/
/ 

SIM swapping: the attack that does not happen to you

2026-10-01 · Web3 Security A SIM swap moves your phone number to a stranger’s device by convincing your carrier to do it, and every authentication code you receive follows the number. The FBI recorded 971 SIM swap complaints and $17,366,758 in losses in 2025, a figure…

01 / 01 Sections Sections

2026-10-01 · Web3 Security

A SIM swap moves your phone number to a stranger’s device by convincing your carrier to do it, and every authentication code you receive follows the number. The FBI recorded 971 SIM swap complaints and $17,366,758 in losses in 2025, a figure that understates the problem because the theft that follows a swap is filed under whatever crime the victim reports.

Key findings

  • The FBI’s Internet Crime Complaint Center recorded 971 SIM swap complaints and $17,366,758 in reported losses in 2025, down from 982 complaints and $25,983,946 in 2024.
  • IC3 classifies complaints by the crime the victim reports, so downstream theft is filed under investment fraud, account takeover or identity theft. IC3 separately recorded roughly 4,700 account takeover complaints and $359.7 million in losses in 2025.
  • Joseph “Josh” Jones held an eight-digit account PIN and lost more than 1,500 bitcoin and roughly 60,000 bitcoin cash in a February 2020 SIM swap, per his counsel’s account of the arbitration award against T-Mobile.
  • The Ninth Circuit held on 30 September 2024 that Michael Terpin created a triable issue over whether AT&T gave hackers access to information protected by Section 222 of the Federal Communications Act, reversing summary judgment on that claim alone.
  • CISA’s guidance to highly targeted individuals states plainly: “Do not use SMS as a second factor for authentication.”
  • Enrolling an account in authenticator-based MFA does not remove SMS from it. CISA describes the leftover as “a weak, exploitable fallback mechanism”.

Case file

Field Value
Technique SIM swap, also called SIM hijacking or SIM splitting; and port-out fraud, the same outcome achieved through a different carrier
Mechanism Reassignment of a phone number to a SIM or eSIM profile the attacker controls, then password reset and one-time passcode interception
Entry points Retail counter with forged identification, call-centre social engineering, bribed carrier insider, carrier portal takeover with breached credentials, port-out through a second carrier, eSIM profile transfer
Reported US volume 971 complaints, $17,366,758 losses (2025); 982 and $25,983,946 (2024); 1,075 and $48,798,103 (2023); 2,026 and $72,652,571 (2022) — FBI IC3
Largest attributed theft Over $400 million from FTX on 11 November 2022, per the Department of Justice indictment unsealed February 2024
First US conviction Joel Ortiz, pleaded guilty February 2019, ten years
Insider pricing $500 to $2,000 per swap advertised on Telegram; a $3,500 bribe to one carrier employee named in the 2019 “The Community” indictment
Governing rule 47 CFR 64.2010(h) for SIM changes, 47 CFR 52.37 for port-outs, adopted in FCC 23-95, WC Docket No. 21-341
Leading authority Terpin v. AT&T Mobility LLC, No. 23-55375 (9th Cir. 30 September 2024), Desai J
Posture as of 1 October 2026 Active. Federal account-lock requirements exist and are opt-in. No published live test shows whether the locks hold against a support-desk override
Defensive action Enable the carrier account lock, both the SIM-change and port-out halves, then remove SMS from accounts that hold value

What the record shows

What is a SIM swap, exactly?

A SIM swap is the unauthorised reassignment of a mobile phone number to a SIM card or eSIM profile controlled by somebody other than the subscriber. The FBI’s Internet Crime Complaint Center defines it as “the use of unsophisticated social engineering techniques against mobile service providers to transfer a victim’s phone service to a mobile device in the criminal’s possession” (2025 Internet Crime Report, p. 61).

The victim’s handset loses service. The attacker receives every call and text sent to that number, including one-time passcodes and password reset links, and uses them to take over email, banking and cryptocurrency accounts.

Port-out fraud is the same outcome by another route: rather than changing the SIM at the subscriber’s existing carrier, the attacker opens an account at a different carrier and requests the number be transferred in. The Federal Communications Commission treats both as one problem in WC Docket No. 21-341, “Protecting Consumers from SIM Swap and Port-Out Fraud”.

How much is actually lost to it?

The FBI’s Internet Crime Complaint Center recorded 971 SIM swap complaints and $17,366,758 in reported losses in 2025 (2025 Internet Crime Report, p. 9). The reported series runs downward from a 2022 peak:

Year Complaints Reported losses
2022 2,026 $72,652,571
2023 1,075 $48,798,103
2024 982 $25,983,946
2025 971 $17,366,758

Read alone, that series suggests the problem is receding. It is better read as a measurement artefact, for a reason the FBI’s own methodology makes plain: IC3 classifies a complaint by the crime the victim describes, not by the technique that enabled it. A victim whose exchange account was emptied after a SIM swap files under investment fraud, personal data breach or identity theft, and the money is counted there.

