SIM swapping

In short: In SIM swapping a fraudster gets the mobile provider to transfer a person’s phone number to a SIM card of the fraudster. Afterwards he receives the victim’s SMS codes and calls.

In more detail: The targets are accounts secured by SMS: email, banking, crypto exchanges, social networks.

In Depth

• Method: The fraudster collects personal data (phishing, data leaks), poses as the customer at the provider or bribes staff and has the number switched.
• Signs: The phone suddenly loses reception (“No service”) and security mails about password changes arrive.
• Protection:
  • For important accounts no SMS codes, but an authenticator app or security key (2FA, passkeys).
  • Set a customer password/SIM lock with the provider.
  • Share little personal data publicly.
• If it happens: Call the provider at once, have the SIM blocked, change passwords of important accounts, inform the bank, file a report.
• Distinction: Different from intercepting SMS in the mobile network (SS7 weaknesses), but it reaches similar goals.

See also: recognising phishing and scams