Fact-checked by the SnapMessages editorial team
Imagine waking up to find your phone has no signal — and within minutes, your bank account is drained, your email is locked, and a stranger is impersonating you online. This is not a hypothetical. SIM swap attack prevention is now a critical concern for anyone who uses a phone number for two-factor authentication, which, in 2024, is nearly everyone. The FBI’s Internet Crime Complaint Center reported that SIM swapping cost Americans over $68 million in a single year, a figure that likely undercounts actual losses due to underreporting.
The scale of the problem is staggering. Between 2018 and 2021, the FBI documented a 1,000% increase in SIM swap complaints, with losses jumping from $1.8 million to over $68 million in just three years. High-profile victims include cryptocurrency investors, corporate executives, and even teenagers who lost their entire savings. Telecom carriers — AT&T, T-Mobile, Verizon — have all faced lawsuits from customers victimized on their networks. The attack is devastatingly simple: a criminal calls your carrier, pretends to be you, and convinces a representative to transfer your number to a SIM card they control.
This guide gives you a complete, actionable roadmap. You will learn exactly how SIM swap attacks work, which account types are most vulnerable, and — most importantly — the specific steps you can take today to lock down your phone number and your accounts. No vague advice. No filler. Just the precise countermeasures that security professionals actually use.
Key Takeaways
- SIM swap attacks cost Americans over $68 million in 2021 alone — a 1,000% increase from 2018 figures reported to the FBI.
- Attackers typically complete a successful SIM swap in under 7 minutes using stolen personal data purchased for as little as $10 on dark web markets.
- Cryptocurrency holders are the primary target — some individual victims have reported losses exceeding $1 million in a single attack.
- SMS-based two-factor authentication (2FA) is the #1 vulnerability exploited in SIM swap attacks — switching to an authenticator app reduces your risk by over 90%.
- Only 38% of major U.S. telecom carriers offered robust SIM lock features as of 2023 — and most users have never activated them.
- Setting a carrier PIN and enabling a port freeze can block the vast majority of SIM swap attempts before they ever reach a carrier representative.
In This Guide
- What Is a SIM Swap Attack?
- How Attackers Gather Your Personal Data
- The Attack in Real Time: A Step-by-Step Breakdown
- Who Is Most at Risk?
- Why SMS-Based 2FA Fails Against SIM Swapping
- Carrier-Level Defenses You Must Activate
- Account-Level Protection: Beyond Your Phone Number
- SIM Swap Attack Prevention Tools and Technologies
- Warning Signs You Are Being Targeted Right Now
- What to Do If You Have Already Been Attacked
What Is a SIM Swap Attack?
A SIM swap attack — also called SIM hijacking, SIM splitting, or port-out fraud — occurs when a criminal convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, every call and text meant for you routes to their device. This includes the one-time passcodes (OTPs) that protect your bank, email, and cryptocurrency accounts.
The attack exploits a feature carriers built for legitimate customers: the ability to transfer a phone number to a new SIM card when you lose or replace your phone. Criminals weaponize this customer service process using stolen personal data. It requires no malware, no hacking skills, and no physical access to your device.
The Anatomy of Account Takeover
Once a criminal has your number, they trigger password resets on your accounts. The reset code goes to your phone number — which now routes to them. Within minutes, they can access your email, social media, banking apps, and cryptocurrency wallets. The average time between a successful SIM swap and first financial transaction by the attacker is less than three minutes, according to security researchers at Princeton University.
This speed is what makes SIM swapping so devastating. By the time you notice your phone has lost service, the attacker may have already changed your passwords, locked you out, and initiated transfers. Recovery becomes a race against a criminal who has a head start.
Legitimate SIM Transfers vs. Fraud
Carriers process millions of legitimate SIM transfers every month — when customers upgrade phones, replace lost devices, or switch plans. Fraudulent transfers look nearly identical to legitimate ones. The difference lies in the verification process, which is where most carriers still have exploitable gaps.
Princeton University researchers found that all five major U.S. carriers were vulnerable to SIM swap attacks in their 2019 study, with some carriers approving fraudulent transfers based on nothing more than the last four digits of a Social Security Number.
How Attackers Gather Your Personal Data
A SIM swap attack does not start with your carrier — it starts weeks or months earlier, when a criminal begins assembling a profile on you. They need enough personal information to impersonate you convincingly to a customer service representative. This data is shockingly easy to obtain.
