How SIM-swap fraud steals your phone number and empties your accounts

How the attack works, step by step

It is a customer-service attack, not a technical hack. Nobody breaks into your phone: the criminal talks your carrier into handing over your number, and the carrier’s own systems do the rest.

1. Reconnaissance. Your name, number and fragments of ID leak from data breaches and social media. That is usually enough raw material.
2. The call. The criminal phones your carrier, claims the phone was lost, and asks for the number to be moved to a new SIM. Weak identity checks — a date of birth, an address — wave it through.
3. The silence. Your own phone drops off the network. Most victims assume a local outage and wait.
4. The drain. Every “forgot your password?” text now lands on the criminal’s SIM. Email first — because email resets everything else — then banking, crypto and betting accounts, in that order.

Why betting and crypto accounts are hit first

Betting and crypto accounts combine three properties criminals want: balances that can be withdrawn or transferred within minutes, customer support that still treats the phone number as proof of identity, and owners who keep meaningful sums in them. A bank may hold a suspicious transfer; a betting balance emptied to a mule account is simply gone — and the attacker only needs the account for the few minutes the codes stay valid, long before the owner next logs in.

The two settings that stop most of it

1. A port-out PIN on your mobile account

Ask your carrier — in the app, or by phone — for a SIM-change / port-out PIN that only you know. With one set, the “lost phone” story fails: the swap cannot be completed without the PIN, and the attack ends at the customer-service desk.

2. An authenticator app instead of SMS codes

On every account that holds money — email first, then bank, crypto and betting — replace text-message codes with an authenticator app (or a hardware key). The codes then live on your physical phone, and a stolen number receives nothing.

Two supporting steps finish the job: give the email account its own unique password, never reused anywhere (the email inbox is the master key to every reset), print the recovery codes and keep them offline, and warn anyone in the household whose name or details could be used to pass a carrier’s identity check.

If your phone suddenly shows “no service”

Treat it as a break-in in progress, not a network fault. From another phone: call your carrier and demand the number be frozen and restored; then your bank; then change the email password and the passwords of any account holding money. Speed matters more than order — the drain is usually finished within the hour.

References

This page summarises the attack pattern and the standard defences documented by mobile carriers, national fraud-reporting bodies and account-security teams:

1. Action Fraud — the UK’s national reporting centre for fraud and cybercrime: guidance on SIM-swap and mobile-account fraud. actionfraud.police.uk
2. FBI Internet Crime Complaint Center (IC3) — public reporting and advisories on SIM swapping. ic3.gov
3. Mobile carrier guidance on port-out PINs and SIM locks, set in the carrier’s app or by phone.
4. Exchange and betting operators’ account-security documentation on authenticator apps, recovery codes and withdrawal holds.

This page gives consumer-protection information; it makes no claim about any individual operator’s security.