SIM swap: how they drain your accounts through your phone number

Your phone suddenly shows no service, even though you are at home in full coverage. You take it as an operator outage. An hour later you find your bank account empty and someone changing the passwords to your accounts. This is not a fault, this is a SIM swap, one of the nastiest scams, because it bypasses even SMS verification, which most people trust.

What SIM swap is

SIM swap is a takeover of your phone number. The attacker convinces a mobile operator that you lost your SIM card and has the number moved onto their card or eSIM. From that moment your calls and texts go to them and your SIM loses signal. They do not need your phone physically, enough data about you is enough.

Why it is so dangerous

The problem is what a phone number is used for these days:

• Verification codes for many services arrive by SMS.
• A forgotten password can be reset by SMS.
• Whoever controls the number takes over email, bank and other accounts through these texts, even without knowing the original passwords.

That is exactly why SMS as the only two-factor authentication is weak.

How the attack plays out

1. The attacker gathers data about you from data breaches and phishing, meaning your name, number, date of birth and sometimes even answers to security questions.
2. They contact the operator posing as you, claiming they lost the SIM.
3. The operator moves the number onto the attacker’s card or eSIM.
4. Your SIM stops working and the phone shows no service.
5. The attacker resets passwords via SMS and drains what they can.

Warning signs

• Sudden loss of signal for no reason, even though you are in coverage.
• A text or email about a SIM change you did not request.
• Suddenly your calls and data do not work while Wi-Fi does.

If this happens, act at once, every minute works against you.

How to protect yourself

• Do not use SMS as your only verification. Move to an authenticator app or, even better, passkeys.
• Set a password or PIN with your operator to protect the number. Without it the transfer should not happen.
• Use strong, different passwords and a password manager, so one breach does not bring everything down.
• Watch out for phishing and scam calls from the bank, which the attacker uses to collect the needed data.
• Share your number thoughtfully, especially together with other personal data.

When it does happen

Immediately contact your operator to return the number to you and block the attacker’s SIM. Then contact your bank as fast as possible, change the passwords of important accounts and check your email. Further steps are in the article on what to do when your account is hacked.

Want to go through your account security before something happens? Get in touch and we will help set up verification that a SIM swap cannot bypass.

This article is part of our Cybersecurity overview.