What’s actually happening
SIM swap fraud works by targeting the weakest link in the chain, which usually isn’t your phone at all. It’s your mobile carrier. An attacker gathers enough personal details about you, often pulled from old data breaches, social media, or a convincing phone call, to impersonate you to your carrier’s customer service. Once they’ve convinced the carrier they’re you, they request your phone number be transferred to a SIM card they control. From that moment, your number belongs to them. Calls and texts meant for you, including the one-time codes banks and email providers send to verify your identity, go straight to the attacker instead.
The FBI’s Internet Crime Complaint Center has tracked this specifically since 2018 and issued a formal public warning describing the pattern. Even as reported dollar losses have moved up and down year to year, officials have been clear that the reported numbers understate the real scope, since a SIM swap is usually just the first step. The actual financial damage, often draining a bank or cryptocurrency account, tends to get logged under a different fraud category entirely, separate from the SIM swap that made it possible.
Why this one is unusually hard to see coming
Most scams give you some kind of warning sign to notice, a suspicious link, an urgent text, an unfamiliar caller. SIM swapping often gives you almost nothing until it’s already happened. The IC3 has noted that a large share of these attacks occur without any interaction from the victim at all. The first sign most people get is simply losing cell signal entirely, which is easy to dismiss as a network glitch rather than recognize as an active attack in progress.
The practical takeaway
The FBI’s own recommendations are specific and worth taking seriously. Set up a PIN or passcode directly with your mobile carrier that’s required before any account changes, including SIM transfers. Avoid posting details about financial accounts, cryptocurrency holdings, or your phone number publicly on social media, since that’s exactly the kind of information used to pass a carrier’s identity check. And move away from SMS text messages as your primary method for account security codes wherever possible, using an authenticator app or a physical security key instead, since those aren’t tied to a phone number that can be hijacked.
If your phone suddenly loses all service with no explanation, especially after receiving an unexpected message about your account, treat it as a possible SIM swap in progress and contact your carrier immediately from another phone.
Reference
Federal Bureau of Investigation, Internet Crime Complaint Center, “Criminals Increasing SIM Swap Schemes to Steal Millions of Dollars from US Public.” https://www.ic3.gov/PSA/2022/PSA220208
