SIM Swapping.

What Is SIM Swapping?

SIM swapping is a scam where a criminal gets a mobile carrier to move your phone number to a SIM card the criminal controls. A SIM card is the small chip that links a phone to a carrier account. The FBI Internet Crime Complaint Center (IC3) calls it a malicious technique that targets mobile carriers. Criminal actors use it to gain access to victims’ bank accounts, virtual currency accounts and other sensitive information.

How Do Criminals Get a Number Moved?

The FTC explains that scammers contact your cellular provider and say your phone was lost or damaged. They ask the provider to activate a new SIM card on a phone they control. If the provider believes the story, the FTC says the scammer, not you, gets your text messages, calls and data.

The FBI says criminals mainly use three routes:

• Social engineering, which means tricking people. Criminals pose as the victim and persuade the carrier to switch the number.
• An insider threat. A criminal pays a carrier employee to switch the number.
• Phishing, which means deceptive messages. Criminals deceive employees into downloading malware that is then used to hack carrier systems that carry out SIM swaps.

What Can a Criminal Do With Your Number?

Many accounts send a code by text message to prove who you are. The FTC says a scammer who holds your number can log in to accounts that use text message codes as a form of multi-factor authentication. The FBI adds that criminals can send “Forgot Password” requests and use text message codes to reset passwords.

What Is Port-Out Fraud?

The FCC describes a related scam. In port-out fraud, the bad actor poses as the victim and opens an account with a different carrier. The phone number is then transferred to that new account. In a SIM swap, the FCC says, the bad actor convinces the victim’s own carrier to move service to a phone the bad actor holds.

How Have SIM Swap Numbers and Rules Changed?

US agencies have published figures and rules over the last few years.

The FCC fact sheet on the draft order lists customer alerts, account locks and records of SIM change requests.

What Are the Warning Signs?

The FTC lists some signs. You may get an unexpected notice from your provider about a SIM card being activated. Your phone may lose service for no clear reason.

What Can You Do to Lower the Risk?

The FTC suggests these steps:

• Do not reply to calls, emails or texts that ask for personal information.
• Limit the personal details you share online.
• Set up a PIN or password on your cellular account.
• For sensitive accounts, use an authentication app or a security key instead of text message codes.

The FBI also advises authentication beyond text messages, such as security tokens or standalone apps, and never giving account credentials during unsolicited calls. The FCC’s rules require wireless providers to use secure methods to authenticate a customer before moving a phone number to a new device or provider. The rules also require providers to notify customers right away when a SIM change or port-out request is made on their account.

What Should You Do If It Happens?

The FTC says to contact your provider straight away to get your number back, then change your account passwords. The FBI asks victims to report to IC3 at ic3.gov.

Is SIM Swapping the Same as Account Takeover?

No. SIM swapping takes control of a phone number. Account takeover is when someone gains control of an online account. A SIM swap can be one way to reach an account that relies on text message codes, but the two terms describe different things.

Related Pages in the Knowledge Hub

• Smishing, text message phishing
• MFA fatigue, another attack on multi-factor sign-in
• Phishing 101, how people get tricked into giving access