Data brokers sell personal profiles containing your name, address, date of birth, and last four digits of your Social Security Number for as little as $10. Dark web markets sell data breach dumps containing millions of records, often including passwords, security question answers, and account details. A determined attacker may spend $50 total to gather everything they need to steal thousands.
Social Engineering as a Precursor
Many attackers also use social engineering tactics to fill in gaps in their research. They may call you pretending to be from your bank, your carrier, or a survey company — all to extract specific personal details. Phishing emails, fake websites, and even LinkedIn profiles can yield critical account recovery information.
Attackers specifically target your security question answers. If your mother’s maiden name, first pet, or childhood street are anywhere on your social media profiles, an attacker can find them. This is why security researchers universally recommend treating security questions as additional passwords — use random, false answers stored in a password manager.
The Role of Insider Threats
A disturbing portion of SIM swaps involve corrupt carrier employees. The U.S. Department of Justice has prosecuted multiple cases where carrier insiders accepted bribes ranging from $1,000 to $2,500 per swap to bypass verification entirely. In 2021, a former T-Mobile employee was sentenced to federal prison for facilitating hundreds of SIM swaps in exchange for cryptocurrency payments.
According to a 2022 Europol operation targeting SIM swap networks, organized criminal groups performed coordinated SIM swaps across multiple countries, stealing over $100 million from victims in a single 8-month campaign.
This insider threat dimension means that even perfect personal data hygiene is not a complete defense. Carrier-level controls — PINs, port freezes, and account flags — create barriers that even corrupt insiders must bypass, adding critical layers of friction.

The Attack in Real Time: A Step-by-Step Breakdown
Understanding exactly how a SIM swap unfolds helps you identify which defensive layers matter most. The attack typically follows a predictable sequence — and there are multiple intervention points where you can stop it cold.
Phase 1: Research and Reconnaissance
The attacker acquires your phone number (often from a data breach or social media), your carrier (sometimes guessable from your number’s area code or stated on LinkedIn), and enough personal data to pass carrier verification. This phase can take anywhere from 24 hours to several weeks, depending on how much of your data is publicly available.
Attackers may run several test calls to your carrier — pretending to check account details — to understand exactly which security questions they will face. They are methodical. They treat it like a job application research process.
Phase 2: The Fraudulent Transfer Call
The attacker calls your carrier’s customer service line. They claim their phone was lost or damaged and ask to transfer the number to a new SIM. They provide your name, account number (often obtained from a previous data breach), billing address, and PIN or answers to security questions. If the representative is insufficiently trained — or corrupt — the transfer is approved.
In carrier stores, the risk is even higher. Walk-in fraud is common, and in-person interactions often receive less scrutiny than phone-based requests. A 2020 study found that in-store SIM swap fraud was approved 81% of the time when attackers had basic account information, compared to 57% over the phone.
Phase 3: Account Takeover Blitz
The moment your number transfers, your phone goes silent — no calls, no texts, no data. The attacker immediately begins triggering password resets on high-value accounts: Gmail, Apple ID, bank apps, and cryptocurrency exchanges. Each reset code goes to your number, which they now control. Most attackers prioritize cryptocurrency wallets first because those transactions are irreversible.
If your phone suddenly loses all service — especially combined with recent phishing attempts or unusual account activity — do not wait to investigate. Contact your carrier immediately from a different device. Every minute of delay increases your losses.
Who Is Most at Risk?
While anyone with a phone number can be targeted, certain profiles attract disproportionate attention from SIM swap criminals. Understanding your risk profile helps you calibrate the urgency of your defenses.
High-Value Target Categories
| Target Type | Why Targeted | Average Loss |
|---|---|---|
| Cryptocurrency Investors | Irreversible transactions, high account balances | $100,000+ |
| Business Executives | Corporate account access, wire transfer authority | $45,000–$200,000 |
| High Social Media Profiles | Valuable usernames, brand accounts for resale | $5,000–$50,000 |
| Financial Professionals | Brokerage and investment account access | $30,000–$150,000 |
| General Public | Opportunistic targeting via data breaches | $1,000–$15,000 |
Cryptocurrency holders are the most targeted demographic by a wide margin. The combination of irreversible transactions and 24/7 accessibility makes crypto wallets the ultimate prize for SIM swap attackers. The FBI’s San Jose field office has reported multiple convictions specifically tied to crypto-targeted SIM swap schemes.
