SIM Swapping Attacks: How Attackers Steal Numbers & How to Lock Your Carrier

SIM swapping has emerged as one of the most devastating forms of targeted account takeover. By tricking or bribing a customer service representative at your cellular provider, an attacker transfers your mobile phone number to a device under their control.

Once the swap is complete, the attacker intercepts all SMS verification codes, resetting passwords on bank accounts, email inboxes, and cryptocurrency wallets within minutes.

How the Attack Unfolds

1. Reconnaissance: The attacker gathers your full name, date of birth, physical address, and cell phone provider through data breach search engines or phishing.
2. Social Engineering the Carrier: The attacker contacts Verizon, AT&T, or T-Mobile claiming to be you, stating their phone was lost or dropped in water.
3. The Swap: The representative activates a new SIM card. Your personal phone immediately loses cellular service, displaying “No Service” or “SOS Only”.
4. Account Reset: The attacker triggers “Forgot Password” prompts across primary email accounts, receiving password reset SMS tokens directly.

How to Protect Your Mobile Account

• Set a Carrier Account PIN / Passcode: Call your carrier or log in online to establish a dedicated 6-to-8-digit account security PIN. Instruct customer service to require this PIN for any account modifications.
• Enable Port Freeze / Transfer Lock: All major carriers offer a feature that locks your number from being ported out without secondary identity verification.
• Transition Off SMS 2FA: Remove your phone number as a two-factor authentication recovery method on critical accounts (Google, Apple, Microsoft, banks). Switch to authenticator apps (TOTP) or FIDO2 hardware keys (YubiKeys).