SIM swap: the scheme broken down by Zavialov Ilia Nikolaevich

What the victim sees

Service disappears without warning, usually in the evening or at a weekend when support lines are thin. The phone still works on wireless networks, which is why most people assume a network fault and wait.

Then the messages start arriving in email instead. Password changed, new device added, withdrawal confirmed. Each one is a notification about something that has already happened.

The window between the two is where everything is lost, and it is short. An hour of waiting to see whether service comes back on its own is an hour spent on the wrong side of the problem.

What happens at the carrier

Somebody contacts the operator claiming to be you, with a broken phone or a lost card, and asks for the number to be moved to a new SIM. What they need is not technical, it is a handful of personal details and a convincing story.

Those details are cheap. Date of birth, address, last four digits of a payment card and the answer to a security question are all available from old breaches, social media or a previous phishing message that seemed pointless at the time.

In a minority of cases somebody inside the shop is paid to do it directly, which removes the need for any story at all. Both routes end in the same place, and neither leaves a trace the customer can see.

Australia reported that around 90 percent of these transfers happened without any engagement from the victim, which is the part people find hardest to accept. There was nothing to click and nothing to fall for.

Why the number is worth taking

A phone number is a master key held by almost every service you use. Password resets are sent to it, one time codes arrive on it, and account recovery falls back to it when everything else fails.

This is why SIM swap is an access step and not the fraud itself. The number is taken in order to drain a bank account or a cryptocurrency exchange, and the loss is then recorded under those categories instead.

That accounting is why the reported figures look modest. The 26 million dollars booked directly under SIM swap in 2024 is the visible tip of a much larger number sitting in other columns.

The settings that remove the risk

Put a port freeze or a transfer PIN on the mobile account. Every major carrier offers one, it takes a few minutes, and it converts a persuasive phone call into a request that cannot be completed.

Move codes off the number. An authenticator application or a passkey does not depend on the mobile network at all, and switching the important accounts away from SMS removes the reason to steal the number.

Use a separate address for account recovery, one that was never published and is never used for anything else. Recovery routes are chosen by attackers precisely because nobody reviews them.

Check which of your accounts still fall back to SMS. The bank is usually the last one to allow anything better, and knowing that in advance is more useful than discovering it during an incident.

If the signal has already gone

Call the carrier from another phone immediately and ask directly whether the number has been transferred. Do not wait to see if service returns, because that hour belongs to whoever took it.

In parallel, get into email from a computer and change the password there first. Email is the account that resets all the others, so it is the one worth reaching before anyone else does.

Then contact the bank and freeze what can be frozen. Recovery of funds depends almost entirely on how quickly the first call is made, and the difference between one hour and one morning is usually the whole amount.