Geographic and Demographic Patterns
Younger victims — particularly those aged 18 to 35 — account for a disproportionate share of reported SIM swap losses, largely because they hold more cryptocurrency and use SMS-based 2FA more frequently. Urban residents and tech-industry workers are also over-represented in victim profiles, likely due to higher asset values and greater digital footprint visibility.
“SIM swapping has become the preferred method for targeting high-net-worth individuals in the cryptocurrency space. The attack is elegant in its simplicity — it turns your carrier’s customer service against you.”
Why SMS-Based 2FA Fails Against SIM Swapping
Two-factor authentication was supposed to make our accounts safer. For most threat models, it does. But SMS-based 2FA has a fundamental architectural flaw: it anchors your security to your phone number, which a motivated criminal can steal without ever touching your device.
When you receive a one-time passcode via text, that code travels through the public telephone network. That same network can be redirected by a successful SIM swap. The 2FA system works exactly as designed — it just sends the code to the wrong person.
SMS vs. Authenticator Apps vs. Hardware Keys
| 2FA Method | Vulnerable to SIM Swap? | Security Level | Ease of Use |
|---|---|---|---|
| SMS/Text Code | Yes — completely | Low | Very Easy |
| Email Code | Indirect (if email uses SMS recovery) | Low-Medium | Easy |
| Authenticator App (TOTP) | No | High | Moderate |
| Hardware Security Key | No | Very High | Moderate |
| Passkey / Biometric | No | Very High | Easy |
The NIST (National Institute of Standards and Technology) deprecated SMS-based authentication for high-security use cases back in 2016. Yet as of 2024, most major financial institutions still offer SMS 2FA as their default or only option. Understanding why passkeys are replacing passwords gives important context for where authentication is heading — and why moving away from SMS is urgent.
If you use an authenticator app like Google Authenticator, Authy, or Microsoft Authenticator, the one-time codes generate locally on your device and are not transmitted over the phone network. A SIM swap cannot intercept them. Switching to an authenticator app is the single highest-impact action you can take for SIM swap attack prevention.
The Hidden SMS Recovery Backdoor
Many people switch to an authenticator app but leave SMS as their account recovery backup. This creates a hidden vulnerability. An attacker who successfully swaps your SIM can use the “forgot password” flow to bypass your authenticator app entirely, falling back to the SMS recovery option. You must disable SMS as a recovery method, not just as your primary 2FA method.
After switching to an authenticator app, audit every account’s recovery options. Remove your phone number as a backup recovery method and replace it with a hardware security key or a set of printed backup codes stored securely offline.
Carrier-Level Defenses You Must Activate
Your first line of defense against SIM swapping lives at your mobile carrier. Most carriers offer account security features that dramatically reduce the risk of unauthorized SIM transfers. The problem is that almost none of them are enabled by default — you must opt in.
Carrier-Specific Security Features
| Carrier | Security Feature | How to Activate | Strength |
|---|---|---|---|
| AT&T | Extra Security (passcode required for changes) | myAT&T app or store | High |
| T-Mobile | Account Takeover Protection (ATP) + SIM lock | T-Mobile app or call 611 | Very High |
| Verizon | Number Lock | My Verizon app | High |
| Google Fi | SIM Lock (PIN required for all SIM changes) | Fi app settings | Very High |
| Mint Mobile | Port Protection (must request removal to port) | Account dashboard | High |
T-Mobile’s Account Takeover Protection is currently one of the strongest carrier-level defenses available. When enabled, it blocks all SIM change requests — even in-store — until you personally disable it. It takes under two minutes to activate through the T-Mobile app and can prevent the majority of fraudulent SIM transfers.
Setting a Carrier PIN and Passphrase
Every carrier allows you to set an account PIN or passcode. This PIN should be different from your phone’s unlock PIN and should be a random string you have never used elsewhere. Store it in your password manager. When a customer service representative asks for it to verify your identity, that same PIN becomes the barrier an attacker cannot easily bypass.
Some carriers also allow you to set a verbal passphrase for in-store verification. This is an underused but powerful feature. Combining a carrier PIN with a verbal passphrase creates two separate barriers a criminal must breach simultaneously.
