SIM swap attack
Cell phone account takeover fraud
- 4 min read
- 2 chapters
Related on Lably
Through Multi-factor authentication, Phishing and Identity theft
Method
The fraud exploits a mobile phone service provider's ability to seamlessly port a phone number to a device containing a different subscriber identity module (SIM). This mobile number portability feature is normally used when a phone is lost or stolen, or a customer is switching service to a new phone.
The scam begins with a fraudster gathering personal details about the victim, either by use of phishing emails, by buying them from organised criminals, directly socially engineering the victim, or by retrieval from online data breaches.
Armed with these details, the fraudster contacts the victim's mobile telephone provider. The fraudster uses social engineering techniques to convince the telephone company employee to port the victim's phone number to the fraudster's SIM. This is done, for example, by impersonating the victim using personal details to appear authentic and claiming that they have lost their phone. Alternatively, fraudsters bribe telecom employees to port the victim's phone number to a new SIM. In some countries, notably India and Nigeria, the fraudster will have to convince the victim to approve the SIM swap by pressing 1.
Once they have a victim's personal information, attackers commonly impersonate them while contacting technical support services for their telecommunication provider and attempt to convince the employees to switch the victim's phone number to their SIM card. In some cases telephone company employees have been bribed by attackers to directly change SIM numbers. Attackers have sought out employees of companies including T-Mobile and Verizon through social media or employee directories in attempts to bribe them, sometimes promising money in cryptocurrency for each phone number they transferred.
Once this happens, the victim's phone will lose connection to the network, and the fraudster will receive all the SMS and voice calls. This allows the fraudster to intercept one-time passwords sent via text or telephone calls to the victim's number and thus subvert two-factor authentication methods relying on them. Since so many services allow password resets with only access to a recovery phone number, the scam allows criminals to gain access to almost any account tied to the hijacked number. This may allow them to directly transfer funds from a bank account, extort the rightful owner, or sell accounts on the black market for further identity theft and fraud.
Sign in to keep reading
One more chapter is free with a Lably account.
Incidents
A number of high-profile hacks have occurred using SIM swapping, including some on the social media sites Instagram and Twitter. In 2019, Twitter CEO Jack Dorsey's Twitter account was hacked via this method.
In December 2018, digital currency investor Michael Terpin – the founder and chief executive officer of Transform Group – filed a lawsuit against Nicholas Truglia, and in May 2020 filed a second lawsuit against 18-year-old Irvington High School senior in Irvington, New York, Ellis Pinsky, accusing them and 20 co-conspirators of swindling $23.8 million in 2018 through the use of account information stolen from smartphones by SIM swaps. At the time, Truglia was 18 years old and Ellis was 15. Truglia was sentenced to 18 months in prison and ordered to pay back $20 million, and Pinsky was ordered to pay back $22M but, as a minor, avoided prison.
The Microsoft Digital Defense Report 2024 stated that less than one-third of one percent of identity attacks use SIM swapping (compared to 99 percent for breach replay, password spray, and phishing).
The US FBI received 1,600 complaints about SIM-swapping in 2021, an increase of more than 400 percent from 2018. "The FBI says that victims lost $68 million to this SIM-card based scam in 2021, compared to just $12 million combined from 2018 through 2020." SIM swap complaints to the FBI in 2022 rose 26 percent, to 2,026, then dropped by 47 percent to 1,075 in 2023, and dropped by 9 percent to 982 in 2024. The peak in 2022 represented less than 0.3 percent of all reported Internet crimes, including phishing/spoofing (44 percent), data breach (8 percent), and identity theft (4 percent).
SIM swap reports to the UK National Fraud Database rose over 1,000 percent from 2023 to 2024, but the 2,760 reported cases represented less than one percent of all fraud reports.
Kenya’s Safaricom, which serves about two-thirds of Kenya’s 70 million phones, experienced a 327 percent increase in SIM swapping from 2024 to 2025, a jump from 11 cases to 47.
In South Korea, various alleged incidents of SIM swapping attacks have been documented since the beginning of 2022. The common pattern includes victims facing abrupt disruptions in their mobile services, coupled with a notification suggesting a change. As a result, affected individuals discover that their bank and cryptocurrency accounts have been compromised.