A SIM swap attack hijacks a phone number through a carrier’s customer-service process, then turns SMS verification into a route into linked accounts. Protecting against it requires more than securing the handset. The effective defense combines carrier locks, authentication that does not depend on SMS, and less public information for an attacker to use when impersonating the account holder.
Why a SIM swap is not a phone hack
The attacker persuades a carrier representative to reassign the victim’s number to a SIM the attacker controls. The phone itself is never touched, the network is never breached, and no encryption is broken. Once the transfer completes, calls, texts, and one-time passcodes intended for the victim arrive on the attacker’s device.
The exploited assumption is that a phone number reliably identifies a person. It instead represents a billing relationship with a carrier, and that relationship can be reassigned through customer service. The distinction determines where protection must sit. SIM hijacking and SIM jacking are names for the same attack, while port-out fraud moves the number to another carrier. In each case, control of the number gives the attacker access to whatever services send to it.
The five-step attack chain, from reconnaissance to drain
Reconnaissance supplies the material needed to impersonate the victim. Attackers gather a name, date of birth, address, and the last four digits of a Social Security number or national ID. Breach dumps, public profiles, data brokers, and phishing pages that mimic a bank or carrier provide those details. The information becomes a script for passing identity checks.
With that preparation, the attacker contacts the carrier by phone or visits a retail store. Claims such as “I broke my phone” or “I lost my SIM while traveling” provide a reason to request reassignment. The harvested details make the request appear legitimate. The FBI’s IC3 public service announcement also describes an insider route, in which attackers bribe or recruit a carrier employee. This route bypasses customer impersonation rather than following it as a necessary additional step.
Once the number moves, the attacker can start password resets on email, banking, and crypto exchange accounts that let people recover access through SMS. Codes sent to the victim’s registered number now authorize the attacker. Scripts that run resets and withdrawals cut the time spent on manual steps before the final drain. The victim’s phone losing service may be the first visible sign, even as account takeovers are already underway.
Two escalations that make the attack harder to stop in 2026: eSIM and AI voice cloning
With digital eSIM activation, the attacker has no need for a physical card. An attacker who phishes carrier credentials or hijacks a session token can request an eSIM transfer through a carrier portal, routing the number to a burner device. No mailed SIM or store visit is required. Carrier controls can protect accounts when enabled, but an eSIM transfer can bypass those protections if the carrier account itself is compromised first.
AI voice cloning exploits the trust people place in a voice they know. A short audio clip from a public TikTok, Instagram, or LinkedIn video can supply material for a convincing clone used in an automated call claiming that a phone was stolen. Together, digital transfers and cloned voices reduce the need for an in-person visit or a complicit employee. That makes carrier locks and reduced reliance on SMS more important both before an attack begins and after service disappears.
Why crypto holders and executives face disproportionate exposure
Banks have transaction holds, chargebacks, and fraud teams that can reverse transfers, while crypto withdrawals confirm on-chain in minutes with no way to make a chargeback. A swap can enable a password reset into email or cloud notes containing a stored seed phrase.
Executives face a further layer of exposure. A hijacked number can support impersonation to colleagues, fraudulent wire approvals, or access to corporate authentication flows that use the number for recovery. Attackers can prioritize crypto exchanges for immediate withdrawals and email for its ability to reset other accounts, then pursue banking and brokerage access. The order can vary with the available recovery paths. The leverage comes from linked accounts that trust the same number.
Federal authorities announced that Tyler Robert Buchanan, 24, of Dundee, Scotland, pleaded guilty on April 17, 2026, to conspiracy to commit wire fraud and aggravated identity theft in a California federal court. Between 2021 and 2023, Buchanan and his crew phished companies including Twilio, LastPass, DoorDash, and Mailchimp to steal credentials, then used SIM swaps to bypass victims’ two-factor authentication and drain millions in cryptocurrency. In a separate case, a California arbitrator’s order that T-Mobile pay a large sum in damages for a cryptocurrency theft made possible by a SIM swap became public in March 2025. For high-risk individuals, passive reliance on carrier security is not a viable posture.
The warning signs that a swap is in progress
Sudden, unexplained service loss is the primary warning. The phone may show “No Service,” permit only emergency calls, or stop receiving calls and texts. In a completed swap, that loss coincides with the attacker beginning to receive communications sent to the number. Unexpected account-lockout notices or password-reset confirmations on a secondary email can also expose the attack. A carrier’s SIM-change or port-out notification may be another warning if it comes through a channel the account holder can still use.
