile carriers to implement additional authentication.

Real-World Use Cases

The first sign is usually that your phone suddenly loses all signal. If service does not come back after a few minutes, or you see a message that the SIM has been deactivated, suspect that the line itself has been taken over rather than a network outage. Attackers collect details such as your date of birth and address in advance so they can pass identity checks, and once they get a SIM reissued at a store or call center, every subsequent SMS code goes to their device. There is a right order to responding. First, use a different line (a family member's phone, or a calling app over Wi-Fi) to contact your mobile carrier and confirm whether the line was suspended and reissued. Then change the passwords for accounts that depend on SMS codes - crypto exchanges and online banks above all - and revoke active sessions. Reversing that order means the password reset SMS lands in the attacker's hands.

The SIM Swap Flow

Historical Background

SIM swapping grew from around 2018 alongside the spread of cryptocurrency. In the United States, an incident in 2019 in which the account of Twitter's chief executive was hijacked through SIM swapping drew widespread public attention. According to a public service announcement issued in February 2022 by the FBI's Internet Crime Complaint Center (IC3), it received 320 SIM swapping complaints with adjusted losses of about 12 million dollars over the three years from January 2018 to December 2020, whereas in 2021 alone it received 1,611 complaints with adjusted losses of more than 68 million dollars. In Japan, too, cases exploiting fraudulent mobile number portability (MNP) have been reported.

Defense Methods

The most important countermeasure is to migrate from SMS-based two-factor authentication to a TOTP app (Google Authenticator, Authy) or a passkey. SMS authentication is vulnerable to SIM swapping, and NIST does not recommend using it. It is also effective to set a PIN code or passphrase with the mobile carrier so that a SIM reissue requires additional authentication. By protecting your mobile carrier's online account with a unique, strong password for each service and strengthening your smartphone lock, you can greatly reduce the risk of SIM swapping.