SIM swap

How it works

The US Federal Communications Commission describes SIM swapping as a bad actor convincing a victim's wireless carrier to transfer the victim's service from the victim's phone to a phone in the bad actor's possession. The FBI's Internet Crime Complaint Center defines it as the use of unsophisticated social engineering techniques against mobile service providers to transfer a victim's phone service to a mobile device in the criminal's possession.

The FCC describes a related scheme, port-out fraud. The bad actor, posing as the victim, opens an account with a different carrier and has the victim's number moved to it.

Once the number is under the criminal's control, text messages and calls go to the criminal. Any account that sends a verification code by SMS, or lets a user reset a password through a text, becomes reachable.

Scale and rules

IC3's 2025 annual report records 971 SIM swap complaints and $17,366,758 in reported losses, against 982 complaints in 2024 and 1,075 in 2023. Reported losses fell from $48,798,103 in 2023. These figures reflect only what victims file.

The FCC adopted rules on November 15, 2023 that require wireless providers to use secure methods of authenticating a customer before redirecting a number to a new device or provider, and to notify customers immediately when a SIM change or port-out request is made on their account.

How it relates to executive exposure

A SIM swap depends on persuading a carrier, and personal details about the victim help. The FCC says data breaches "can increase the risk posed by these scams by exposing consumers' information that can make it easier for scammers to steal consumers cell phone accounts." Names, phone numbers and addresses are the kind of fields that appear in breach records, and CEM shows which executives have a phone number or password exposed there. A phone number tied to an executive's email, banking or cloud accounts is a high-value target because a successful swap can enable password resets. Executive personal accounts in breach data shows how personal contact details end up in leaked data.

Reducing the risk

The FBI's 2022 announcement on SIM swapping advises "strong multi-factor authentication methods such as biometrics, physical security tokens, or standalone authentication applications", not giving mobile account details to callers who ask for them, avoiding posting a mobile number or address online, and watching for changes in SMS connectivity. Where an account offers it, choose an authenticator app or a hardware security key instead of SMS codes. Treat an unexpected loss of mobile service, or an unexpected carrier notification, as a possible swap: the FBI advises contacting the carrier immediately and then changing account passwords.

How it differs from related terms

A SIM swap takes over a phone number, not the device. Account takeover is the wider outcome, and a SIM swap is one route to it. Credential stuffing uses leaked passwords, while a SIM swap targets the second factor. Pretexting is the deception often used on the carrier.