The FCC finalized new rules in November 2023 requiring carriers to implement additional SIM swap and port-out protections, including mandatory notification to customers when a SIM change is requested. Check your carrier’s compliance status — not all have fully implemented these rules.
Number Porting Locks
Separate from SIM swapping, number porting — transferring your number to a different carrier entirely — is an equally dangerous attack vector. Most carriers allow you to add a “port freeze” or “port protection” flag to your account that requires additional verification before any porting request can be processed. This is distinct from a SIM lock and must be activated separately.
Account-Level Protection: Beyond Your Phone Number
Even if an attacker successfully swaps your SIM, account-level protections can prevent them from actually accessing your accounts. Defense in depth is the core principle here — each layer you add forces the attacker to do more work, and most will abandon the attempt if the target proves sufficiently hardened.
Removing Your Phone Number From High-Value Accounts
The most aggressive protection is removing your phone number as a login or recovery option from critical accounts entirely. For your email, bank, and investment accounts, use an authenticator app as your sole 2FA method. This completely severs the link between your phone number and your account security.
For accounts where a phone number is legally required (most financial institutions require it for identity verification), keep the number on file but ensure it is not used for 2FA. Use a separate authentication method and disable SMS recovery. Building a personal digital security routine that includes regular audits of your account recovery options is one of the most effective long-term strategies.
Hardware Security Keys for Critical Accounts
For your highest-value accounts — Google, Apple ID, cryptocurrency exchanges, financial institutions — a hardware security key provides the strongest available protection against SIM swap attack vectors. Keys like the YubiKey 5 Series require physical possession of the device to authenticate. No phone number involved, no SMS code to intercept.
Hardware keys cost between $25 and $65 per key. Security professionals recommend buying two — a primary and a backup — stored in different physical locations. The cost is trivial compared to the average SIM swap loss of tens of thousands of dollars.
Google reported that after requiring hardware security keys for all 85,000 employees in 2017, they experienced zero successful phishing or account takeover incidents — including SIM swap-style attacks — in the following two years.
Password Manager Hygiene
Weak or reused passwords accelerate the damage from a successful SIM swap. If an attacker has your phone number and your password is reused from a breach, they do not even need to trigger a reset — they can log in directly. Use a password manager to generate and store unique, 20+ character passwords for every account. This eliminates credential reuse as a compounding attack vector.

SIM Swap Attack Prevention Tools and Technologies
Beyond carrier controls and account hardening, a growing ecosystem of tools specifically addresses SIM swap attack prevention. These range from monitoring services to alternative phone number strategies.
Google Voice and Virtual Number Strategies
One underutilized tactic is using a VoIP number — such as a Google Voice number — as your account recovery phone number instead of your actual cellular number. VoIP numbers are not associated with SIM cards. A SIM swap on your real phone number leaves your Google Voice number unaffected. However, you must secure the Google account controlling that VoIP number with hardware-key 2FA, or you simply move the vulnerability up one level.
This strategy works particularly well for accounts where removing a phone number entirely is not an option. Using a VoIP number decouples your account security from the cellular network’s vulnerabilities.
Identity Monitoring Services
Services like Efani, a carrier specifically designed for high-risk individuals, offer SIM swap protection built into their core product. Efani uses a multi-factor verification process before any account change — reportedly making SIM swaps on their network virtually impossible. Their service costs approximately $99 per month, targeting high-net-worth individuals and cryptocurrency holders.
General identity monitoring services (Experian, LifeLock, Aura) can alert you to unusual activity on your phone account, including port requests. While they cannot prevent an attack, early warning can cut your response time from hours to minutes — which is often the difference between losing everything and losing nothing.
Dark Web Monitoring
Since SIM swap attacks are often preceded by data purchases on dark web markets, monitoring your personal data’s presence on these markets gives you advance warning. Services like HaveIBeenPwned (free) track breach exposure for your email addresses. Paid services scan dark web forums for your phone number, Social Security Number, and other identifiers. Knowing your data is out there is the first step to hardening your defenses appropriately.
“The most important thing people can do is treat their phone number like a password — assume it can be stolen, and make sure your accounts do not depend on it for security.”
Warning Signs You Are Being Targeted Right Now
SIM swap attacks do not happen in a vacuum. Most victims, in retrospect, experienced warning signs they did not recognize at the time. Knowing what to look for can help you intervene before the attack completes.