Two figures in the same report support that reading. IC3 recorded roughly 4,700 account takeover complaints with $359.7 million in losses in 2025 (p. 12), and account takeover is the outcome a SIM swap produces. Separately, complaints with a cryptocurrency nexus reached 181,565 complaints and $11.366 billion in losses, at an average of $62,604 per complaint, with 18,589 complainants reporting losses above $100,000 each (p. 53).

The comparison worth making is jurisdictional. The UK fraud-prevention body Cifas recorded close to 3,000 unauthorised SIM swap cases in 2024 against 289 in 2023, an increase of roughly 1,055 per cent, on a counting method that records the technique rather than the downstream loss.

Who actually performs the swap?

Three routes are documented in charging papers, and none of them requires a technical exploit.

The retail counter. In the compromise of the US Securities and Exchange Commission’s X account on 9 January 2024, a false post announcing approval of spot bitcoin exchange-traded funds moved the bitcoin price by more than $1,000 before the hoax was corrected. Eric Council Jr. of Athens, Alabama produced a forged identity document and obtained a replacement SIM from a mobile phone store, defeating the SMS-based two-factor authentication on the account. He pleaded guilty and was sentenced to 14 months in May 2025, per the Department of Justice announcement reported by CNBC.

The call centre. Researchers at Princeton University signed up for 50 prepaid accounts across five US carriers, built call and message history on each, then telephoned the carriers posing as fraudsters. All five used authentication challenges that could be subverted, and 80 per cent of first attempts succeeded (Lee, Kaiser, Mayer and Narayanan, USENIX SOUPS 2020). The same team found 17 websites where an account could be compromised by a SIM swap alone, with no password required, and reported that nine of those companies had not fixed the issue after disclosure.

The insider. A fifteen-count federal indictment unsealed in May 2019 charged six members of a group calling itself “The Community” alongside three mobile carrier employees, who were charged with stealing subscriber identities in exchange for bribes. Reporting on the indictment by Brian Krebs records one carrier employee accepting a $3,500 bribe that produced a $100,000 theft, and one contractor performing 29 fraudulent SIM swaps. Criminal marketplaces on Telegram advertise access to carrier insiders at roughly $500 to $2,000 per swap, according to fraud researcher Frank McKenna.

The largest theft is a SIM swap, and the victim was an employee

On 11 November 2022, hours after FTX filed for bankruptcy protection, more than $400 million in cryptocurrency left the exchange’s wallets. The theft went unattributed for over a year.

In February 2024 the Department of Justice indicted three people. According to the indictment as reported by CNBC and by Brian Krebs, Emily Hernandez used a fraudulent identity document to convince AT&T to transfer an FTX employee’s phone number to a SIM the group controlled, and Robert Powell used the intercepted authentication codes to drain the wallets. Prosecutors described a SIM swapping ring operating from March 2021 through April 2023 with many victims besides FTX. The defendants are charged; charges are allegations and defendants are presumed innocent unless and until proven guilty.

The structural point survives the posture. The person whose number was stolen was an employee, not the company, and FTX’s own security arrangements were not the entry vector.

The same shape appears in the compromise of the risk advisory firm Kroll on 19 August 2023. An attacker SIM swapped a single Kroll employee, and in Kroll’s own account the carrier transferred the number without any contact with Kroll. That access exposed creditor data for the FTX, BlockFi and Genesis bankruptcy estates, which was immediately used in targeted phishing against people waiting for money.

What the courts have decided

Terpin v. AT&T Mobility LLC, No. 23-55375, is the leading US authority. Michael Terpin lost $24,000,000 after a January 2018 SIM swap and sued AT&T under the Federal Communications Act and California law.

On 30 September 2024 a Ninth Circuit panel of Clifton, H. Thomas and Desai JJ, in an opinion by Judge Desai, decided the appeal from the Central District of California (D.C. No. 2:18-cv-06975-ODW-KS, Wright J). The panel:

  • affirmed dismissal of the fraud claims, holding Terpin failed to allege that AT&T had a duty to disclose, and failed to allege AT&T made a promise with intent not to perform;
  • affirmed summary judgment on the breach of the Privacy Policy incorporated in the Wireless Customer Agreement, holding that consequential damages were barred by the limitation of liability clause;
  • affirmed summary judgment on the negligence claims, holding them foreclosed by the economic loss rule;
  • reversed and remanded on the claim under Section 222 of the Federal Communications Act, holding that Terpin “created a triable issue over whether, through the fraudulent SIM swap, AT&T gave hackers access to information protected under the Act.”

The panel expressly declined to decide whether Section 222 protects only customer proprietary network information or a broader category of customer proprietary information. That question remains open.

The practical reading for any subscriber: the contract route is weak, because the limitation of liability clause in a carrier agreement bars exactly the loss a SIM swap causes. The statutory route under Section 222 survived.

Arbitration has produced the larger disclosed recovery. Counsel for tech entrepreneur Joseph “Josh” Jones report a $33 million arbitration award against T-Mobile, arising from a February 2020 SIM swap in which more than 1,500 bitcoin and roughly 60,000 bitcoin cash were taken, and state that Jones had an eight-digit account PIN on the account at the time.

