WhatIsCrypto.info
BTC—ETH—BTC MAX SUPPLY21,000,000BTC MINED20,000,000+BLOCK REWARD3.125 BTCNEXT HALVING~2028BTC BLOCK TIME~10 MINETH BLOCK TIME12 SECETH TRANSFER21,000 GAS1 BTC100,000,000 SATS1 ETH1,000,000,000 GWEISTABLECOIN TARGET$1.00US CRYPTO FRAUD LOSSES 2025$11.4BCOINS ON COINGECKO~22,800FIRST BLOCKJAN 3 2009

SIM swap attacks

Your phone number is a weak key. Here's how to stop relying on it.

BeginnerAbout 7 minutesReviewed November 5, 2026
The short answer

In a SIM swap, a criminal convinces or bribes your mobile carrier to move your phone number to a SIM card they control. Your phone loses service, and every text-message code now goes to them, letting them reset your email and exchange passwords and withdraw your crypto. The fix is to stop using SMS for security: use an authenticator app or, better, a hardware security key or passkey.

The rule that never changes

Legitimate support will never ask for your seed phrase (recovery phrase) or private key. Not an exchange, a wallet maker, a lawyer, the police or the FBI. Anyone who asks for it, or asks you to type it into a website, is trying to steal from you.

How it works, step by step

  1. Research. The attacker collects your name, phone number, address and date of birth from data breaches and social media, often after you mentioned crypto publicly.
  2. The swap. They impersonate you to your carrier with a fake ID or leaked details, bribe an employee, or phish carrier systems, and have your number moved to their SIM or eSIM.
  3. Your phone goes quiet. You see "No service" or "SOS only."
  4. Resets. They request "forgot password" codes by text for your email, then use the email to reset your exchange accounts.
  5. Withdrawal. They change security settings, add their own withdrawal address and empty the account, often within an hour.

Real, dated examples

  • February 8, 2022: the FBI warned that SIM-swap complaints jumped from 320 between 2018 and 2020 (about $12 million lost) to 1,611 in 2021, with more than $68 million lost.
  • January 9, 2024: attackers SIM-swapped the phone number linked to the SEC's X account and posted a false announcement that bitcoin ETFs had been approved. Bitcoin jumped more than $1,000, then fell more than $2,000. One of the attackers, who used a fake ID to take over the number, was sentenced on May 16, 2025, to 14 months in prison.
  • 2025: IC3 recorded 971 SIM-swap complaints and $17.4 million in losses. Reported numbers are lower than at the 2021–2022 peak, but individual losses are often large.

How to protect yourself

  1. Switch two-factor authentication away from SMS. On your email and every exchange, turn on an authenticator app, or better, a hardware security key or passkey, which also resists phishing. Then remove your phone number as a login or recovery option where the service allows.
  2. Lock your number with your carrier. Add an account PIN and turn on the carrier's SIM-change or port-out protection (names vary, such as "number lock" or "SIM protection"). In November 2023 the FCC adopted rules requiring carriers to verify customers more securely before SIM changes and to notify them.
  3. Protect your email first. It's the master key to everything else. Use a unique password, a security key and recovery options that don't depend on your phone number.
  4. Use a withdrawal allowlist on exchanges, so new withdrawal addresses need a waiting period or extra approval.
  5. Keep holdings quiet. Don't post your balances, and consider a separate email address used only for crypto accounts.
  6. Self-custody savings. Coins on a hardware wallet can't be withdrawn by someone who takes over your phone number.

Warning signs

  • Your phone suddenly shows no service where it normally works.
  • Texts or emails from your carrier about a SIM change, eSIM activation or port request you didn't make.
  • Password-reset emails or "new login" alerts you didn't trigger.
  • A call from "your carrier" asking you to read out a code.

If it happened to you

  1. Call your carrier at once from another phone (using the number on its official website) to get your number back, and add a PIN and port-out lock.
  2. Secure your email, then each exchange: change passwords, remove the attacker's devices, check for new forwarding rules, API keys and withdrawal addresses, and ask the exchange to freeze the account.
  3. Write everything down before anything gets deleted: wallet addresses, transaction IDs (hashes), website addresses, usernames, phone numbers, screenshots of chats, dates and amounts.
  4. Report it to the FBI at ic3.gov and the FTC at reportfraud.ftc.gov. Reports are free. If funds land at a regulated exchange, law enforcement can sometimes freeze them, and speed matters. A local police report gives you a reference number for your bank or insurer.
  5. Contact the exchange you sent from, and the receiving exchange if the blockchain shows one, through its official website or app (never a number or link from a search ad or a stranger). Ask them to flag the addresses and the transactions.
  6. Expect a second scam. Victims are targeted again by fake "recovery" firms, fake lawyers and fake FBI agents. Real law enforcement never charges a fee. Read crypto recovery scams.

Need the steps in order? Use the emergency checklist for a compromised wallet or account.

Frequently asked questions

Is SMS two-factor authentication better than nothing?

Yes, but it's the weakest form because a SIM swap defeats it. An authenticator app is much better; a hardware security key or passkey is better still.

Can a SIM swap steal crypto from my hardware wallet?

Not directly. The coins are controlled by keys on the device and your seed phrase, not by your phone number. Exchange and custodial accounts are the main targets.

What is a port-out PIN?

A code your carrier requires before your number can be moved to another carrier. Most US carriers offer one, along with a setting that blocks SIM changes unless you turn it off.

Does an eSIM prevent SIM swapping?

No. Attackers can request an eSIM transfer in the same way. Carrier locks and non-SMS two-factor are what help.

Where to next

Sources

  1. Criminals increasing SIM swap schemes to steal millions of dollars from US public (FBI PSA, February 8, 2022)
  2. Alabama man sentenced to 14 months in connection with SEC X hack (DOJ, May 16, 2025)
  3. FBI IC3 2025 Internet Crime Report (published April 2026)
  4. FCC rules on SIM swap and port-out fraud (Federal Register, December 8, 2023)

Written for beginners and checked against the sources listed. Last reviewed November 5, 2026. This page is educational and is not financial, tax or legal advice. How we write and check pages.