A SIM swap transfers your mobile number to a device controlled by someone else. Because so many services still use SMS for verification and account recovery, control of the number frequently means control of email, banking, and anything that resets through them.

How it is done

The attacker contacts your carrier posing as you, using personal details gathered from breaches, social media, or earlier phishing. They request a transfer to a new SIM, citing a lost or damaged phone. Where social engineering fails, insider assistance at a retail outlet is a documented alternative. Once the port completes, your device loses service and theirs receives your calls and messages.

The warning signs

  • Sudden and unexplained loss of mobile service, especially if others nearby have signal.
  • Notifications about a SIM or device change you did not request.
  • Password reset emails you did not initiate.
  • Being unable to log into accounts with credentials you know are correct.

What to do in the first ten minutes

Speed is decisive. From another phone, call your carrier and report an unauthorised port, asking them to reverse it and lock the account. Then call your bank's fraud line. Then, from a clean device, change your email password and revoke sessions. Every minute counts, because the attacker is working through your accounts in the same window.

Prevention, which is straightforward

  • Add a port-out PIN or account passcode with your carrier and ask what verification is required for a SIM change.
  • Move critical accounts off SMS verification to an authenticator app, or preferably a passkey or hardware key.
  • Remove your phone number as a recovery method where the service allows an alternative.
  • Reduce what is publicly available about you — date of birth, address history, and mother's maiden name are all standard verification questions.

Why this matters more for some people

Attackers select targets who hold cryptocurrency, have public profiles, or work in finance and technology. If you hold significant digital assets, assume you are a target, keep them on hardware wallets, and ensure no exchange account relies on SMS for recovery.