SIM-swap fraud, explained for people who don't work in security
Your phone number is the master key to your bank account. Here is how criminals borrow it, and the ten minutes it takes to make them give up.
At some point in the last decade, without anyone asking you, your phone number quietly became the most important password you own. It resets your email. It receives your bank’s one-time codes. It proves to half the apps on your phone that you are, in fact, you.
So naturally, criminals would like to borrow it.
What actually happens
A SIM swap is exactly what it sounds like. Someone persuades your mobile network to move your number onto a SIM card in their phone. The moment that happens, your phone drops to “No service”, and theirs starts receiving your calls, your SMS and, crucially, your one-time passwords.
They usually do this one of three ways:
- Talking their way in. They walk into a shop or call customer care with your name, date of birth and a convincing story about a lost phone. Much of that information is already floating around from old data leaks.
- Paying someone inside. A small number of swaps involve a dealer or staff member who is paid to look the other way.
- Getting you to help. A “customer care agent” calls to “upgrade your SIM to 5G” and asks you to read out a code. That code was the authorisation for the swap. You have just held the door open.
Then the clock starts. With your number, they request password resets, drain what they can from your accounts, and are often done before you have found a shop that is open.
The tell
Your phone suddenly loses signal for no reason, in a place where it normally works, and stays that way. Do not wait for it to “come back”. Use another phone and call your network and your bank immediately. Minutes matter here, in a way they rarely do in security.
The ten-minute fix
You cannot stop someone from trying. You can make it pointless.
- Ask your bank to stop relying on SMS alone. Where your bank offers an authenticator app or in-app approval, switch to it. A code sent to your number is only as safe as your number.
- Move your email off SMS recovery. Your email is how everything else gets reset. Give it an authenticator app or a security key.
- Ask your network about a SIM-swap lock or PIN for changes to your line, if they offer one.
- Never read a code to anyone who called you. Real customer care never needs it. This one rule defeats the most common version of the scam.
- Keep your date of birth and phone number off public profiles. They are half of the script a fraudster reads to customer care.
None of this makes you unhackable. It makes you more expensive than the next person, which, as with most crime, is the actual goal.