Pre-Attack Signals
Increased phishing attempts targeting your specific accounts — especially emails or texts asking you to “verify” account details — often precede a SIM swap attempt. Attackers are gathering the data they need. Similarly, unusual login attempts on your accounts, even failed ones, suggest someone is testing your credentials.
Strange calls or texts from people claiming to be from your carrier asking you to “confirm your account PIN” are a major red flag. Carriers do not call you unprompted to ask for your PIN. This is a social engineering attempt — either to steal your PIN directly or to gauge your security posture. Also watch for fake QR codes sent via text or email that may be part of a broader data-gathering campaign against you.
Attack-in-Progress Signals
The clearest signal that a SIM swap is in progress is sudden, complete loss of mobile service — no calls, no texts, no cellular data — on your phone. This happens because your number has been transferred to the attacker’s SIM card. Do not assume it is a network outage. Verify by checking with someone nearby or testing on Wi-Fi.
Receiving unexpected password reset emails or 2FA prompts you did not initiate is another critical warning sign. The attacker may be in the middle of accessing your accounts. Act immediately — this is a race condition.
Many SIM swap attacks are timed for late Friday evenings or weekends, when carrier fraud departments are less staffed and victims may not notice the service outage for hours. Attackers exploit response time gaps deliberately.
Post-Attack Discovery Signals
Some victims discover a SIM swap only after the fact — when they find accounts locked, emails changed, or financial transactions they did not initiate. At this point, the attack has succeeded, but damage limitation is still possible. Speed of response determines ultimate losses more than any other factor in the recovery phase.
What to Do If You Have Already Been Attacked
If you suspect a SIM swap attack is underway or has already occurred, every second matters. The recovery process requires simultaneous action on multiple fronts — carrier, financial institutions, and law enforcement.
Immediate Actions (First 15 Minutes)
Call your carrier immediately — from a landline, a family member’s phone, or via Wi-Fi calling through your phone’s settings. Report that you believe your number has been fraudulently transferred. Request an emergency SIM lock and immediate reversal of the transfer. Ask to speak to the fraud department directly, not general customer service.
While you are waiting for carrier recovery, use a separate device to log in to your highest-value accounts — bank, email, crypto — and change passwords without triggering SMS 2FA. If you have hardware keys or authenticator apps set up, use them now. Check your email for any password reset confirmations you did not initiate. Those accounts have already been compromised.
Contacting Law Enforcement
File a complaint with the FBI’s Internet Crime Complaint Center (IC3) and your local police department. A police report number is essential for your financial institution’s fraud investigation. Some jurisdictions have cybercrime units that actively investigate SIM swap cases, particularly when losses exceed $10,000.
Also contact the FTC at reportfraud.ftc.gov. The FTC coordinates SIM swap reports with carriers and can add significant institutional pressure to your carrier’s response timeline.
Financial Institution Escalation
Call your bank’s fraud line immediately — do not use the app or website until you have regained control of your accounts. Request that unauthorized transactions be reversed and that a fraud flag be placed on your account. Under Regulation E, consumers have strong protections for unauthorized electronic transfers, but the 60-day reporting window means speed matters. Document everything with timestamps.
“Victims often focus on recovering their phone number first, but the critical parallel action is contacting your financial institutions simultaneously. Every minute of delay on the financial side costs money that becomes harder to recover.”
Real-World Example: Michael Terpin’s $24 Million SIM Swap Case
In January 2018, cryptocurrency investor Michael Terpin lost approximately $24 million in digital assets in a SIM swap attack that took less than two minutes to execute. Terpin had previously suffered a smaller SIM swap in June 2017, after which AT&T placed a verbal password on his account. Attackers circumvented this by bribing or socially engineering an AT&T store employee to remove the password restriction and complete the transfer.
Once the attackers had Terpin’s number, they accessed his cryptocurrency accounts using SMS-based 2FA — draining $24 million in digital tokens in minutes. Despite the verbal password safeguard, the insider threat vector made carrier-level controls insufficient. Terpin filed a $224 million lawsuit against AT&T alleging negligence, a case that ultimately proceeded through federal courts and established important legal precedents around carrier liability for SIM swap fraud.
