What is SIM swapping
SIM swapping is an attack where a victim’s phone number is transferred to a SIM card controlled by the criminal. The attacker contacts the operator, impersonating the subscriber, and requests a SIM duplicate or number transfer. After hijacking the number, the criminal receives verification SMS messages, 2FA codes, and can reset passwords for banking, email, and cryptocurrency accounts. In 2025, Europol reported SIM swapping losses in the EU at EUR 120M.
How criminals execute a SIM swap
Social engineering on customer service
Criminals call the operator’s helpline, impersonate the subscriber, and use previously obtained data (SSN, address, date of birth) for authentication. The customer service agent issues a SIM duplicate.
Corrupting employees
In some cases, criminals bribe retail store employees for $200-500 per swap.
Phishing for authentication data
Collecting data needed for authentication: phishing, database leaks, social media mining.
Exploiting porting processes (MNP)
Exploiting gaps in the number porting process between operators (Mobile Number Portability).
Consequences of SIM swapping
For the subscriber:
- Loss of bank account access and fund theft
- Hijacking of email, social media, and crypto accounts
- Identity theft — loans taken out in victim’s name
- Average loss: $1-10K (for crypto: potentially millions)
For the operator:
- Loss of customer trust
- Legal liability and compensation
- Regulatory fines
- Reputational damage
How operators can protect subscribers
-
Multi-level identity verification — PIN/password in addition to standard personal data. Biometric verification (voice) on helpline.
-
SIM duplicate activation delay — 24-48h delay with SMS/email notification to old SIM and alternative contact channels.
-
SIM change alerts — automatic email/push notification when SIM card is changed or number ported.
-
Customer service training — regular social engineering recognition training, escalation procedures for suspicious attempts.
-
Anomaly monitoring — detecting patterns: multiple duplicate SIM attempts, SIM change after contact data change, activity from new location.
-
Bank cooperation — information sharing about suspicious SIM changes, SIM status verification before transaction authorization.
Cybersecurity for Your Industry
Learn more about cybersecurity in your industry:
Why this matters for organizations
SIM swapping allows criminals to hijack victims’ phone numbers and access bank accounts and crypto wallets. How to protect against it? In the context of growing cyber threats and tightening regulations (NIS2, DORA), organizations must proactively manage this security area. Failure to implement adequate safeguards can lead to data breaches, financial penalties, and reputational damage.
Best practices for implementation
Effective implementation requires several key steps:
- Risk assessment and inventory — identify assets, threats, and vulnerabilities specific to your organization.
- Policy development — document requirements, roles, and responsibilities.
- Technical controls — deploy tools and configurations proportionate to identified risks.
- Training and awareness — engage employees in protecting organizational security.
- Monitoring and continuous improvement — regularly verify effectiveness and adapt to the evolving threat landscape.
