What is SIM swap?

An attack in which someone takes over your phone number by persuading or bribing the carrier to move it to their own card, then uses text message codes to reset your accounts.

It is the reason text-message verification is the weakest second factor. Move exchange and email accounts to totp or a passkey.

Crypto holders are targeted disproportionately because the payoff is irreversible. A bank transfer can sometimes be recalled. A withdrawal from an exchange to an attacker's wallet cannot.

How it works

The attack has three steps and only the first is technical in any interesting sense.

First, the attacker gathers enough personal detail to impersonate you to a carrier: name, address, date of birth, the last four digits of a payment card. Data breaches and public records supply most of it. Some cases skip this entirely by bribing or socially engineering a retail store employee.

Second, the number is ported or reassigned to a card the attacker controls. Your phone loses service, which is the one visible warning sign and is easily mistaken for an ordinary outage.

Third, the attacker runs password resets. Email is usually the first target, because whoever controls the email inbox controls most other resets. Then the exchange account, using the text-message code that now arrives on their device.

The United States Federal Communications Commission adopted rules requiring wireless providers to authenticate a customer before transferring a number to a new device or carrier, and to notify the customer of such requests (source: Federal Communications Commission SIM swap and port-out fraud rules). Those rules raise the bar on the carrier side. They do not remove the exposure created by an account whose only second factor is a text message.

Example

Illustrative sequence. An account holder keeps $5,000 on an exchange, with text-message two-factor authentication and no withdrawal whitelist. At 2am their phone loses signal. By 2:20am the attacker has reset the email password, by 2:35am the exchange password, and by 2:50am the balance is withdrawn to an address the attacker controls. Every step used a code sent to a number that was no longer the account holder's. The exchange did nothing wrong by its own rules, and the funds are gone.

The single change that most often breaks this chain is a withdrawal address whitelist with a time delay, because the delay outlasts the attacker's window even when every code is intercepted.

Why it matters when you buy

The security controls a venue offers are part of what you are choosing between, alongside price. The exchange pages list what each venue supports, and the two-factor authentication guide walks through moving an account off text messages.

Related terms

• totp — app-generated codes that are not sent anywhere
• passkey — a phishing-resistant login factor
• two factor authentication — the control being attacked
• withdrawal whitelist — the delay that survives a takeover
• phishing — how the personal details are often collected

Questions

Will a carrier port PIN stop this?

It helps and it is worth setting, since it forces the attacker to obtain one more piece of information. It has not stopped attacks that involve a cooperating or careless employee, so treat it as one layer rather than the answer.

What should I change first?

Remove text messages as a recovery and second-factor option on your email account, then on the exchange. Email is the pivot point in almost every recorded case.

Does a hardware wallet protect me?

It protects coins you already hold yourself. It does nothing for a balance sitting on an exchange account that an attacker can log into, which is why the exchange controls matter separately. See self custody.