What Is a SIM Swap?
A SIM swap is an attack where someone gets a mobile carrier to move your phone number onto a SIM or eSIM they control. Once they hold your number, they receive your calls and text messages, including the one-time codes many services send for login and account recovery. Port-out fraud is the related attack where the number is moved to a different carrier.
How it works, at a high level
The attacker needs the carrier to believe they are you. They may impersonate you to customer support, or an insider may help. They need very little from you. A name, an address and a phone number are often a good start, which is why people-search sites and data broker profiles matter here. The attacker then uses the number to reset passwords on accounts that texted a code.
I’m leaving the rest out on purpose.
How common is it
The FBI’s Internet Crime Complaint Center reported 982 SIM swap complaints with losses of about $26 million in 2024, down from 1,075 complaints and about $48.8 million in 2023, and 2,026 complaints and about $72.7 million in 2022. Those are reported complaints only. Losses from the later account takeover are often filed under other categories, so the real picture is probably larger.
What the FCC requires
In November 2023 the Federal Communications Commission adopted rules on SIM swap and port-out fraud. Carriers must use secure authentication before a SIM change or port-out and notify customers of those requests. They must also offer a free account lock option, keep records of SIM changes, and train employees. The rules took effect in January 2024, with some compliance dates later. A rule is a floor. Carrier practice still varies.
How to defend yourself
- Ask your carrier for an account lock or port-out PIN. The FCC rules require carriers to offer a lock option. The details depend on the carrier.
- Stop using text messages as your second factor where you can. An authenticator app or a hardware security key doesn’t depend on your phone number.
- Make the number worth less. The less an attacker can learn about you from public records, the harder the impersonation. That is where a privacy broker helps.
- Keep a recovery path that doesn’t use your phone. If the number is gone, you want a way back in.
The point
A SIM swap is an authentication problem. A weak link, in this case a phone number, was treated as proof of identity. In the WordPress class story, the way in was a password someone else had been given, and nobody had asked whether that person should still have it. Different system, same weak link.
Sources
- FBI Internet Crime Complaint Center, 2024 Internet Crime Report.
- Federal Communications Commission, Report and Order on SIM swap and port-out fraud, FCC 23-95, published in the Federal Register December 8, 2023.