A SIM swap attack (also called SIM hijacking or SIM splitting) is when an attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they can reset passwords and drain crypto accounts.
How SIM Swapping Works
- Research — Attacker gathers personal info (email, DOB, address) from data breaches or social media
- Social engineering — Attacker calls your mobile carrier, pretends to be you, claims they lost their SIM
- Transfer — Carrier activates a new SIM with your number
- Access — Attacker uses SMS-based 2FA to reset your exchange, email, and social media passwords
- Drain — Attacker transfers crypto to their own wallets
Why It’s Dangerous
| Factor | Why It Works |
|---|---|
| Carrier support is your weakest link | Customer service reps are trained to help — not to suspect fraud |
| SMS is insecure | SMS text messages can be intercepted or redirected |
| Personal data is abundant | Your DOB and address are likely in a data breach already |
| Recovery is difficult | Once the attacker changes your passwords, recovering accounts is complex |
High-Profile SIM Swap Attacks
- Michael Terpin — Lost $24M in crypto (won $75M lawsuit against AT&T)
- Various Twitter accounts — High-profile Twitter accounts taken over via SIM swaps
- Crypto influencers — Dozens of crypto Twitter personalities have been SIM swapped
How to Protect Yourself
1. Remove SMS 2FA
The single most important step. Stop using SMS for two-factor authentication.
| 2FA Method | Security Level |
|---|---|
| SMS | ❌ Not secure |
| Authenticator app (Google Authenticator, Authy) | ✅ Secure |
| Hardware key (YubiKey, Trezor) | ✅ Most secure |
| Email-based 2FA | ⚠️ Somewhat secure (if email is protected) |
Swap every account from SMS to authenticator app or hardware key.
2. Add a PIN or Password to Your Mobile Account
Most carriers allow you to add an account PIN or password. This creates an extra barrier for SIM swaps.
| Carrier | How to Add PIN |
|---|---|
| T-Mobile | Account takeover protection in settings |
| AT&T | Wireless passcode (4–8 digits) |
| Verizon | Account PIN in your profile |
| EE (UK) | Account password on your account |
| Vodafone (UK) | Security question or PIN |
3. Use a Google Voice Number (US)
If you must use SMS, get a Google Voice number and use that instead of your mobile number. Google Voice numbers are harder to SIM swap.
4. Monitor Your Mobile Signal
If you suddenly lose mobile service when you normally have coverage, your SIM may have been swapped. Act quickly:
- Call your carrier immediately
- Check your email for account change notifications
- Start recovery of crypto exchange accounts
5. Use a Hardware Wallet
Funds on a hardware wallet cannot be drained by a SIM swap. The attacker would still need physical access to your device and PIN.
What to Do If You’re SIM Swapped
| Step | Action |
|---|---|
| 1 | Call your carrier to regain your number |
| 2 | Change passwords for all linked accounts |
| 3 | Check exchange accounts for unauthorised activity |
| 4 | Contact exchanges to freeze withdrawals |
| 5 | File a police report |
| 6 | Report to your local cybercrime unit |
Bottom Line
SIM swapping is one of the most dangerous crypto threats because it targets a weak link — mobile carriers — not your crypto security directly. Remove SMS 2FA from every account today. Use authenticator apps or hardware keys. Add a carrier PIN. And never rely solely on your phone number for crypto account security.