The invisible theft: Understanding the cellphone SIM swapping scam

Michelle Reitan

In a SIM swap, a criminal does not steal your physical phone. Instead, they trick your mobile carrier into transferring your phone number to a new SIM card that they control.”

For many of us, our cellphone is more than a convenience; it is a vital link to our families, our finances, and the digital world. We often think of it as a secure device, protected by a passcode. However, there is a sophisticated and increasingly common scam that bypasses the security of your phone entirely by attacking your phone number. This crime is known as a SIM swap scam, and it poses a serious threat to your financial security and personal identity.

Your phone uses a small chip called a SIM (subscriber identity module) card to connect to your carrier's network and link your device to your phone number.

In a SIM swap, a criminal does not steal your physical phone. Instead, they trick your mobile carrier into transferring your phone number to a new SIM card that they control. The scammer accomplishes this by posing as you, often using personal information they have gathered from data breaches, phishing emails, or even your public social media profiles.

They call your carrier, claim they have lost their phone, and request that your number be activated on their new SIM card. If the carrier's representative is successfully deceived, your phone will suddenly lose service. At that same moment, the scammer's phone connects to your phone number. Your phone SIM has been swapped to another phone.

In our modern world, your phone number is often the key to your most sensitive accounts. Banks and other services use it for two-factor authentication (2FA), sending a one-time passcode via text message to verify your identity when you log in or make a transaction.

Once a scammer controls your phone number, they can intercept these crucial security codes. They can then use your email address and a “forgot password” request to have a reset link sent to your phone, which they now control.

Within minutes, a criminal can reset your banking passwords, drain your accounts, steal cryptocurrency, or commit other forms of fraud in your name, while you are locked out of your own phone and digital life.

The consequences can be devastating, both financially and emotionally. In one case, a Florida couple were targeted in a SIM swap scam. While their phones went dead, the criminals accessed their financial accounts, stealing over $125,000.

Another victim described the loss of his cryptocurrency savings as “absolutely devastating,” noting that “these weren’t just digital numbers on a screen; they represented my family’s savings, our future security, our dreams.”

These are not isolated incidents; federal authorities report that Americans lost more than $26 million to SIM swap scams in 2024 alone.

Fortunately, there are steps you can take to protect yourself from this silent threat. The most effective measure is to move away from relying on SMS text messages for two-factor authentication.

Instead, use an authenticator app like Google Authenticator or a physical security key. These methods generate codes directly on your device and are not tied to your phone number, making them immune to a SIM swap.

You should also proactively secure your mobile account by contacting your carrier and requesting an extra layer of security, such as a unique PIN, password, or a "port-out lock" that must be provided before any number transfer can be made.

Staying vigilant and taking these proactive steps are the best defenses against this invisible yet powerful form of theft.