Your phone drops to “No Service.” You assume it’s a tower issue. You’ll check it in a few minutes.
Those few minutes are enough. Somewhere across town — or across the world — someone just called your carrier, convinced them they were you, and transferred your phone number to a SIM card they control. Every SMS headed to your number now lands on their device. Your email password reset just went to them. So did your bank’s OTP.
By the time you figure out what happened, they’re already in.
The moment it happens
The first sign is the signal drop. No calls, no texts, no data. Your phone is on, but it’s cut off from the network. This is the tell — your number has been transferred off your SIM.
Within minutes of a successful swap, an attacker starts their clock. They go to your email provider first. Email is the master key: it unlocks password resets for everything else. From there they hit banking apps, crypto wallets, PayPal, investment accounts. If your accounts use SMS-based two-factor authentication — and most people’s do — every verification code goes straight to them.
The FTC received more than 15,000 SIM swap reports in the US in 2023 alone. Those are only the cases that got reported.
How attackers execute the swap
The mechanics are simpler than most people expect.
An attacker calls your carrier’s customer support line and says they’ve lost their SIM. They want their number transferred to a new one. Customer support then asks identity verification questions. That means your name, your billing address, the last four digits of your Social Security Number (or Aadhaar number in India), your account PIN, and answers to security questions. Pass enough of those checks, and the agent processes the transfer.
So where do attackers get this information? From you — just not directly.
Your name and home address are listed on Whitepages, Spokeo, and dozens of data broker sites right now. Your date of birth is on your Facebook profile, possibly set to public. The last four digits of your SSN are available in breach databases. The 2023 MOVEit breach alone exposed records belonging to tens of millions of Americans. Your carrier account PIN, if you haven’t set one, defaults to a weak value or doesn’t exist at all. Security question answers, such as mother’s maiden name, childhood pet, and first car, are often findable through social media in under twenty minutes.
Scattered Spider’s 2023 attacks on MGM Resorts, Caesars Entertainment, and several other corporations used enterprise vishing, impersonating employees to trick corporate IT helpdesks into resetting credentials. That’s related to but distinct from consumer SIM swap requests at carrier stores. The same pattern of social engineering, applied to consumer carrier accounts, works on ordinary people every day.
What they do once they have your number
The first ten minutes after a swap are when the most damage happens.
Your email goes first — it’s the account that resets everything else. Once they’re in your inbox, they search for financial institution names, scan for linked accounts, and start requesting password resets. Banking apps that send OTPs via SMS hand them over immediately. Crypto wallets — which have no fraud reversal and no customer support line to call — are often drained within minutes.
Jack Dorsey, then CEO of Twitter, had his own Twitter account compromised via SIM swap in 2019. His phone number was transferred without authorization, and attackers used it to post offensive content from his account before the swap was detected and reversed. If it can happen to the CEO of a major tech company, it can happen to anyone with a public-facing phone number.
In India, SIM swap fraud has a specific flavor: it targets UPI and net banking OTPs. Attackers file a fraudulent SIM replacement request at a carrier store using forged Aadhaar documents. They then wait for the victim’s SIM to deactivate, which happens automatically when a new SIM activates on the same number. Finally, they drain the victim’s bank account during the window before the victim notices. Indian banks have improved detection, but the attack continues at scale.
Who is most at risk
Crypto holders are the highest-value targets — there’s no chargeback, no fraud team to call, no reversal. Stolen crypto is gone.
People with large social media followings get targeted for account hijacking, which gets repurposed for scams or sold. Executives are targeted for corporate access — their phone number unlocks enterprise accounts and internal communication platforms.
But “most at risk” doesn’t mean regular people are safe. Attackers run volume operations. A compromised email account with a PayPal or Venmo attached is worth real money. A bank account with a few thousand dollars in it is worth the fifteen-minute effort of a SIM swap. Your net worth doesn’t need to be exceptional for you to be worth targeting.
How to protect yourself
Set a carrier PIN — today. AT&T, Verizon, T-Mobile, Jio, and Airtel all allow you to add a PIN that must be provided before any SIM change can be processed. This single step dramatically raises the bar. Without it, a caller just needs to pass basic identity verification with information that’s already exposed. With it, they need your PIN too. Call your carrier’s customer service line and ask specifically to set a port freeze or SIM lock — some carriers call it a “number transfer PIN” or “account security PIN.”
Switch SMS-based 2FA to an authenticator app (Google Authenticator, Authy, or similar) on every account that allows it. Authenticator codes generate locally on your device. They’re not routed through your phone number and can’t be intercepted by a SIM swap. Gmail, most banks, and every major crypto exchange support TOTP-based 2FA.
For your highest-value accounts, use a hardware security key like a YubiKey. A SIM swap cannot bypass a hardware key. The attacker would need the physical device in their hand. Hardware keys are the strongest consumer-grade protection available.
Remove your phone number from services that don’t genuinely need it. Many apps ask for your number during signup but don’t require it for the service itself. The fewer places your number exists as a linked identifier, the smaller your attack surface.
If it happens to you
Act immediately — every minute matters.
Use a different device (a family member’s phone, a landline, your laptop’s Wi-Fi calling) to call your carrier’s fraud line. Your phone is compromised; do not rely on it. Report the fraudulent SIM transfer, have them deactivate the attacker’s SIM, and restore service to your original device.
From a device that isn’t your phone, change passwords for your email, banking, and any accounts where the attacker had enough time to get in. Log out all active sessions on your email account.
Contact your bank’s fraud department directly — not through links in any emails you received during the attack window. Explain that you’re a victim of SIM swap fraud. Ask them to flag your account, reverse any unauthorized transactions, and temporarily freeze outbound transfers.
File a report:
- US: reportfraud.ftc.gov
- India: cybercrime.gov.in (National Cyber Crime Reporting Portal)
- UK: Action Fraud at actionfraud.police.uk
- EU: your national data protection authority
Document everything with timestamps. If crypto was stolen, report it to the exchange and to law enforcement — recovery is unlikely but documentation matters for any subsequent legal action.
What you can do right now
Want to see what data brokers expose about you? See what a scan finds → shows an example report: the kinds of sites that list your name, phone, and address. Once KnytX Shield launches it will find and remove these automatically. Join the waitlist to get in early.