Research Brief

SIM swapping (also known as SIM hijacking or simjacking) is a type of account takeover fraud where attackers deceive or bribe mobile carriers into transferring a victim's phone number to a SIM card they control. The attacker performs the SIM swap by manipulating the mobile carrier, often through social engineering tactics to deceive telecom providers or, in some cases, by bribing telephone company employees to directly change SIM numbers. This breach grants them access to calls, texts, and crucially, SMS-based two-factor authentication (2FA) codes, often the final barrier protecting sensitive accounts.

The threat is escalating rapidly. In the FBI's Internet Crime Report 2024, SIM Swap appears as its own crime type with 982 complaints and $25,983,946 in losses. The UK saw nearly 3,000 unauthorised SIM swaps filed in 2024, described as a 1,055% surge, while Australia reported a 240% increase in people seeking help for phone porting and SIM swap fraud in 2024 versus 2023, with 90% happening without the victim's engagement. In March 2025, T-Mobile was ordered to pay $33 million in an arbitration case after a single SIM swap allowed thieves to drain a customer's cryptocurrency wallet. In 2021 alone, the FBI's IC3 received 1,611 complaints related to SIM swapping, with adjusted losses exceeding $68 million.

Protection requires multiple layers. Carrier-level SIM lock is the primary defense: When SIM Protection is enabled on a line, the status of the line is changed to Locked. A Locked line cannot process a SIM change and device upgrade until the SIM Protection is turned off. This ensures that your number is protected from SIM swapping. All major US carriers offer this free feature but it must be manually enabled: For Verizon, it's "Number Lock" and "SIM Protection" in the My Verizon app. For T-Mobile, it's "Port Out Protection" and "SIM Protection" on their website or app. For AT&T, it's "Wireless Account Lock" in the myAT&T app. Device-level SIM PIN is a separate protection: On an Apple device, go to Settings → Cellular → SIM PIN. On an Android device, go to Settings → Security & Privacy → SIM card lock → Lock SIM card. However, SIM Card Lock does NOT protect against SIM SWAP attacks—it only prevents someone who steals your physical phone from using the SIM in another device. Authentication method is critical: Avoid using 2FA with one-time codes by text. For your 2FA needs, it's better to use an authenticator app and a FIDO U2F hardware key. The safest methods are hardware security keys (like YubiKey) and FIDO2 passkeys, as they are immune to both SIM swapping and phishing. The next best option is an authenticator app (like Google Authenticator). The least secure method is SMS-based 2FA.

Rivka Tadjer is a cybersecurity expert featured on the Detonation Point podcast. Rivka Tadjer spent 20 years as a business and tech journalist, covering privacy, security, identity theft, data mining, artificial intelligence and supply chains. Tadjer serves BSS Unit with her background in business infrastructure, development, vertical market vulnerabilities, market predictions and profiling. She served as a Point of Contact for the White House National Infrastructure Advisory Council (NIAC), on the Cyber Security research and working groups for critical infrastructure. Detonation Point is hosted by Matt O'Neill, a former US Secret Service Deputy Special Agent, who shares insights from his 25-year career, exploring the ongoing battle against cyber threats.