SIM swapping, how your number gets stolen without anyone ever touching your phone

The article on two-factor authentication mentioned SIM swapping as one of the weaknesses of SMS-based codes, without going into how it actually works. This attack deserves its own explanation: unlike most threats already covered on this site, it never targets the victim's device directly.

The principle: stealing a number, not a device

SIM swapping consists of transferring a phone number to a SIM card controlled by an attacker, by convincing the phone carrier's customer service that they are the legitimate owner of that number. This usually relies on personal information gathered in advance, often from an earlier data breach or from social media (see the dedicated article), enough to pass the identity verification questions the carrier asks.

What the attacker gets once the transfer is done

Once the number has been transferred, every call and every text message meant for the victim goes straight to the attacker instead, including two-factor authentication codes sent by SMS. The victim's own phone immediately loses all connection to the mobile network, a concrete signal that is often misread in the moment. With that number in hand, the attacker can then reset passwords on accounts that use the phone as a recovery method, or approve an SMS-based two-factor prompt meant to protect an account that was otherwise properly secured.

Why it works even against careful people

Most of the attacks already described on this site target a decision made by the victim directly: clicking a link, answering a call, typing a password. SIM swapping works differently: the social engineering (see the dedicated article) targets the phone carrier's own customer service, not the victim, who can have their number stolen without making a single mistake themselves. That distinction is exactly what makes this attack so frustrating to prevent through personal vigilance alone.

How to spot a swap in progress or already done

• A sudden, unexplained loss of mobile network signal, with no known outage at the carrier
• A carrier notification confirming a SIM card change that was never requested
• Suddenly being unable to log into an account that normally relies on phone-based verification

Good habits

• Avoid relying on SMS for two-factor authentication on the most sensitive accounts whenever possible, preferring a dedicated app or a physical security key instead (see the article on two-factor authentication for the real differences between these methods)
• Enable an extra security code or passphrase with the carrier for any change to the line, if that option is offered
• React immediately to an unexplained loss of signal by contacting the carrier through an independent channel, rather than assuming a simple outage
• Limit the personal information shared publicly, since it serves as direct raw material for this kind of attack

SIM swapping is a reminder that protection doesn't only depend on personal habits: it also depends on how solid a third party's own verification process is, here the phone carrier, something the victim has no direct control over.