SIM swap attacks have graduated from a niche fraud technique to a mainstream security risk. The FBI has issued an alert that should get the attention of anyone who relies on SMS-based authentication. According to the data, victims lost more than $68 million in a single year, a sharp increase over the $12 million reported across the prior three years combined. The agency received more than 1,600 complaints in 2021, up from 320 across 2018 to 2020.
That is a steep escalation. Let us break down what is happening, who is at risk, and what to do about it.
How a SIM swap works
A SIM swap is a social engineering attack against a mobile carrier. The attacker contacts the carrier and convinces the customer service team that they are the legitimate account holder, using personal information obtained through unofficial channels. The carrier transfers the phone number to a new SIM controlled by the attacker. From that moment, the attacker receives every SMS and voice call intended for the victim.
That includes the one-time passwords used for SMS-based multi-factor authentication on bank accounts, crypto exchanges, email, social media and corporate VPNs. Once the attacker controls the number, they control the authentication.
What the FBI data shows
The jump from $12 million over three years to $68 million in a single year is not a statistical blip. It reflects a technique that has become more widely known, more easily executed, and more profitable as crypto and digital financial services have grown.
Who should care
| Profile | Risk Level | Priority Action |
|---|---|---|
| Crypto investors | High | Switch to hardware wallet + non-SMS 2FA immediately |
| Online banking users | High | Move beyond SMS-based verification |
| Remote workers | Medium-High | Audit which accounts rely on SMS |
| Social media users | Medium | Use app-based authenticator where possible |
| General public | Low-Medium | Add port-out PIN; limit public personal data |
Prevention steps
The first job is to remove SMS as the only second factor on anything that matters. Use an authenticator app, a hardware token, or a passkey wherever the service supports it. SMS should be a fallback, not the primary.
The second job is to reduce the personal information that an attacker can use to social engineer your carrier. Most SIM swaps succeed because the attacker knows your full name, address, date of birth, and other details available through data breaches or social media. Ask your carrier to add a port-out PIN or a verbal verification step that is not based on data the attacker already has.
What to do if you are a victim
If you suspect a SIM swap has occurred, act fast. Contact your cellular network immediately to reclaim your number. Once restored, open your accounts and change your passwords without delay. Contact your financial institutions and request alerts for suspicious transactions. Review all recent activity carefully. Finally, consider signing up for an identity theft protection program to monitor and secure your personal information going forward.
Our analysis
The core trade-off in SIM swap defence is between carrier convenience and account security. Carriers built their customer service around fast porting to serve legitimate customers who want their number transferred quickly. That same speed is what makes SIM swap attacks devastating.
A second angle is the role of SMS-based MFA. It was always a weaker control, and the surge in SIM swap is the predictable outcome of relying on it for high-value accounts. The migration to authenticator apps, hardware keys and passkeys is overdue.
Watch for the next wave to target business mobile accounts, not just consumers. A successful swap on a senior executive's phone gives the attacker access to corporate email, password resets, and the rest of the company.
Bottom line
SIM swap is a high-impact, low-effort attack, and the FBI data shows it is growing fast. The fix is straightforward: stop using SMS as a primary authentication factor and add a port-out PIN to every mobile account you control.
Key takeaways
- Stop using SMS as a primary second factor on any high-value account.
- Add a port-out PIN or verbal verification step to every mobile account.
- Move executives and finance staff to hardware keys or passkeys.
- Act quickly if you suspect a swap: contact your carrier and financial institutions immediately.
Frequently asked questions
What is a SIM swap attack?
An attack where a fraudster convinces a mobile carrier to transfer a victim's phone number to a SIM card the attacker controls, then intercepts SMS-based authentication codes.
How much money have SIM swap victims lost?
According to the FBI, more than $68 million in a single year, up from about $12 million across the prior three years.
What is the best defence against SIM swap?
Remove SMS as the primary second factor. Use an authenticator app, hardware security key or passkey, and add a port-out PIN to your mobile account.
Are some accounts more at risk than others?
Yes. Bank accounts, crypto exchanges, email and any senior executive's accounts are the highest-value targets.
Should I contact my carrier if I suspect an attack?
Yes. Contact your cellular network immediately to reclaim your number, then change your passwords and alert your financial institutions.