The Terpin case revealed three critical vulnerabilities: reliance on SMS 2FA for high-value accounts, dependence on a single carrier-level control (the verbal password), and no hardware-key authentication on the cryptocurrency exchanges. Had Terpin used hardware security keys and an authenticator app instead of SMS 2FA, the SIM swap — even though it succeeded at the carrier level — would have provided the attacker with no useful access to his accounts.
The outcome drove major changes in how cryptocurrency exchanges handle authentication. Coinbase, Gemini, and Kraken all significantly improved their non-SMS 2FA options in the 18 months following high-profile SIM swap cases like Terpin’s. The case remains the clearest illustration of why SIM swap attack prevention must be implemented in layers — carrier controls alone are insufficient for high-value targets.

Your Action Plan
-
Activate your carrier’s SIM lock and port freeze today
Log in to your carrier’s app or call their customer service line. Enable Account Takeover Protection (T-Mobile), Number Lock (Verizon), Extra Security (AT&T), or the equivalent on your carrier. Also request a port freeze — this is a separate feature that blocks number porting to another carrier. Do both. It takes under 10 minutes.
-
Set a strong, unique carrier PIN and verbal passphrase
Your carrier PIN should be at least 8 digits, randomly generated, and stored only in your password manager. Ask your carrier if they support a verbal passphrase for in-store verification — many do — and set one. These two measures make impersonation dramatically harder for an attacker, even one with your personal data.
-
Replace SMS 2FA with an authenticator app on every critical account
Download Google Authenticator, Authy, or Microsoft Authenticator. Go through every account — email, bank, investment, social media — and switch 2FA from SMS to the authenticator app. After switching, disable SMS as a recovery option. This single step eliminates the primary attack surface for SIM swap fraud. For accounts that force SMS 2FA, use a Google Voice or VoIP number instead of your cellular number.
-
Add hardware security keys to your highest-value accounts
Purchase two hardware security keys (YubiKey 5 NFC or equivalent). Add them to your Google account, Apple ID, and any cryptocurrency exchange you use. Store one key on your keychain and one in a secure location at home. This provides SIM-swap-proof authentication for your most critical accounts and is the strongest available consumer defense.
-
Audit and harden all security question answers
Go through every account that uses security questions and change the answers to random strings stored in your password manager. Treat security questions as additional passwords — never answer them truthfully. An attacker who knows your mother’s maiden name or first pet can use that information to bypass authentication at carriers and financial institutions.
-
Remove your cellular number from non-essential accounts
Log in to your social media accounts, shopping sites, and any service that has your real phone number on file. Remove it if it is not legally required. Every place your real phone number exists is a potential data source for an attacker building a profile on you. Reduce your attack surface aggressively.
-
Monitor your data exposure proactively
Check haveibeenpwned.com for your email addresses and phone number. Set up alerts so you are notified when your data appears in a new breach. Consider a paid identity monitoring service if you hold significant financial assets. Early warning of data exposure lets you harden your defenses before an attack is launched, not after.
-
Create an emergency recovery plan
Write down — on paper, stored securely — your carrier’s fraud line number, your bank’s fraud line number, and your IC3 complaint link. Know in advance that you will need to call from a different device. Store your authenticator app backup codes offline. Having a documented, rehearsed response plan means you act effectively in the critical first minutes of an attack rather than freezing under pressure.
Frequently Asked Questions
How long does a SIM swap attack take to complete?
The fraudulent SIM transfer itself can be completed in as little as 2 to 7 minutes if the attacker has sufficient personal data. The subsequent account takeover phase — accessing your accounts using the intercepted 2FA codes — typically occurs within 3 minutes of the number transfer. Total time from call to first unauthorized financial transaction can be under 10 minutes.
Can my carrier fully prevent a SIM swap?
No carrier can guarantee 100% prevention, largely because of the insider threat dimension. However, enabling available protections like SIM locks, port freezes, and strong carrier PINs raises the difficulty significantly. Combining carrier-level controls with account-level protections (authenticator apps, hardware keys) creates a defense stack that is effective against the vast majority of SIM swap attempts.
Is my phone number still at risk if I use an authenticator app?
A SIM swap can still transfer your phone number even if you use an authenticator app. What changes is that the attacker can no longer use your phone number to intercept 2FA codes or trigger password resets on accounts secured with an authenticator app. The SIM swap succeeds at the carrier level but fails to give the attacker access to your properly secured accounts. However, any account that still uses SMS as a backup recovery option remains vulnerable.