The immediate response is to call the carrier from a landline or another phone. Contact the financial institutions linked to the number. For crypto accounts, try to sign in from a device with a hardware key or authenticator app instead of SMS before the attacker changes the recovery options. Response speed can limit damage in the minutes after service drops. Preventing the transfer from completing is nevertheless a stronger position than relying on a fast reaction.
What the FCC rule requires carriers to do — and where it still falls short
FCC Order FCC 23-95, adopted in late 2023, requires secure authentication before carriers honor SIM-swap or port-out requests. The order rejects authentication based on “readily available biographical information, account information, recent payment information, or call detail information.” It also requires immediate notification through a method reasonably designed to reach the customer, an account-lock feature, employee training, and recordkeeping of requests and authentication measures. These are distinct obligations. Notification can use email or a backup number, but the rule does not mandate a separate channel.
The implementation timeline limits its value as current protection. On July 5, 2024, the FCC’s Wireline Competition Bureau waived compliance “with the rules in their entirety” pending OMB review. OMB approved the paperwork on January 15, 2025. As of mid-October 2026, however, the eCFR text still showed no compliance date, so carriers were not yet formally required to comply.
Full compliance would still leave an authentication-design problem. If a swap succeeds, services that accept SMS recovery codes still send those codes to the attacker. Carrier rules cannot change that downstream behavior. CISA’s December 2024 Mobile Communications Best Practice Guidance directed organizations not to use SMS as a second authentication factor, recommending FIDO authentication and recognizing passkeys as an acceptable alternative.
Carrier-side controls available now, before the rule takes effect
The practical first step is to enable the carrier protections already available. These controls include Verizon Number Lock and SIM Protection, AT&T Wireless Account Lock, and T-Mobile Account Takeover Protection. These controls offer protection without waiting for the regulatory timeline. They block account changes, SIM changes, or number transfers until the account holder lifts the block on that action. For someone at elevated risk, enabling these controls is the highest-priority carrier-side action.
A SIM-change lock does not automatically block a port-out. Ask whether a port-out PIN or port-out block is a separate setting, and enable it separately where needed. Also set a strong, unique carrier account PIN that is separate from the phone’s screen lock. It should not derive from a birthday or the last four digits of a Social Security number, because those are precisely the details reconnaissance seeks. These measures protect the carrier account, but they do not replace protection for the services connected to the number.
Moving two-factor authentication off SMS — which methods actually resist a swap
The service generates a valid code and sends it to the registered number, exactly as designed. It cannot tell whether the destination SIM belongs to the legitimate customer or an attacker. Once the number moves, the attacker receives the code. Fixing that dependency requires a different authentication method.
TOTP authenticator apps resist a swap because they generate codes on the device independently of the mobile network. Examples include Aegis on Android, Google Authenticator, 2FAS, and Raivo on iOS. FIDO-based passkeys also avoid reliance on the phone number and provide phishing-resistant authentication, with device biometrics supporting their use. Email magic links are conditional protection. They resist a swap only when the email account itself has a SIM-swap-resistant second factor independent of SMS.
The upgrade must cover recovery as well as login. An account with a passkey is still at risk if a text message is enough to prove ownership when someone tries to recover access. Prioritize the most consequential accounts, starting with the crypto exchange, primary email, and bank, and explicitly check each recovery path for SMS access.
Reducing the reconnaissance footprint that makes the attack possible
Reconnaissance turns scattered personal details into an identity-verification script. Attackers can assemble those details from breach dumps, dark-web identity packages, public LinkedIn profiles, voter rolls, social posts, and data brokers. Reducing that exposure raises the cost of impersonation. Opting out of major people-search and data-broker sites cuts down the places where an attacker can get a full profile without phishing for it. Limiting publicly searchable birthdays, hometowns, employers, and family members’ names reduces the material available for the same purpose.
Phishing fills in what the attacker cannot find in public information. Messages posing as a bank or carrier may seek the missing credentials, so a request for a full Social Security number or account PIN by text or email is a practical warning sign. Data minimization does not eliminate the insider or credential-theft routes described earlier. A carrier lock, SIM-swap-resistant authentication across login and recovery, and reduced data exposure together make the attack materially harder to execute against an individual who applies all three.