What I think is going on

The technique has not needed to improve, and that is the whole story. Joel Ortiz became the first person convicted of SIM swapping in the United States in February 2019, receiving ten years for thefts exceeding $5 million. His method and the method used against the SEC in 2024 are functionally the same: persuade a human being at a carrier to move a number. Six years of prosecutions have not changed the technique because they have not changed the thing it exploits.

What it exploits is a judgement call, not a system. Every case above turns on somebody at a carrier deciding who was on the phone or at the counter. A forged licence at FTX and at the SEC. A plausible story in the Princeton study, which succeeded four times in five. A $3,500 payment in “The Community”. The subscriber is not present for any of it.

That is why I think the standard advice is close to worthless as usually stated. Telling a holder to use a strong password and stay alert addresses a channel the attack does not use. Josh Jones had an eight-digit PIN. Michael Terpin was a professional in the industry who had already been swapped once. Your own security habits have very little bearing on whether the swap succeeds. They govern only how much it costs you afterwards.

The reported numbers are being read backwards. I expect the 2025 figure of 971 complaints to be cited as evidence that SIM swapping is fading. The more defensible reading is that it is a low-volume, high-severity attack whose victims skew heavily toward people with concentrated holdings, and whose losses are booked to other categories. A count that fell by 11 complaints while the adjacent account takeover category ran to $359.7 million is not measuring what the headline implies.

The open question is enforcement, not existence. Since 2024 every US carrier has been required to offer a free lock. What nobody has published is whether the lock holds when a support agent is asked to lift it. That is a measurable question and it is the one I would most like answered, which is why it is the subject of a separate quarterly audit.

What reduces your exposure

Each of these narrows a specific path. None of them closes all of them, and the first two are the only ones that touch the carrier-side failure that every case above depended on.

Turn on the carrier account lock, both halves. Most carriers split it into a SIM-change lock and a port-out lock and you need both, because they defend different routes. This is required to be free under 47 CFR 64.2010(h)(4) and 47 CFR 52.37(d). It stops the request from being processed at all; it does nothing about interception at the network signalling layer, and nothing about an attacker who has your carrier portal password. Menu paths for eighteen carriers, and the rule text behind them, are in the companion piece on the carrier lock.

Test the lock rather than trusting the toggle. Call your carrier from another phone and ask to move your number to a new SIM. If they do it, the setting did not take, whatever the app shows. A pass proves it held once, in one queue, on one day, which is a genuine limit on what the test tells you.

Set a carrier account PIN and put non-SMS multi-factor on the carrier account itself. CISA’s guidance recommends adding “a PIN and MFA to your mobile carrier account to reduce the risk of SIM-swapping techniques”. This closes the route where an attacker logs into the carrier portal with breached credentials and lifts the lock themselves. It does not help if the carrier’s own staff can override the lock.

Move accounts that hold value off SMS. CISA states: “Do not use SMS as a second factor for authentication,” and recommends FIDO phishing-resistant authentication, naming hardware security keys as most effective with passkeys an acceptable alternative. NIST SP 800-63B-4 (July 2025) classifies the use of the public switched telephone network for out-of-band authentication as the single restricted authenticator in the guidelines, at §3.2.9. Authenticator apps are better than SMS and are still phishing-vulnerable; only FIDO is phishing-resistant, on CISA’s own analysis.

Then check the account did not keep SMS as a fallback. This is the step most people miss and CISA calls it out specifically: “Enrollment in authenticator-based MFA does not automatically unenroll the account’s SMS. This can create a weak, exploitable fallback mechanism.” An account is only as strong as its weakest enabled factor. Check the recovery phone field separately from the two-factor field, because they are different settings.

Lock the messaging accounts your number controls. Your phone number is the identity on WhatsApp, Signal and Telegram, so a swap lets somebody register your account elsewhere and message your contacts as you. WhatsApp two-step verification, Signal Registration Lock and the Telegram two-step password each require a secret the SIM does not carry. They protect the account; they do nothing for messages already delivered or for a contact who has already been defrauded.

Ask whether the institutions holding your assets check for a recent SIM change before sending a code. NIST SP 800-63B-4 §3.1.3.3 states that verifiers “SHOULD consider risk indicators (e.g., device swap, SIM change, number porting, other abnormal behavior) before using the PSTN to deliver an out-of-band authentication secret”. Carrier APIs expose exactly that signal. Almost no consumer institution discloses whether it uses them, and asking is currently the only way to find out.

Sources

Disclosure. Max Avery is affiliated with Digital Ascension Group (DAG). Investment advisory services are offered through DAG Wealth, an SEC-registered investment adviser (CRD No. 328627). Registration does not imply a certain level of skill or training. DAG is not a law firm and does not provide legal or tax advice. Custody arrangements with third-party independent qualified custodians reduce certain risks but do not eliminate them. Nothing here is investment, legal, or tax advice, or a recommendation to buy or sell any asset. This article describes matters of public record; charges are allegations and defendants are presumed innocent unless and until proven guilty.

More from the journal

Continue reading.