What is the difference between a SIM swap and number porting?
A SIM swap transfers your number to a different SIM card on the same carrier — as if you got a new phone. Number porting (also called port-out fraud) transfers your number to a completely different carrier. Both attacks have the same outcome for the victim, but they exploit different carrier processes. Protecting against both requires separate controls: a SIM lock for SIM swapping and a port freeze for number porting.
Can I sue my carrier if I am victimized by a SIM swap?
Yes, and several victims have successfully done so. Michael Terpin’s lawsuit against AT&T established significant legal precedent. Carriers have a duty of care to protect customer accounts, and negligence in verification processes has resulted in multi-million dollar settlements. Document everything — when you noticed the service loss, every call you made, every fraudulent transaction — as this evidence is critical in any legal claim. Consult a cybersecurity-focused attorney immediately after filing law enforcement reports.
Are prepaid phones less vulnerable to SIM swap attacks?
Prepaid accounts are sometimes more vulnerable, not less. Many prepaid carriers have weaker identity verification requirements at the point of sale and for account changes, because prepaid accounts were designed for easy, low-friction access. If you use a prepaid number for account recovery, ensure you have set a strong account PIN and enabled any available security controls. Consider moving high-value account recovery to a VoIP number instead.
What accounts are most critical to protect against SIM swap attacks?
Prioritize in this order: (1) your primary email account — since most accounts reset through email, this is the master key; (2) cryptocurrency exchange accounts; (3) banking and investment accounts; (4) your Apple ID or Google account; (5) social media accounts with large followings or valuable usernames. Securing these five categories eliminates the vast majority of financial risk associated with a successful SIM swap.
How do attackers know which carrier I use?
Phone number prefixes (the first six digits) often correlate with specific carriers and regions, and number lookup APIs can identify carriers directly. Attackers also mine social media profiles, LinkedIn pages, and data broker records where carrier information may be mentioned. In some cases, attackers call multiple carriers sequentially until they find the one that has your account. Never assume your carrier is not publicly known.
Does freezing my credit stop SIM swap attacks?
A credit freeze at the three major bureaus (Equifax, Experian, TransUnion) prevents new credit accounts from being opened fraudulently — but it does not directly prevent SIM swap attacks, which exploit your carrier’s identity verification process rather than your credit record. Credit freezes are an important part of overall identity protection but should be considered a complementary measure, not a substitute for carrier-level and account-level SIM swap defenses.
How can I make my digital security more robust overall?
SIM swap protection is one component of comprehensive digital security. Building a consistent personal digital security routine — covering passwords, 2FA, device security, and data minimization — dramatically reduces your overall attack surface. Also consider reviewing how you handle messaging app security when traveling internationally, where risks are elevated. And be aware that attackers often combine SIM swapping with other tactics, including spyware installation, to maximize access to your accounts.
Users who enable both a carrier SIM lock and a non-SMS authenticator app reduce their practical SIM swap attack risk by an estimated 95%, according to security researcher analysis of attack pattern data from 2020 to 2023.
Sources
- FBI Internet Crime Complaint Center — SIM Swapping Public Service Announcement 2022
- FBI San Jose Field Office — SIM Swapping Conviction Press Release
- FBI IC3 — Internet Crime Complaint Center Filing Portal
- Federal Trade Commission — Report Fraud Portal
- FTC Business Guidance Blog — FCC Action on SIM Swap Fraud 2023
- Princeton University — An Empirical Study of Wireless Carrier Authentication for SIM Swaps (2019)
- NIST Special Publication 800-63B — Digital Identity Guidelines: Authentication and Lifecycle Management
- Europol — Eight Arrested for SIM Swapping Against High-Profile Victims
- U.S. Department of Justice — SIM Swapping Sentencing Press Release
- Krebs on Security — The Case for Strong Authentication: SIM Swapping Edition
- Electronic Frontier Foundation — Your Phone Number Should Not Be Used for Authentication
- Google Security Blog — How Effective Is Basic Account Hygiene at Preventing Hijacking
- Have I Been Pwned — Personal Data Breach Monitoring Tool
- FTC Consumer Information — What to Know About SIM Swap Scams
- Wired — SIM Swap Victim Michael Terpin Sues AT&T for $224 Million






