What Is a SIM Swap Attack

A SIM swap attack (also known as SIM hijacking) is an attack technique where the attacker tricks a mobile carrier into transferring the victim's phone number to a SIM card controlled by the attacker. By seizing control of the phone number, the attacker intercepts two-factor authentication codes sent via SMS and gains unauthorized access to bank accounts, cryptocurrency wallets, email accounts, and more.

This attack is not technically sophisticated hacking but primarily uses social engineering. The attacker contacts the mobile carrier's customer support using personal information obtained through phishing or data breaches (name, address, date of birth, account number, etc.) and requests a number transfer by claiming "I lost my SIM card" or "I want to change my phone."

In Japanese procedures too, the opening is identity verification rather than technology. In a regulatory impact assessment published in January 2025, the Ministry of Internal Affairs and Communications noted that identification documents forged too convincingly to be spotted at a glance were being used to open mobile contracts fraudulently, and set out a plan to amend its ministerial ordinance so that remote verification by sending an image of an ID document, or by mailing a copy of one, is abolished.

Specific Techniques of SIM Swap Attacks

Collecting personal information: The attacker gathers the target's name, address, date of birth, phone number, and account information from phishing emails, publicly available SNS information, data leaked in past breaches, and details taken from markets where leaked data is traded.
Contacting the mobile carrier: Using the collected personal information, the attacker contacts the mobile carrier's customer support and impersonates the victim. They claim "I lost my SIM" or "I want to switch to a new device" and request the number be transferred to a new SIM.
SIM transfer: Once the mobile carrier passes the identity verification, the victim's phone number is transferred to the attacker's SIM. At this point, the victim's smartphone goes out of service and can no longer receive calls or SMS.
Account takeover: The attacker receives SMS authentication codes on the victim's phone number and logs into bank accounts, email accounts, cryptocurrency exchanges, etc. Password resets can also be performed via SMS, so accounts can be taken over even without knowing the password.

The number transfer and the movement of money run as one continuous sequence, so there are cases where the transfers are finished before the victim notices the phone has lost service and calls the carrier.

Defenses Against SIM Swap Attacks

Specific measures to protect yourself from SIM swap attacks.

Move away from SMS authentication: The core of the defense is to stop tying authentication to a phone number. Switching to TOTP (authenticator apps like Google Authenticator or Authy) or passkeys means authentication codes cannot be intercepted even if the phone number is stolen.
Protect the details of your carrier contract: Reissuing a SIM or porting a number normally requires the PIN you set when signing the contract. Avoid digits that are easy to guess, and do not reuse the same number on other services. Where the carrier offers a dedicated passcode or a lock on line changes, turn that on as well.
Minimize public personal information: Avoid publishing your date of birth, address, and phone number on social media. Reducing information attackers can use for identity verification lowers the success rate of social engineering.
Early detection of anomalies: If your smartphone suddenly goes out of service or stops receiving SMS, suspect a SIM swap attack and immediately contact your mobile carrier. The longer you wait, the more damage expands.
Email notifications for important accounts: Set up email notifications for login alerts and transfer notifications on bank accounts and cryptocurrency exchanges. This helps with early detection of unauthorized access.

SMS Authentication Risks and Alternatives

The fundamental problem behind SIM swap attacks is that SMS is weak as an authentication channel. In SP 800-63B, issued in June 2017, NIST (National Institute of Standards and Technology) classified authentication over the public switched telephone network (PSTN), including SMS and voice calls, as RESTRICTED, and required organizations that continue to use it to assess the risk and offer an alternative. That document was withdrawn in August 2025 and superseded by SP 800-63B-4.

SMS authentication is vulnerable for reasons beyond just SIM swapping.

SS7 protocol vulnerabilities: The SS7 protocol underlying the telephone network has design vulnerabilities that make SMS interception technically possible.
SMS interception by malware: Malware installed on Android devices can read SMS messages and forward them to attackers.

The options to move to are listed below. Choose according to what your services support and how you use them.

Passkeys: The credential is bound to the site domain, so it cannot be captured by phishing, and pairing with device biometrics keeps sign-in quick.
TOTP authenticator apps: One-time passwords generated on the device. Not dependent on communication channels, so unaffected by SIM swaps.
Hardware security keys: Physical devices like YubiKey. Phishing-resistant and widely adopted in enterprise environments.

Not all services support authentication methods other than SMS, but it is strongly recommended to prioritize migration for important accounts such as banking, email, and cryptocurrency.

To learn more about this topic, see Two-Factor Authentication (2FA): The Best Defense for Your Accounts.

Common Misconceptions

SIM swap attacks only target celebrities and wealthy individuals: Regular users who hold cryptocurrency or rely on SMS authentication for online banking are targeted as well. What decides whether you are attacked is not how well known you are, but what can be moved through the accounts tied to your phone number. Attackers assemble the identity details they need from leaked data, then work through a carrier store or support line one target at a time.
Japanese mobile carriers have strict identity verification so SIM swaps don't happen: When an identification document is forged convincingly, spotting it at the counter is far from easy. The Ministry of Internal Affairs and Communications has itself pointed to convincingly forged documents being used to open mobile contracts fraudulently. Carrier-side verification is being tightened, but as long as a phone number sits at the center of authentication, the risk does not fall to zero.

SIM Swap Attack